djbdns: More Than Just a Mouthful of Consonants

Recently released into the public domain, djbdns is a fast and secure replacement for BIND.
Installing djbdns

The latest version of djbdns compiles on all the major Linux distributions. You also need to install daemontools (see sidebar), another package by Dan Bernstein.

Download djbdns from Bernstein's Web site, and run the following commands. The third line is a workaround for a glibc bug on Linux:

# tar xzf djbdns-1.05.tar.gz
# cd djbdns-1.05
# echo gcc -O2 -include /usr/include/errno.h > conf-cc
# make
# make setup check

See Bernstein's official documentation if you have further questions about installing djbdns.

Using dnscache, a DNS Cache

One of the easiest ways to begin using djbdns is to configure a DNS cache on your local network. There are many reasons why you may want to do this—from faster DNS lookup times to avoiding those pesky mistyped domain search result pages. In either case, installing dnscache can help.

Let's assume you have a home network with several computers on Additionally, a Linux machine (named linux1) is running on You want to install dnscache on linux1, so it can provide DNS resolution service for the other machines on the network.

Fortunately, installing dnscache is trivial, thanks to the dnscache-conf utility provided with djbdns. Before running dnscache-conf, you need to create one new group and two accounts on linux1. These will be used exclusively by djbdns and should not be available for login:

# groupadd djbdns
# useradd -s /bin/false -d /etc/dnscache -g djbdns dnscache
# useradd -s /bin/false -d /dev/null -g djbdns dnslog

The next step is to run dnscache-conf and provide it with four parameters: the account for the dnscache process, the account for the logging process, the dnscache service directory and the IP on which dnscache should listen:

# dnscache-conf dnscache dnslog /etc/dnscache

The /etc/dnscache directory now should exist. Before you can begin using your new cache, you need to allow access to it from your local network. dnscache checks to see if a machine is allowed to access it by comparing the IP of the incoming request address against files in /etc/dnscache/root/ip/. You can grant access to your whole network simply by touching a single file:

# touch /etc/dnscache/root/ip/192.168.10

At this point, you are ready to start the cache. If you are running BIND, you need to stop and disable it so that dnscache can take ownership of port 53. Assuming daemontools is installed and running, you now can start dnscache:

# ln -s /etc/dnscache /service/

That's it. You now have a DNS cache running on your local network. Your next step is to update the /etc/resolv.conf file on all your machines to point to


If your network is very busy, you may find you need to increase the amount of memory that is allocated to your cache. Dan Bernstein provides instructions on his Web site for adjusting the cache size, but you also may want to take a look at Paul Jarc's Perl script or Mike Babcock's Python script.

Using tinydns, an Authoritative DNS Server

If you have ever run BIND as an authoritative DNS server, it is likely that at some point you neglected to increment the serial on an SOA record, overlooked a missing semicolon somewhere or simply forgot to append a period (.) at the end of a record. These are just a few of the common mistakes people make when dealing with BIND's zone files. If you have been bitten by any of these issues, you probably remember the trouble it created for you. These errors can cause big headaches (just ask Google).

tinydns, the authoritative DNS server in djbdns, takes an entirely different approach and makes it much more difficult to get yourself in trouble. One major difference is that instead of separate zone files for each domain, tinydns uses a single text file named data to store every record of every domain. This data file is then compiled into a very fast database in cdb format. Of course, if you prefer managing domains in separate files, you still can, just concatenate them together before compiling the database.

Let's get started by configuring our tinydns instance. You should have daemontools already installed and running. Again, let's assume we are running a home network on, and we now want to access each host by name using DNS. We have another Linux machine (named linux2) running on that will publish DNS information with tinydns.

First, create the tinydns user:

# useradd -s /bin/false -d /etc/tinydns -g djbdns tinydns

Like dnscache, there is a utility for creating and configuring instances of tinydns. It also takes four parameters: the account for the tinydns process, the account for the logging process, the tinydns service directory and the IP on which tinydns should listen:

# tinydns-conf tinydns dnslog /etc/tinydns

This creates the /etc/tinydns directory and populates it with everything needed to begin publishing your DNS data. The last step is to create a symbolic link for the tinydns service into /service. Again, be sure to stop and disable any BIND instances first:

# ln -s /etc/tinydns/ /service/

Now you can begin adding records for each host on your network.


Cory Wright


Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.


Anonymous's picture

Focus should be on useability and safety.
To answer your questions - just for the records:

1) daemontools are an easy way to ensure that a program is run and restarted where necessary. Nowadays you also find 'runit' which works the same.

2) fine - you can put it somewhere else. 'runit' uses /etc/service

3) besides the fact that you can run qmail using a start-stop daemon, qmail is not exactly state of the art anymore

4) some very big sites are using tinydns. Why do you think that there is a speed problem?

5) yes. It is also possible to use vegadns which is a web based system to maintain tinydns records. Data is stored in a database; exported to tinydns using a shell command.

As djbdns is not open source binary distributions have become available.


Anonymous's picture

1) why using daemon tools if linux has already other tools to lunch daemon and software ?
2) as a sysadmin i neglet to fill my "/" with not standard directories
3) Have You ever got problems trying to stop qmail or a piece of it ? ..(ask google) ..daemontools are simply...too much , sometime.Too much effort to keep daemons running, even when You have to stop them.
4) This is a question: how about speed?
5) Second question: importing zones from bind is possible?

StefanoA. rn- italy