dns

github.com/miekg/dns is a complete, from-scratch DNS library for Go that supports both client- and server-side programming. Every standard resource record type is implemented as a native Go struct rather than stored in raw wire format, and the server API deliberately mirrors net/http — you register a Handler and call ListenAndServe — so building a DNS resolver or authoritative nameserver feels familiar to any Go developer.

Beyond basic query/response handling, the library covers the DNS ecosystem in depth: DNSSEC signing, validation, and key generation (RSA, ECDSA, Ed25519), AXFR/IXFR zone transfers, TSIG and SIG(0) message authentication, EDNS0 options (NSID, Cookies, Client Subnet), and DNS-over-TLS. It’s the DNS engine behind projects like CoreDNS, HashiCorp Consul, and dnscontrol, and while a faster v2 rewrite is now developed separately on Codeberg, this v1 package continues to receive fixes and remains one of the most widely used DNS libraries in the Go ecosystem.

What You Get

• Native Go types for every DNS resource record, including all DNSSEC record types
• A net/http-style server API (Handler, HandlerFunc, ListenAndServe) for building authoritative or forwarding nameservers
• A full DNSSEC toolkit: zone signing, validation, and key generation for RSA, ECDSA, and Ed25519
• Zone file parsing with support for $INCLUDE, $ORIGIN, $TTL, and $GENERATE directives
• Built-in support for AXFR/IXFR transfers, TSIG/SIG(0) authentication, and DNS-over-TLS

Common Use Cases

• Writing a custom authoritative or caching DNS server in Go
• Programmatically querying and parsing DNS records from a Go application
• Signing and validating DNSSEC zones as part of a DNS management pipeline
• Building DNS-aware network tooling such as service discovery, load balancers, or security scanners
• Parsing and generating BIND-style zone files

Under The Hood

Architecture The library is organized as a flat, single-package layered design: types.go and the generated zmsg.go/ztypes.go (produced by msg_generate.go, which walks struct tags via go/types and code-generates Pack/Unpack methods) define every resource record as a native Go struct with wire (de)serialization baked in at compile time; msg.go implements the Msg envelope (header, question, answer, authority, additional sections) and its own Pack/Unpack logic on top of those RR types; client.go and server.go sit above that as thin transport layers — server.go’s Handler/HandlerFunc/ServeMux (in serve_mux.go, guarded by a sync.RWMutex for concurrent registration and lookup) deliberately mirror net/http’s handler contract, while dnssec.go, tsig.go, sig0.go, and xfr.go are separate, optional layers for signing/validation, message authentication, and zone transfers that depend on the core message types but not on each other. Changing the core RR interface or the generated Pack/Unpack contract would ripple through every record-type file and the code generator itself, but the transport and security layers stay cleanly separable from that core.

Tech Stack Written in Go 1.25 with an unusually small dependency surface — go.mod declares only three direct requirements (golang.org/x/net, golang.org/x/sync, golang.org/x/sys), plus golang.org/x/tools and golang.org/x/mod as generate-time-only tool dependencies, so the runtime footprint is close to Go’s standard library alone. There’s no external database, ORM, or web framework involved — it’s a systems-level networking package covering UDP/TCP/DNS-over-TLS transport via net and crypto/tls, with go generate (msg_generate.go) as the only build step beyond go build. CI runs via GitHub Actions (a standard Go test workflow plus a CodeQL static-analysis workflow), and a fuzzing target (fuzz.go, gated behind a fuzz build tag) exercises the Msg Pack/Unpack round trip.

Code Quality Testing uses Go’s standard testing package exclusively (no third-party assertion library) across dozens of _test.go files totaling roughly 294 Test functions, plus a dedicated example_test.go of runnable documentation examples and a fuzz target for the wire-format parser — a strong signal of care for a library whose core risk surface is untrusted-input parsing. Error handling is explicit and typed: a package-level Error type backs sentinel values like ErrShortRead, and parse failures are wrapped with fmt.Errorf(”…: %w”, err) rather than swallowed or logged silently. Naming is idiomatic Go, the generated files (zmsg.go, ztypes.go, zduplicate.go) are clearly marked as such and checked in rather than built on the fly, and CI runs both tests and static analysis on every change.

What Makes It Unique The API’s central design choice is treating every DNS resource record as a native, typed Go struct instead of exposing raw wire bytes, combined with a net/http-shaped server contract (Handler, HandlerFunc, ListenAndServe) — so a Go developer already familiar with net/http can write a DNS server with almost no new mental model. Getting started is a single dns.NewRR(…) call or a few struct-literal field assignments, and the same Msg type serves both client queries and server responses. This isn’t algorithmically novel — it’s a faithful, complete implementation of a decades-old protocol — but generating typed RRs and Pack/Unpack methods from struct tags rather than hand-writing or reflecting them at runtime is a deliberate, well-executed engineering tradeoff that keeps the public API both exhaustive and fast.