Knot Resolver configuration JSON schema

Type: object

Version Knot Resolver 6.0.9

root version
Type: integer Default: 1

Version of the configuration schema. By default it is the latest supported by the resolver, but couple of versions back are be supported as well.

root nsid
Type: string or null Default: null

Name Server Identifier (RFC 5001) which allows DNS clients to request resolver to send back its NSID along with the reply to a DNS request.

root hostname
Type: string or null Default: null

Internal DNS resolver hostname. Default is machine hostname.

root rundir
Type: string Default: "/run/knot-resolver"

Directory where the resolver can create files and which will be it's cwd.

root workers
Default: 1

The number of running kresd (Knot Resolver daemon) workers. If set to 'auto', it is equal to number of CPUs available.

root workers anyOf item 0
Type: enum (of string)

Must be one of:

  • "auto"
root workers anyOf item 1
Type: integer

Value must be greater or equal to 1

root max-workers
Type: integer Default: 256

The maximum number of workers allowed. Cannot be changed in runtime.

Value must be greater or equal to 1

root management
Type: object Default: {"unix_socket": "/run/knot-resolver/kres-api.sock", "interface": null}

Configuration of management HTTP API.

root management unix-socket
Type: string or null Default: null

Path to unix domain socket to listen to.

root management interface
Type: string or null Default: null

IP address and port number to listen to.

root webmgmt
Type: object or null Default: null

Configuration of legacy web management endpoint.

root webmgmt unix-socket
Type: string or null Default: null

Path to unix domain socket to listen to.

root webmgmt interface
Type: string or null Default: null

IP address or interface name with port number to listen to.

root webmgmt tls
Type: boolean Default: false

Enable/disable TLS.

root webmgmt cert-file
Type: string or null Default: null

Path to certificate file.

root webmgmt key-file
Type: string or null Default: null

Path to certificate key.

root options
Type: object Default: {"glue_checking": "normal", "minimize": true, "query_loopback": false, "reorder_rrset": true, "query_case_randomization": true, "priming": true, "rebinding_protection": false, "refuse_no_rd": true, "time_jump_detection": true, "violators_workarounds": false, "serve_stale": false}

Fine-tuning global parameters of DNS resolver operation.

root options glue-checking
Type: enum (of string) Default: "normal"

Glue records scrictness checking level.

Must be one of:

  • "normal"
  • "strict"
  • "permissive"

root options minimize
Type: boolean Default: true

Send minimum amount of information in recursive queries to enhance privacy.

root options query-loopback
Type: boolean Default: false

Permits queries to loopback addresses.

root options reorder-rrset
Type: boolean Default: true

Controls whether resource records within a RRSet are reordered each time it is served from the cache.

root options query-case-randomization
Type: boolean Default: true

Randomize Query Character Case.

root options priming
Type: boolean Default: true

Initializing DNS resolver cache with Priming Queries (RFC 8109)

root options rebinding-protection
Type: boolean Default: false

Protection against DNS Rebinding attack.

root options refuse-no-rd
Type: boolean Default: true

Queries without RD (recursion desired) bit set in query are answered with REFUSED.

root options time-jump-detection
Type: boolean Default: true

Detection of difference between local system time and expiration time bounds in DNSSEC signatures for '. NS' records.

root options violators-workarounds
Type: boolean Default: false

Workarounds for known DNS protocol violators.

root options serve-stale
Type: boolean Default: false

Allows using timed-out records in case DNS resolver is unable to contact upstream servers.

root network
Type: object Default: {"do_ipv4": true, "do_ipv6": true, "out_interface_v4": null, "out_interface_v6": null, "tcp_pipeline": 100, "edns_tcp_keepalive": true, "edns_buffer_size": {"upstream": "1232B", "downstream": "1232B"}, "address_renumbering": null, "tls": {"cert_file": null, "key_file": null, "sticket_secret": null, "sticket_secret_file": null, "auto_discovery": false, "padding": true}, "proxy_protocol": false, "listen": [{"interface": ["127.0.0.1"], "unix_socket": null, "port": 53, "kind": "dns", "freebind": false}, {"interface": ["::1"], "unix_socket": null, "port": 53, "kind": "dns", "freebind": true}]}

Network connections and protocols configuration.

root network do-ipv4
Type: boolean Default: true

Enable/disable using IPv4 for contacting upstream nameservers.

root network do-ipv6
Type: boolean Default: true

Enable/disable using IPv6 for contacting upstream nameservers.

root network out-interface-v4
Type: string or null Default: null

IPv4 address used to perform queries. Not set by default, which lets the OS choose any address.

root network out-interface-v6
Type: string or null Default: null

IPv6 address used to perform queries. Not set by default, which lets the OS choose any address.

root network tcp-pipeline
Type: integer Default: 100

TCP pipeline limit. The number of outstanding queries that a single client connection can make in parallel.

