DNSvizor: privacy-enhanced DNS resolver and DHCP server

2024-10-01

In the DNSvizor project, we develop a robust DHCP server and DNS resolver as a MirageOS unikernel. MirageOS unikernels are self-contained virtual machine images which are composed of only the required OCaml libraries, leading to a binary with a minimal trusted code base, and thus minimized attack surface.

We want to develop and test DNSSec support for DNSvizor, support several DHCP and DNS privacy extensions, do extensive testing, and documentation to allow anyone to use our tool on their laptop, their home router, or in their data center. Migration of existing configuration from similar tools to DNSvizor will be provided as well.

DNSvizor will support resolving over DNS over TLS as well as DNS over HTTPS, and can be configured to use a SOCKS proxy, for example tor, to further anonymize DNS queries. Externally maintained block lists can be configured to block domain names primarily serving advertisement, trackers, or malicious content.

We will also develop a web interface for DNSvizor to identify its current state, which DNS lookups have been blocked, what the mean response time is, how many clients are using DNSvizor, etc.

From 2024 until 2025 we received funding from the European Union in the Next Generation Internet project (NGI0 Entrust), via NLnet. The amount is 50_000€.

Reynir, Pixie, Romain, and Hannes all contributed to this project.