Skip to content

Bindizr

Open-source control plane for authoritative DNS

Bindizr manages DNS zones and records through an HTTP API or CLI. It stores them in MySQL, PostgreSQL, or SQLite and sends changes to BIND, Knot DNS, NSD, PowerDNS, Technitium, Windows Server DNS, and other secondaries. Those servers answer your clients' DNS queries.

  • Deploy it

    Install on Kubernetes, Docker Compose, or a host, then query your first zone.

  • Configure it

    Every option in bindizr.conf.toml and its environment-variable form.

  • Use the CLI

    Zones, records, versions, access control, and DNSSEC from the CLI.

  • Automate it

    Token-authenticated HTTP API with an OpenAPI reference.

Concepts

Bindizr control plane and secondary DNS servers

Control Plane
The HTTP API and CLI manage zones and records stored in the database.
XFR Server
Sends a whole zone (AXFR) or just its changes (IXFR) to secondaries. Each change advances the zone's SOA serial number.
Catalog Zones
Tell secondaries which zones to serve. Creating or deleting a zone in Bindizr updates the catalog automatically (RFC 9432).
Secondary DNS Servers
Discover zones from the catalog, pull their records, and answer client queries. See Secondary Servers for setup.

Features

  • Zones and records: Bulk changes, zone-file import/export, dry-run previews, version diffs, and rollback.
  • Dynamic updates: RFC 2136 updates authenticated with TSIG keys.
  • Access control: Roles limit API tokens and TSIG keys by zone, action, record name, and type.
  • DNSSEC: Automatic signing, signature renewal, key rollover, and BIND-format key import/export.
  • ExternalDNS: Turn Kubernetes Service and Ingress hostnames into DNS records.
  • Observability: Prometheus metrics, health probes, text or JSON logs, and CLI diagnostics.

Performance

In the benchmark runs, Bindizr + BIND served 59,397 queries/s, compared with 59,904 queries/s for BIND alone. Client queries go directly to the secondary.

License

Bindizr is licensed under the Apache License 2.0.