Value must be greater or equal to 0 and lesser or equal to 65535

root network edns-tcp-keepalive
Type: boolean Default: true

Allows clients to discover the connection timeout. (RFC 7828)

root network edns-buffer-size
Type: object Default: {"upstream": "1232B", "downstream": "1232B"}

Maximum EDNS payload size advertised in DNS packets. Different values can be configured for communication downstream (towards clients) and upstream (towards other DNS servers).

root network edns-buffer-size upstream
Type: string Default: "1232B"

Maximum EDNS upstream (towards other DNS servers) payload size.

Must match regular expression: ^(\d+)(B|K|M|G)$

root network edns-buffer-size downstream
Type: string Default: "1232B"

Maximum EDNS downstream (towards clients) payload size for communication.

Must match regular expression: ^(\d+)(B|K|M|G)$

root network address-renumbering
Type: array of object or null Default: null

Renumbers addresses in answers to different address space.

 No Additional Items

Each item of this array must be:

root network address-renumbering address-renumbering items
Type: object

Renumbers addresses in answers to different address space.

root network tls
Type: object Default: {"cert_file": null, "key_file": null, "sticket_secret": null, "sticket_secret_file": null, "auto_discovery": false, "padding": true}

TLS configuration, also affects DNS over TLS and DNS over HTTPS.

root network tls cert-file
Type: string or null Default: null

Path to certificate file.

root network tls key-file
Type: string or null Default: null

Path to certificate key file.

root network tls sticket-secret
Type: string or null Default: null

Secret for TLS session resumption via tickets. (RFC 5077).

root network tls sticket-secret-file
Type: string or null Default: null

Path to file with secret for TLS session resumption via tickets. (RFC 5077).

root network tls auto-discovery
Type: boolean Default: false

Experimental automatic discovery of authoritative servers supporting DNS-over-TLS.

root network tls padding
Default: true

EDNS(0) padding of queries and answers sent over an encrypted channel.

root network tls padding anyOf item 0
Type: boolean
root network tls padding anyOf item 1
Type: integer

Value must be greater or equal to 0 and lesser or equal to 512

root network proxy-protocol
Default: false

PROXYv2 protocol configuration.

root network proxy-protocol anyOf item 0
Type: enum (of boolean)

Must be one of:

  • false
root network proxy-protocol anyOf item 1
Type: object

PROXYv2 protocol configuration.

root network proxy-protocol anyOf item 1 allow
Type: array

Allow usage of the PROXYv2 protocol headers by clients on the specified addresses.

 No Additional Items

Each item of this array must be:

root network proxy-protocol anyOf item 1 allow allow items

root network listen
Type: array of object Default: [{"interface": ["127.0.0.1"], "unix_socket": null, "port": 53, "kind": "dns", "freebind": false}, {"interface": ["::1"], "unix_socket": null, "port": 53, "kind": "dns", "freebind": true}]

List of interfaces to listen to and its configuration.

 No Additional Items

Each item of this array must be:

root network listen listen items
Type: object

Configuration of listening interface.

root network listen listen items interface
Default: null

IP address or interface name with optional port number to listen to.

root network listen listen items unix-socket
Default: null

Path to unix domain socket to listen to.

root network listen listen items port
Type: integer or null Default: null

Port number to listen to.

root network listen listen items kind
Type: enum (of string) Default: "dns"

Specifies DNS query transport protocol.

Must be one of:

  • "dns"
  • "xdp"
  • "dot"
  • "doh-legacy"
  • "doh2"

root network listen listen items freebind
Type: boolean Default: false

Used for binding to non-local address.

root views
Type: array of object or null Default: null

List of views and its configuration.

