Knot DNS

https://www.knot-dns.cz/docs/3.1/singlehtml/
Admin
Knot DNS is a high-performance open-source authoritative DNS server that reliably serves top-level...
Tokens:76,180
Snippets:827
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Example 2: Zonefileless setup (zonefile-sync: -1, zonefile-load: none, journal-content: all)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone contents are stored only in the journal. Suitable for secondary servers. Requires careful tuning of journal-size options to avoid the journal getting full.

```text
zonefile-sync: -1
zonefile-load: none
journal-content: all

```

--------------------------------

### Install Knot DNS with make install

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to install the binaries and configuration files. Non-root users may need to use sudo or su -c.

```bash
$ make install

```

--------------------------------

### Add example.org zone with a zonefile location

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Starts a transaction, sets the zone and its file location, then commits the transaction.

```bash
$ knotc conf-begin
$ knotc conf-set 'zone[example.org]'
$ knotc conf-set 'zone[example.org].file' '/var/zones/example.org.zone'
$ knotc conf-commit

```

--------------------------------

### Example configuration initialization with knotc conf-begin, conf-set, conf-diff, conf-commit

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

A complete example of initializing a configuration: begin a transaction, set server listen addresses, define a remote master server, set a template with storage and master, add a zone, show the diff, and commit. Note that some server parameters (rundir, user, pidfile, tcp-reuseport, udp-workers, tcp-workers, background-workers, listen) require a server restart to take effect.

```bash
$ knotc conf-begin
$ knotc conf-set 'server.listen' '0.0.0.0@53' '::@53'
$ knotc conf-set 'remote[master_server]'
$ knotc conf-set 'remote[master_server].address' '192.168.1.1'
$ knotc conf-set 'template[default]'
$ knotc conf-set 'template[default].storage' '/var/lib/knot/zones/'
$ knotc conf-set 'template[default].master' 'master_server'
$ knotc conf-set 'zone[example.com]'
$ knotc conf-diff
$ knotc conf-commit

```

--------------------------------

### Start and inspect server directly in gdb

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Commands to start knotd under gdb with a configuration file and run it to reproduce an error, allowing direct inspection in the debugger.

```bash
$ gdb --args knotd -c /etc/knot.conf
(gdb) run
...

```

--------------------------------

### queryacl module example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example configuration for the 'queryacl' module, allowing queries from specified address ranges and target interface, applied per-zone.

```yaml
mod-queryacl:
  - id: default
    address: [192.0.2.73-192.0.2.90, 203.0.113.0/24]
    interface: 198.51.100

zone:
  - domain: example.com
    module: mod-queryacl/default

```

--------------------------------

### kdig: DNS over HTTPS examples

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Various DoH implementations using different servers and options.

```bash
$ kdig @1.1.1.1 +https example.com.
$ kdig @193.17.47.1 +https=/doh example.com.
$ kdig @8.8.4.4 +https +https-get example.com.
$ kdig @8.8.8.8 +https +tls-hostname=dns.google +fastopen example.com.

```

--------------------------------

### Get the primary servers for the example.com zone

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the master configuration item for the example.com zone. The zone name is specified in brackets.

```bash
$ knotc conf-read 'zone[example.com].master'

```

--------------------------------

### GeoIP module configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

An example configuration for the GeoIP module, specifying a config-file, TTL, mode, GeoLite2 database file, and geodb-key for country and city.

```yaml
mod-geoip:
  - id: default
    config-file: /path/to/geo.conf
    ttl: 20
    mode: geodb
    geodb-file: /path/to/GeoLite2-City.mmdb
    geodb-key: [ country/iso_code, city/names/en ]

zone:
  - domain: example.com.
    module: mod-geoip/default

```

--------------------------------

### kdig: Get A records for example.com

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Basic query to retrieve A records for example.com using kdig.

```bash
$ kdig example.com A

```

--------------------------------

### Check zone files with knotc zone-check

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc zone-check example.com` to validate zone files before starting the server in primary (master) mode.

```bash
$ knotc zone-check example.com

```

--------------------------------

### Statistics configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example of a statistics section configuration. The timer sets the period for writing statistics metrics to the file. The file path defaults to rundir/stats.yaml. The append option, when enabled, appends to the file instead of replacing it.

```yaml
statistics:
    timer: TIME
    file: STR
    append: BOOL

```

--------------------------------

### khost: Get A, AAAA, and MX records

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Simple lookup for example.com retrieving A, AAAA, and MX records.

```bash
$ khost example.com

