Moving DNS off the ISP's resolver and onto the LAN
Technitium DNS Server is an open source DNS server written in C# that acts as both a recursive resolver and an authoritative server. Its README makes the case against the ISP's resolver, which sees every domain a machine looks up, HTTPS or not; some ISPs redirect or inject content even when clients query Google DNS or Cloudflare. Run on the local network, Technitium answers from its cache and blocks domains for every device using blocklists pulled from URLs. Upstream, it can reach resolvers over encrypted DNS. The web console is itself a client of an HTTP API that scripts can call, and a built-in DHCP server can cover several networks.
DoT, DoH and DoQ on both legs, plus DNSSEC signing
- Encryption toward clients and upstream: devices can query the server over DNS-over-TLS, DNS-over-HTTPS (HTTP/1.1, HTTP/2 and HTTP/3) or DNS-over-QUIC, and the server can use the same protocols to reach Cloudflare, Google, Quad9 or AdGuard. An HTTP or SOCKS5 proxy setting can send queries out through Tor.
- Blocking that follows CNAMEs: a domain whose CNAME points at a blocked domain is blocked as well. The Advanced Blocking app adds regex lists and separate lists per client IP address or subnet.
- Primary, secondary and stub zones: AXFR and IXFR transfers authenticated with TSIG, also over TLS or QUIC, catalog zones (RFC 9432) to provision secondaries, and dynamic updates (RFC 2136).
- DNSSEC validation and signing: RSA, ECDSA and EdDSA, with NSEC or NSEC3. ANAME records flatten a CNAME at the zone apex.
- Programmable answers: an APP record hands the response to a DNS app that runs its own logic. Split horizon and geolocation-based answers are built this way.
- The developers' load test: over 100,000 queries per second on an Intel i7-8700 over Gigabit Ethernet.
.NET runtime jumps and lockstep cluster upgrades
The server tracks new .NET releases. Version 14.0 (November 2025) moved to .NET 9 and 15.0 (April 2026) to .NET 10. On a manual install, the new runtime has to be in place before the server is upgraded. Since 15.0, the Linux install script sets up a systemd service that no longer runs as root; an older install keeps its previous mode until it is reinstalled.
DHCP in a container needs host networking. The official docker-compose.yml says so in a comment: for DHCP, switch to network_mode: "host" and remove every port mapping.
Cluster nodes have to be upgraded together. Clustering, which manages several instances from one console, shipped in 14.0 on November 8, 2025. Releases 14.1, 14.2 and 15.0 each introduced a breaking change in it, and each time every node had to be upgraded.
An organization's network is as much the target as a home one. The README names both, and several recent additions serve teams of admins: TOTP two-factor authentication in 14.0, OpenID Connect SSO and Prometheus metrics in 15.0, LDAP authentication in 15.5.
Version 15.6.2 (October 17, 2026) follows a run of security fixes. Five releases shipped in the four weeks starting September 19. Version 15.5 alone fixes nine vulnerabilities reported by outside researchers (Palo Alto Networks, Penn State, Tel Aviv University, Nankai University), including two cache poisoning flaws and a DNSSEC validation bypass. Version 15.6 fixes four more, one of them a log injection through the login API that required no authentication. Version 15.6.2 closes a UDP receive loop that a stream of empty packets could keep running.