 No Additional Items

Each item of this array must be:

root views views items
Type: object

Configuration parameters that allow you to create personalized policy rules and other.

root views views items subnets
Type: array of string

Identifies the client based on his subnet. Rule with more precise subnet takes priority.

 No Additional Items

Each item of this array must be:

root views views items subnets subnets items
Type: string

root views views items dst-subnet
Type: string or null Default: null

Destination subnet, as an additional condition.

root views views items protocols
Type: array of enum (of string) or null Default: null

Transport protocol, as an additional condition.

 No Additional Items

Each item of this array must be:

root views views items protocols protocols items
Type: enum (of string)

Must be one of:

  • "udp53"
  • "tcp53"
  • "dot"
  • "doh"
  • "doq"

root views views items tags
Type: array of string or null Default: null

Tags to link with other policy rules.

 No Additional Items

Each item of this array must be:

root views views items tags tags items
Type: string
Must match regular expression: ^(?!-)[a-z0-9-]*[a-z0-9]+$

root views views items answer
Type: enum (of string) Default: null

Direct approach how to handle request from clients identified by the view.

Must be one of:

  • "allow"
  • "refused"
  • "noanswer"

root views views items options
Type: object Default: {"minimize": true, "dns64": true}

Configuration options for clients identified by the view.

root views views items options minimize
Type: boolean Default: true

Send minimum amount of information in recursive queries to enhance privacy.

root views views items options dns64
Type: boolean Default: true

Enable/disable DNS64.

root local-data
Type: object Default: {"ttl": null, "nodata": true, "root_fallback_addresses": null, "root_fallback_addresses_files": null, "addresses": null, "addresses_files": null, "records": null, "rules": null, "rpz": null}

Local data for forward records (A/AAAA) and reverse records (PTR).

root local-data ttl
Type: string or null Default: null

Default TTL value used for added local data/records.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root local-data nodata
Type: boolean Default: true

Use NODATA synthesis. NODATA will be synthesised for matching name, but mismatching type(e.g. AAAA query when only A exists).

root local-data root-fallback-addresses-files
Type: array of string or null Default: null

Direct replace of root hints from a zonefile.

 No Additional Items

Each item of this array must be:

root local-data root-fallback-addresses-files root-fallback-addresses-files items
Type: string

root local-data addresses
Type: object or null Default: null

Direct addition of hostname and IP addresses pairs.

root local-data addresses-files
Type: array of string or null Default: null

Direct addition of hostname and IP addresses pairs from files in '/etc/hosts' like format.

 No Additional Items

Each item of this array must be:

root local-data addresses-files addresses-files items
Type: string

root local-data records
Type: string or null Default: null

Direct addition of records in DNS zone file format.

root local-data rules
Type: array of object or null Default: null

Local data rules.

 No Additional Items

Each item of this array must be:

root local-data rules rules items
Type: object

Local data advanced rule configuration.

root local-data rules rules items name
Default: null

Hostname(s).

root local-data rules rules items name anyOf item 0
Type: null
root local-data rules rules items name anyOf item 1

root local-data rules rules items name anyOf item 1 anyOf item 0
Type: array of string
No Additional Items

Each item of this array must be:

root local-data rules rules items name anyOf item 1 anyOf item 0 item 0 items
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$
root local-data rules rules items name anyOf item 1 anyOf item 1
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root local-data rules rules items subtree
Type: enum (of string) Default: null

Type of subtree.

Must be one of:

  • "empty"
  • "nxdomain"
  • "redirect"

root local-data rules rules items file
Default: null

Path to file(s) with hostname and IP address(es) pairs in '/etc/hosts' like format.

root local-data rules rules items file anyOf item 0
Type: null
root local-data rules rules items file anyOf item 1

root local-data rules rules items file anyOf item 1 anyOf item 0
Type: array of string
No Additional Items

Each item of this array must be:

root local-data rules rules items file anyOf item 1 anyOf item 0 item 0 items
Type: string
root local-data rules rules items file anyOf item 1 anyOf item 1
Type: string

root local-data rules rules items records
Type: string or null Default: null

Direct addition of records in DNS zone file format.

root local-data rules rules items tags
Type: array of string or null Default: null

Tags to link with other policy rules.

