MaraDNS

MaraDNS is a small, lightweight, cross platform open source DNS server, valued by its users for being easy to set up and remarkably secure, and it runs on both Windows and UNIX clones.

Its security record is the strongest claim it makes and it is stated precisely rather than vaguely: no attack stronger than remote denial of service has ever been found in MaraDNS. For a network service that accepts unsolicited packets from anywhere on the internet, never having had a remote code execution vulnerability is a genuinely unusual record, and it follows from the deliberately small codebase.

The project is candid about its current state, which is more useful to an evaluator than optimism would be. Since late 2022 MaraDNS has been in deep freeze, updated only to fix important security holes or compile errors in GCC or Clang. Anyone choosing it should understand they are adopting a finished, maintained program rather than an evolving one.

Considerable work has gone into keeping it buildable far into the future. MaraDNS is Y2038 compliant, every external dependency has multiple implementations, with document conversion scripts moved from Perl to Lua specifically because several Lua implementations exist and one ships in the source tree, and it compiles with the c99 standard flag to reduce the chance that future compiler changes break it. Configuration is text file based and suits anyone comfortable editing configuration files directly.