PHAROS

Safe Rust, down to the wire.

Your DNS server reads whatever strangers on the internet send it. The code doing that reading should be the last place memory bugs can hide.

#![forbid(unsafe_code)]

  1. Codecour own

    The parser is ours, and it’s safe

    The wire codec, name compression, record types, EDNS, zone files, TSIG and DNSSEC are all Pharos’s own code. Well-known dependencies like tokio and rustls may use unsafe inside; Pharos adds none of its own.

  2. Fuzzingdifferential

    Cross-checked against two other codecs

    The protocol code is fuzzed against domain and hickory, and tested with RFC vectors, ported miekg/dns and CoreDNS fixtures, and round-trip property tests. The fuzz targets run in CI.

  3. BaselineCoreDNS 1.15

    Every response compared with CoreDNS

    A differential harness sends the same queries to Pharos and CoreDNS 1.15 and compares what comes back, response by response.

  4. RFCMUST first

    Standards first, real deployments respected

    Where CoreDNS breaks an RFC MUST, Pharos follows the RFC, unless real setups depend on the CoreDNS behaviour. Either way, every difference is written down.

Read the compatibility notes

Try it on your Corefile.

Ask Pharos what it thinks of your config, then let it serve. It reads /etc/pharos/pharos.conf, so one mount is all it takes.

Move over from CoreDNSSource on GitHub
# see what changes for your Corefile, if anything$ docker run --rm \-v "$PWD/Corefile:/etc/pharos/pharos.conf:ro" \ghcr.io/itsmeyaw/pharos:1.0.0 check # serve it on port 53$ docker run --rm -p 53:53/udp -p 53:53/tcp \-v "$PWD/Corefile:/etc/pharos/pharos.conf:ro" \ghcr.io/itsmeyaw/pharos:1.0.0