 No Additional Items

Each item of this array must be:

root local-data rules rules items tags tags items
Type: string
Must match regular expression: ^(?!-)[a-z0-9-]*[a-z0-9]+$

root local-data rules rules items ttl
Type: string or null Default: null

Optional, TTL value used for these answers.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root local-data rules rules items nodata
Type: boolean or null Default: null

Optional, use NODATA synthesis. NODATA will be synthesised for matching name, but mismatching type(e.g. AAAA query when only A exists).

root local-data rpz
Type: array of object or null Default: null

List of Response Policy Zones and its configuration.

 No Additional Items

Each item of this array must be:

root local-data rpz rpz items
Type: object

Configuration or Response Policy Zone (RPZ).

root local-data rpz rpz items file
Type: string

Path to the RPZ zone file.

root local-data rpz rpz items tags
Type: array of string or null Default: null

Tags to link with other policy rules.

 No Additional Items

Each item of this array must be:

root local-data rpz rpz items tags tags items
Type: string
Must match regular expression: ^(?!-)[a-z0-9-]*[a-z0-9]+$

root forward
Type: array of object or null Default: null

List of Forward Zones and its configuration.

 No Additional Items

Each item of this array must be:

root forward forward items
Type: object

Configuration of forward subtree.

root forward forward items subtree

Subtree(s) to forward.

root forward forward items subtree anyOf item 0
Type: array of string
No Additional Items

Each item of this array must be:

root forward forward items subtree anyOf item 0 item 0 items
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$
root forward forward items subtree anyOf item 1
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root forward forward items servers

Forward servers configuration.

root forward forward items servers anyOf item 0
Type: array of string
No Additional Items

Each item of this array must be:

root forward forward items servers anyOf item 0 item 0 items
Type: string
root forward forward items servers anyOf item 1
Type: array of object
No Additional Items

Each item of this array must be:

root forward forward items servers anyOf item 1 item 1 items
Type: object

Forward server configuration.

root forward forward items servers anyOf item 1 item 1 items address

IP address(es) of a forward server.

root forward forward items servers anyOf item 1 item 1 items transport
Type: enum (of string) Default: null

Transport protocol for a forward server.

Must be one of:

  • "tls"

root forward forward items servers anyOf item 1 item 1 items pin-sha256
Default: null

Hash of accepted CA certificate.

root forward forward items servers anyOf item 1 item 1 items pin-sha256 anyOf item 0
Type: null
root forward forward items servers anyOf item 1 item 1 items pin-sha256 anyOf item 1

root forward forward items servers anyOf item 1 item 1 items pin-sha256 anyOf item 1 anyOf item 0
Type: array of string
No Additional Items

Each item of this array must be:

root forward forward items servers anyOf item 1 item 1 items pin-sha256 anyOf item 1 anyOf item 0 item 0 items
Type: string
Must match regular expression: ^[A-Za-z\d+/]{43}=$
root forward forward items servers anyOf item 1 item 1 items pin-sha256 anyOf item 1 anyOf item 1
Type: string
Must match regular expression: ^[A-Za-z\d+/]{43}=$

root forward forward items servers anyOf item 1 item 1 items hostname
Type: string or null Default: null

Hostname of the Forward server.

Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root forward forward items servers anyOf item 1 item 1 items ca-file
Type: string or null Default: null

Path to CA certificate file.

root forward forward items options
Type: object Default: {"authoritative": false, "dnssec": true}

Subtree(s) forward options.

root forward forward items options authoritative
Type: boolean Default: false

The forwarding target is an authoritative server.

root forward forward items options dnssec
Type: boolean Default: true

Enable/disable DNSSEC.

root cache
Type: object Default: {"storage": "/var/cache/knot-resolver", "size_max": "100M", "garbage_collector": {"interval": "1s", "threshold": 80, "release": 10, "temp_keys_space": "0M", "rw_deletes": 100, "rw_reads": 200, "rw_duration": "0us", "rw_delay": "0us", "dry_run": false}, "ttl_min": "5s", "ttl_max": "1d", "ns_timeout": "1000ms", "prefill": null, "prefetch": {"expiring": false, "prediction": null}}

DNS resolver cache configuration.

root cache storage
Type: string Default: "/var/cache/knot-resolver"

Cache storage of the DNS resolver.

root cache size-max
Type: string Default: "100M"

Maximum size of the cache.

