DNSdist Defender

Traditional DNS filtering in DNSdist often requires deep expertise in Lua and DNS internals. DNSdist Defender removes that complexity by providing a simple yet powerful YAML-based configuration, along with predefined and continuously updated security rules. An intuitive API layer built on top of DNSdist’s Lua capabilities further simplifies implementation, while seamless integration ensures compatibility with existing environments. This enables you to implement advanced DNS filtering and protection without the need for specialized scripting knowledge.

DNSdist Defender continuously monitors traffic and responds instantly to anomalies by leveraging dynamic rule generation based on real-time traffic behavior. It automatically blocks, rate-limits, or logs malicious queries, while a flexible policy engine supports a wide range of protocols, subnets, and actions. Dynamic blocks triggered by an attack are synchronized across all DNSdist instances, significantly reducing the impact on the load of both DNSdist and Authoritative Servers. All rules are executed with high performance and minimal impact on latency, ensuring efficient and reliable protection.

Designed for modern, distributed infrastructures, DNSdist Defender delivers features that enhance scalability and security. It supports Session Ticket Encryption Key Sharing (STEK), which enables the secure distribution of STEK keys across multiple servers. This makes TLS session resumption significantly more efficient in large infrastructures spanning multiple servers or data centers. To enable this, DNSdist Defender uses NATS, an open-source messaging technology, for distributed communication.