PowerDNS DNSdist
High-performance DNS traffic management built for security, resilience, and scale.
PowerDNS DNSdist is a high-performance, DNS-aware proxy and load balancer designed to optimize and protect DNS traffic for service providers, network operators, and enterprises. Deployed in front of recursive or authoritative DNS servers, DNSdist intelligently distributes incoming queries, improves availability and performance, and adds a powerful layer of security and encryption to your DNS infrastructure.

Load balancing
Intelligently distribute DNS traffic across available backends to improve performance, resilience, and availability.

Caching
Accelerate DNS responses and reduce backend load with high-performance packet caching.

Encryption
Protect DNS traffic with support for modern encrypted DNS protocols, including DoT, DoH, DoQ and DoH3.

Protection
Secure your DNS infrastructure against abusive and malicious traffic with flexible filtering, rate limiting, and traffic controls.
Load balancing
DNSdist is a uniquely powerful DNS proxy that provides DNS-aware load balancing through a variety of high-availability and traffic distribution techniques.
Its primary goal is to route traffic to the most suitable server, ensuring top performance for legitimate users. Today, hundreds of millions of internet users worldwide benefit from its optimized performance and fast content delivery.
Caching
DNSdist comes with an effective packet cache that optimizes the internet experience for users. It caches DNS queries and their corresponding IP addresses to speed up repeated queries and reduce the load on downstream resolvers. This prevents a domain from being queried repeatedly through the recursive server, thereby shortening response times. By reducing queries to the recursive DNS server, overall network performance is improved. Finally, DNSdist also contributes to increased reliability, as the cached address can still be returned if the main DNS server fails.
Encryption
Encrypted DNS gives internet users additional privacy and protects their personal data against interception and profiling. Providing an encryption-capable DNS resolver is also vital in order to prevent DNS requests moving to ‘OTT DNS providers’. DNSdist provides such an encrypted DNS service and lets network operators keep control over users’ DNS traffic.
DNSdist supports all of the IETF’s standardized DNS encryption methods:
DNS over TLS (DoT): Establishes a secure communication channel between clients and resolvers.
DNS over HTTPS (DoH): Uses HTTPS to transport DNS queries and responses securely, similar to the encryption employed by the World Wide Web.
DNS over QUIC (DoQ): Sends DNS queries and responses over QUIC (Quick UDP Internet Connections), adding extra security and reducing latency.
DNS over HTTP/3 (DoH3): Builds on DoH by providing enhanced performance and efficiency, particularly in challenging environments.
Protection
When combined with the add-on DNSdist Defender, DNSdist provides a user-friendly and efficient way to filter malicious DNS traffic and apply per-subscriber rate-limiting. Acting as a DNS firewall, DNSdist Defender delivers comprehensive protection against DNS misuse:
- Prevention of DNS tunneling and data exfiltration
- Mitigation of pseudo-random subdomain (PRSD) attacks
- Protection against DNS reflection/amplification threats
- Defense against device takeovers via command-and-control (C2) attempts
Everything You Need for High-Performance DNS Traffic Management
PowerDNS DNSdist provides the capabilities you need to build fast, resilient, and secure DNS services, including:
- DNS-aware load balancing
- Multiple load balancing policies
- Active backend health checking
- High-performance packet caching
- DNS over TLS (DoT)
- DNS over HTTPS (DoH)
- DNS over QUIC (DoQ)
- DNS over HTTP/3 (DoH3)
- Flexible rules and actions
- Simple YAML configuration
- Lua scripting and customization
- Detailed statistics and operational visibility
- Deployable in front of PowerDNS Recursor or Authoritative Server
- Usable with non-PowerDNS solutions
- Able to run directly on CPE
Why Commercial PowerDNS?
Open source is in our DNA. Commercial expertise is our promise.
When DNS is critical to your business, you need more than software. You need a partner who understands the technology, the architecture, and the operational challenges behind it.
PowerDNS solutions enhance our open source products with access to commercial add-ons, support and the people who build and maintain the software.
Commercial Products
Access enterprise features designed for service providers, network operators, hosting companies, and large enterprises.
Early Security Patches
Keep your DNS infrastructure protected with early access to security patches before public release.
Long-Term Maintenance
Plan upgrades and lifecycle management with confidence and keep your DNS infrastructure maintainable over time.
Training and Consulting
Build internal expertise with professional services and training tailored to your team and infrastructure.
Professional Support
Get professional support backed by clearly defined, strong service levels for your production environment.
Direct Access to PowerDNS Experts
Work with engineers who understand PowerDNS at its core and can help diagnose complex technical issues.
Architecture Guidance
Design resilient, scalable DNS environments with guidance based on real-world deployments.
Enhance DNSdist with Powerful Product Extensions.
Ready to take control of your DNS traffic?
