About

One person, a DNS resolver, and an open invitation to break it.

DNS Daddy started as a way to learn protective DNS, networking, secure development and detection by building something real instead of reading about it. It is being improved in public, mistakes included.

The story

Built for learning. Open for improvement.

DNS Daddy started as a proof-of-concept.

I built it while studying at Master's level with a focus on cybersecurity, partly to learn by building something real and partly because I became frustrated with how difficult and expensive protective DNS and enterprise security tooling can become for small businesses.

Products from large security vendors can be extremely capable, but licensing, complexity, implementation requirements and cost can put some of those protections out of reach for smaller organisations.

DNS Daddy is an experiment in a different direction:

What if useful protective DNS tooling could be understandable, self-hosted, open source and accessible to smaller organisations?

That is what this project is exploring.

Why I started building it.

Working around IT and cybersecurity made me increasingly aware of the gap between what large organisations can deploy and what smaller businesses can realistically afford, understand and maintain.

Protective DNS is a good example. The technology itself isn't magic. Yet accessing advanced security capabilities can quickly involve enterprise licensing, complex platforms, consultants and significant ongoing cost.

I wanted to understand the problem from first principles. So rather than only studying DNS security, I started building a DNS resolver. DNS Daddy grew from that experiment.

It is partly a cybersecurity learning project. Partly an open-source experiment. And partly a question:

Can we make useful defensive technology easier for small organisations to understand and access?

I don't know yet. That's why the project is open.

To be clear: this isn't a swipe at established vendors. Large security platforms are mature, supported and extensively engineered, and for many organisations they're the right answer. The point is that there should also be room for accessible, understandable, open-source alternatives and learning projects. DNS Daddy is exploring that gap.

No pretending.

I don't want to pretend DNS Daddy is something it isn't. I'm a cybersecurity student building in public. Some parts of this project have been created with extensive assistance from AI coding tools.

Some decisions will be wrong. Some code will need rewriting. Security issues will almost certainly be discovered.

That's part of the point.

Instead of hiding that process, DNS Daddy is being developed openly so people can see the mistakes, improvements, security fixes and decisions as the project evolves.

The objective is not to pretend one person built the perfect DNS security platform. The objective is to see whether a community can build something useful together.

What DNS Daddy is trying to prove.

Security should be understandable.

People should be able to understand the infrastructure protecting them.

Learning should involve building.

DNS Daddy exists because building the system teaches things reading about DNS cannot.

Small organisations deserve options.

Security capability should not automatically require enterprise budgets.

Open source requires honesty.

If something isn't secure yet, say so.

Good security comes from scrutiny.

Invite people to challenge the implementation.

Share what you learn.

The project's mistakes and fixes should be useful to other people learning cybersecurity.

Security through scrutiny.

Publishing security software does not automatically make it secure. Open source simply gives people the opportunity to inspect it.

DNS Daddy's security will improve only if people actually review the code, challenge assumptions, report vulnerabilities and contribute fixes. That is why peer review is a central goal of this project.

SECURITY.md →GitHub Issues →Semgrep triage notes →Contributing guide →Source code →

Found a vulnerability?

Please report security vulnerabilities responsibly rather than publicly exploiting them against real deployments. Only test systems you own or have explicit permission to test — never someone else's infrastructure.

Read the disclosure policy →

Help build DNS Daddy.

DNS Daddy needs people who know more than I do.

Security engineers, Go developers, network engineers, sysadmins, homelab enthusiasts, students and curious people are all invited to contribute.

If you look at the code and think "Why on earth did you do it that way?" — excellent. Open an issue. Explain the better approach. Submit a pull request. Teach me something. Help make the project safer for the next person who deploys it.

Review the security

Look for vulnerabilities, unsafe defaults, authentication problems, DNS abuse risks and architectural weaknesses.

Review the code →

Improve the code

Refactor messy implementations, improve tests, simplify architecture and improve reliability.

Contribute on GitHub →

Break it

Test DNS Daddy in a lab. Look for edge cases. Try strange configurations. Report what fails.

Report an issue →

Improve the documentation

Help make installation, configuration and security guidance understandable to people who aren't DNS experts.

Improve the docs →

Suggest features

If you're running DNS infrastructure, tell us what's actually useful. Feature ideas go in the issue tracker.

Open a feature issue →

Learn with the project

Students and people learning cybersecurity should feel welcome to follow the project, investigate issues and contribute improvements.

Explore the repository →

DNS Daddy isn't being built behind closed doors and unveiled when it's "finished." The learning, mistakes, security findings and improvements are part of the project.

Built for education. Built in public. Built with the hope of making useful security more accessible.

Like DNS Daddy? Buy me a coffee. ☕

DNS Daddy is free, open source and has no paid tiers.

If you enjoy the project and fancy supporting the hosting, testing and caffeine behind it, you're welcome to buy me a coffee. You absolutely don't have to.

Using DNS Daddy, reporting bugs, reviewing the code, improving the documentation and contributing pull requests are just as valuable.

Code, bug reports and coffee all gratefully accepted.

Contribute on GitHub ☕ Buy James a coffee

Donations unlock nothing. No extra features, no priority support, no private builds. DNS Daddy is equally available to everyone.

This project needs people smarter than me.

Seriously.

If you're experienced with DNS, networking, Go, Docker, Linux or application security, I'd genuinely value your eyes on DNS Daddy.

Find something bad? Tell me. Find something stupid? Tell me why. Know a safer pattern? Show me. Want to build something? Open a pull request.

This project gets better when people challenge it.

View the source Contribute on GitHub Report an issue