```

--------------------------------

### Logging configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example of a log section configuration. The target can be stdout, stderr, syslog, or a file name. The server, control, zone, and any options set minimum severity levels for different message types. If the log section is missing, warning and more serious messages go to stderr and syslog, while info and notice go to stdout.

```yaml
log:
  - target: stdout | stderr | syslog | STR
    server: critical | error | warning | notice | info | debug
    control: critical | error | warning | notice | info | debug
    zone: critical | error | warning | notice | info | debug
    any: critical | error | warning | notice | info | debug

```

--------------------------------

### Example 4: Auto-increment SOA serial (zonefile-sync: -1, zonefile-load: difference-no-serial, journal-content: all)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Similar to Example 3 but the server handles SOA serial automatically. Requires journal-content: all to preserve the last real SOA serial across restarts.

```text
zonefile-sync: -1
zonefile-load: difference-no-serial
journal-content: all

```

--------------------------------

### Pregenerate future ZSKs with keymgr pregenerate

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Generates ZSKs for the example.com zone for 6 months ahead. The newly-generated ZSKs remain non-published until their rollover starts.

```bash
$ keymgr -c /path/to/ZSK/side.conf example.com. pregenerate +6mo

```

--------------------------------

### Start a writing transaction with knotc zone-begin

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Opens a writing transaction on all zones or on specific zones. Use the ``--`` argument to target all zones, or list zone names to target specific zones.

```shell
$ knotc zone-begin --
$ knotc zone-begin example.com example.net

```

--------------------------------

### kxdpgun: Manually created queries file

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example queries file for kxdpgun, one query per line in the format 'query_name query_type [flags]'. Flags E (EDNS) and D (DNSSEC) are shown.

```text
abc6.example.com. AAAA
nxdomain.example.com. A
notzone. A
a.example.com. NS E
ab.example.com. A D
abcd.example.com. DS D

```

--------------------------------

### Get the list of the current zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the zone.domain configuration item to list all configured zones.

```bash
$ knotc conf-read zone.domain

```

--------------------------------

### Show per-zone statistics with knotc zone-stats

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc zone-stats` to display statistics for a specific zone and module. The example shows all mod-stats counters for the `example.com` zone.

```bash
$ knotc zone-stats example.com mod-stats

```

--------------------------------

### dnsproxy example configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configures a remote server and the mod-dnsproxy module to forward queries for zones not in local.zone. Queries for local.zone are answered locally; others are forwarded to 10.0.1.1.

```yaml
remote:
  - id: hidden
    address: 10.0.1.1

mod-dnsproxy:
  - id: default
    remote: hidden
    fallback: on

template:
  - id: default
    global-module: mod-dnsproxy/default

zone:
  - domain: local.zone

```

--------------------------------

### kdig: Query SOA with TLS, certificate checks, and debug

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets SOA record for example.com using TLS with system certificates, hostname check, certificate pin, and debug output.

```bash
$ kdig -d @185.49.141.38 +tls-ca +tls-host=getdnsapi.net \
  +tls-pin=foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9S= soa example.com

```

--------------------------------

### Example of reverse IPv6 address shortening in synthrecord module

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the default output format for reverse IPv6 address generation in the synthrecord module, which now shortens the address by default.

```text
dynamic-2620-0-b61-100--1.test. 400 IN AAAA 2620:0:b61:100::1

```

--------------------------------

### Show all configure options

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to display all available configure options.

```bash
$ ./configure --help

```

--------------------------------

### show-offline

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Print pre-generated offline key-related records for a specified time interval. If the end timestamp is omitted, it extends to infinity; if the start timestamp is omitted, it starts from the beginning.

```APIDOC
## show-offline

### Description
Print pre-generated offline key-related records for specified time interval. If `_timestamp-to_` is omitted, it will be to infinity. If `_timestamp-from_` is omitted, it will start from the beginning.

### Syntax
`show-offline [_timestamp-from_] [_timestamp-to_]`

### Parameters
- `_timestamp-from_` (timestamp) - Optional - Start of the interval. Defaults to the beginning if omitted.
- `_timestamp-to_` (timestamp) - Optional - End of the interval. Defaults to infinity if omitted.

### Example
```
$ keymgr example.com. show-offline
```
```

--------------------------------

### Start Knot DNS server as a daemon

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Starts the Knot DNS server (knotd) in the background using the -d option with a specified configuration file. When run in the foreground, no PID file is created.

```bash
$ knotd -d -c knot.conf

```

--------------------------------

### Run configure with default options

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to configure the build with default settings.

```bash
$ ./configure

```

--------------------------------

### conf-init

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Initializes the configuration database. Execute as the intended user to ensure server access.

```APIDOC
## conf-init

### Description
Initialize the configuration database. If the database doesn't exist yet, execute this command as an intended user to ensure the server is permitted to access the database (e.g. sudo -u knot knotc conf-init).

### Usage
`conf-init`
```

