dnsdist.conf

port=os.getenv('PORT')
backend=os.getenv('BACKEND')
tlsEnabled=os.getenv('TLS_ENABLED')

-- upstream resolver
newServer({
    address=backend,
    name='resolver1',
    healthCheckMode='up',
})

-- allow query from all IP addresses
setACL({ '0.0.0.0/0', '::/0' })

-- add a DNS resolver listening on port 53 of all interfaces
setLocal(string.format('0.0.0.0:%s', port), { reusePort=true })
addLocal(string.format('[::]:%s', port), { reusePort=true })

if tlsEnabled == 'true' then
    certFile='./certs/fullchain.pem'
    keyFile='./certs/privkey.pem'

    -- add a DoH resolver listening on port 443 of all interfaces
    addDOHLocal('0.0.0.0:443', certFile, keyFile, { '/', '/dns-query' }, { doTCP=true, reusePort=true, tcpFastOpenSize=0 })
    addDOHLocal('[::]:443', certFile, keyFile, { '/', '/dns-query' }, { doTCP=true, reusePort=true, tcpFastOpenSize=0 })

    -- add a DoT resolver listening on port 853 of all interfaces
    addTLSLocal('0.0.0.0', certFile, keyFile)
    addTLSLocal('[::]', certFile, keyFile)
end

-- add a local control socket
controlSocket('127.0.0.1')
setKey('miQjUydO7fwUmSDS0hT+2pHC1VqT8vOjfexOyvHKcNA=')

-- add logging target to dnstap
dnstap=newFrameStreamUnixLogger('./dnstap.sock')
addResponseAction(AllRule(), DnstapLogResponseAction('dns', dnstap))

-- rate limit
-- Over UDP, truncate rather than drop once a source gets noisy: a legitimate
-- client retries over TCP transparently, while a spoofed source cannot
-- complete the handshake -- so this still blocks reflection/amplification,
-- and a truncated response is query-sized (no amplification gain).
addAction(
    AndRule({
        NotRule(TCPRule(true)),
        MaxQPSIPRule(50, 32, 56, 100),
    }),
    TCAction()
)

-- Hard stop for sustained abuse well above the truncate threshold. Applies to
-- TCP/DoT/DoH too, where truncation is meaningless.
addAction(MaxQPSIPRule(200, 32, 56, 400), DropAction())