DNS Synchronization Service for BIND9

Bindizr is a Rust-based DNS control plane that manages zones and records via an HTTP API or CLI, stores data in a database backend (MySQL, PostgreSQL, or SQLite), and propagates changes to BIND9 secondary servers via AXFR/IXFR using DNS Catalog Zones.

• Deploy it

  Helm, Docker Compose, or a package install on a VM.

• Configure it

  Every option in bindizr.conf.toml and its environment-variable form.

• Drive it

  Zones, records, snapshots, TSIG keys, and API tokens from the CLI.

• Automate it

  Token-authenticated HTTP API with an OpenAPI reference.

Concepts

Control Plane

Manage DNS zones and records through HTTP API or CLI commands. All changes are stored in the database (MySQL, PostgreSQL, or SQLite).

XFR Server

Built-in AXFR (full zone transfer) and IXFR (incremental zone transfer) server that serves zone data to secondary DNS servers. SOA serial numbers are automatically incremented on each change.

Catalog Zones

Bindizr uses DNS Catalog Zones (RFC 9432) to automatically propagate zone configuration to BIND9 secondary servers. When you create or delete a zone via the API/CLI, BIND9 automatically discovers and configures it without manual intervention.

Secondary DNS Servers

Standard BIND9 (or any RFC-compliant DNS server) instances configured as secondaries. They automatically discover zones through the catalog zone, pull zone updates from Bindizr's XFR server via zone transfer, and respond to DNS queries from clients.

Features

• Zone and Record Management: Full CRUD over zones and records through the HTTP API or CLI, including bulk inserts, BIND master-file import/export, and dry-run diff previews.

• Multiple Database Backends: Store DNS data in MySQL, PostgreSQL, or SQLite.

• Zone Transfers (AXFR/IXFR): Serve full and incremental zone transfers to secondaries, with automatic SOA serial management and an optional per-serial zone cache.

• Automatic Zone Provisioning: DNS Catalog Zones (RFC 9432) let BIND9 secondaries discover created and deleted zones without configuration changes.

• DNS NOTIFY: Notify secondaries after each change, with configurable retries and timeouts, plus a sync/async apply mode that batches NOTIFYs under load.

• nsupdate (Dynamic Update): RFC 2136 dynamic updates with TSIG-signed requests, managed TSIG keys, and per-zone update policies.

• Zone History: Per-serial SOA snapshots with diffs between serials and rollback to a previous serial.

• Observability: Health probe endpoint, Prometheus metrics at /metrics, and bindizr doctor end-to-end diagnostics.

Performance

Bindizr never answers a client query — the BIND9 secondaries do. It owns the zone data and the transfer path, so putting it in front of BIND9 costs nothing on the query path: Bindizr + BIND9 serves 62,448 QPS against native BIND9's 61,629.

License

Bindizr is licensed under the Apache License 2.0.