--------------------------------

### zone-get

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone data within the transaction.

```APIDOC
## zone-get

### Description
Get zone data within the transaction.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.
- **owner** (string) - Optional - Owner name to get.
- **type** (string) - Optional - Record type to get.

### Usage
`zone-get zone [owner [type]]`
```

--------------------------------

### zone-diff

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone changes within the transaction.

```APIDOC
## zone-diff

### Description
Get zone changes within the transaction.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.

### Usage
`zone-diff zone`
```

--------------------------------

### zone-read

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone data that are currently being presented.

```APIDOC
## zone-read

### Description
Get zone data that are currently being presented.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.
- **owner** (string) - Optional - Owner name to read.
- **type** (string) - Optional - Record type to read.

### Usage
`zone-read zone [owner [type]]`
```

--------------------------------

### Flush the example.com and example.org zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Flushes the specified zones, forcing them to be written to disk.

```bash
$ knotc zone-flush example.com example.org

```

--------------------------------

### Get the current server configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the server configuration from the active configuration database.

```bash
$ knotc conf-read server

```

--------------------------------

### Simple Knot DNS configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

A minimal configuration file for Knot DNS, defining server listen addresses, a zone, and logging. Use as a base for a basic setup. The server listens on all IPv4 and IPv6 addresses on port 53, serves example.com from /var/lib/knot/zones/example.com.zone, and logs info-level messages to syslog.

```yaml
# Example of a very simple Knot DNS configuration.

server:
    listen: 0.0.0.0@53
    listen: ::@53

zone:
  - domain: example.com
    storage: /var/lib/knot/zones/
    file: example.com.zone

log:
  - target: syslog
    any: info

```

--------------------------------

### Enable mod-onlinesign with default policy

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone configuration enabling the onlinesign module with the default signing policy.

```yaml
zone:
  - domain: example.com
    module: mod-onlinesign

```

--------------------------------

### Optimize XDP network queues with ethtool and renice

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

These commands help optimize XDP performance by configuring RSS hash fields, combined channels, ring sizes, and prioritizing ksoftirqd processes. Replace `<interface>` with the network interface name and `<?>` with appropriate values.

```bash
ethtool -N <interface> rx-flow-hash udp4 sdfn
ethtool -N <interface> rx-flow-hash udp6 sdfn
ethtool -L <interface> combined <?>
ethtool -G <interface> rx <?> tx <?>
renice -n 19 -p $(pgrep '^ksoftirqd/[0-9]*$')

```

--------------------------------

### Get the SOA record for each configured zone

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the SOA record for all zones using the @ owner to denote the zone name.

```bash
$ knotc zone-read -- @ SOA

```

--------------------------------

### Bootstrap configure with autoreconf

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command in the source directory to generate the configure script when compiling from a git checkout.

```bash
$ autoreconf -i -f

```

--------------------------------

### whoami.domain.example zone file with IPv4 nameservers

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone file for whoami.domain.example. It defines four nameservers with only IPv4 addresses, as required for A queries. The SOA TTL is 1 and the minimum TTL is 1.

```dns
$TTL 1

@       SOA     (
                        whoami.domain.example.          ; MNAME
                        hostmaster.domain.example.      ; RNAME
                        2016051300                      ; SERIAL
                        86400                           ; REFRESH
                        86400                           ; RETRY
                        86400                           ; EXPIRE
                        1                               ; MINIMUM
                )

$TTL 86400

@       NS      ns1.whoami.domain.example.
@       NS      ns2.whoami.domain.example.
@       NS      ns3.whoami.domain.example.
@       NS      ns4.whoami.domain.example.

ns1     A       198.51.100.53
ns2     A       192.0.2.53
ns3     A       203.0.113.53
ns4     A       198.19.123.53

```

--------------------------------

### Get backtrace with pstack utility

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Command to use the pstack utility to capture a backtrace of a running knotd process and save it to a file.

```bash
$ pstack $(pidof knotd) > backtrace.txt

```

--------------------------------

### Example of non-shortened reverse IPv6 address output

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the previous output format for reverse IPv6 address generation, which did not shorten the address.

```text
dynamic-2620-0000-0b61-0100-0000-0000-0000-0001.test. 400 IN AAAA 2620:0:b61:100::1

```

--------------------------------

### kxdpgun: Basic usage

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Runs kxdpgun with a queries file against an IPv6 target, using default settings (UDP, 5s duration, 1000 QPS).

```bash
# kxdpgun -i ~/queries.txt 2001:DB8::1

```
Tokens:
Raw