Must match regular expression: ^(\d+)(B|K|M|G)$

root cache garbage-collector
Default: {"interval": "1s", "threshold": 80, "release": 10, "temp_keys_space": "0M", "rw_deletes": 100, "rw_reads": 200, "rw_duration": "0us", "rw_delay": "0us", "dry_run": false}

Use the garbage collector (kres-cache-gc) to periodically clear cache.

root cache garbage-collector anyOf item 0
Type: object

Configuration options of the cache garbage collector (kres-cache-gc).

root cache garbage-collector anyOf item 0 interval
Type: string Default: "1s"

Time interval how often the garbage collector will be run.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache garbage-collector anyOf item 0 threshold
Type: integer Default: 80

Cache usage in percent that triggers the garbage collector.

Value must be greater or equal to 0 and lesser or equal to 100

root cache garbage-collector anyOf item 0 release
Type: integer Default: 10

Percent of used cache to be freed by the garbage collector.

Value must be greater or equal to 0 and lesser or equal to 100

root cache garbage-collector anyOf item 0 temp-keys-space
Type: string Default: "0M"

Maximum amount of temporary memory for copied keys (0 = unlimited).

Must match regular expression: ^(\d+)(B|K|M|G)$

root cache garbage-collector anyOf item 0 rw-deletes
Type: integer Default: 100

Maximum number of deleted records per read-write transaction (0 = unlimited).

Value must be greater or equal to 0

root cache garbage-collector anyOf item 0 rw-reads
Type: integer Default: 200

Maximum number of readed records per read-write transaction (0 = unlimited).

Value must be greater or equal to 0

root cache garbage-collector anyOf item 0 rw-duration
Type: string Default: "0us"

Maximum duration of read-write transaction (0 = unlimited).

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache garbage-collector anyOf item 0 rw-delay
Type: string Default: "0us"

Wait time between two read-write transactions.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache garbage-collector anyOf item 0 dry-run
Type: boolean Default: false

Run the garbage collector in dry-run mode.
root cache garbage-collector anyOf item 1
Type: enum (of boolean)

Must be one of:

  • false

root cache ttl-min
Type: string Default: "5s"

Minimum time-to-live for the cache entries.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache ttl-max
Type: string Default: "1d"

Maximum time-to-live for the cache entries.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache ns-timeout
Type: string Default: "1000ms"

Time interval for which a nameserver address will be ignored after determining that it does not return (useful) answers.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache prefill
Type: array of object or null Default: null

Prefill the cache periodically by importing zone data obtained over HTTP.

 No Additional Items

Each item of this array must be:

root cache prefill prefill items
Type: object

Prefill the cache periodically by importing zone data obtained over HTTP.

root cache prefill prefill items origin
Type: string

Origin for the imported data. Cache prefilling is only supported for the root zone ('.').

Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root cache prefill prefill items url
Type: string

URL of the zone data to be imported.

root cache prefill prefill items refresh-interval
Type: string Default: "1d"

Time interval between consecutive refreshes of the imported zone data.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache prefill prefill items ca-file
Type: string or null Default: null

Path to the file containing a CA certificate bundle that is used to authenticate the HTTPS connection.

root cache prefetch
Type: object Default: {"expiring": false, "prediction": null}

These options help keep the cache hot by prefetching expiring records or learning usage patterns and repetitive queries.

root cache prefetch expiring
Type: boolean Default: false

Prefetch expiring records.

root cache prefetch prediction
Type: object or null Default: null

Prefetch record by predicting based on usage patterns and repetitive queries.

root cache prefetch prediction window
Type: string Default: "15m"

Sampling window length.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root cache prefetch prediction period
Type: integer Default: 24

Number of windows that can be kept in memory.

Value must be greater or equal to 1

root dnssec
Default: true

Disable DNSSEC, enable with defaults or set new configuration.

root dnssec anyOf item 0
Type: boolean
root dnssec anyOf item 1
Type: object

DNSSEC configuration.

root dnssec anyOf item 1 trust-anchor-sentinel
Type: boolean Default: true

Allows users of DNSSEC validating resolver to detect which root keys are configured in resolver's chain of trust. (RFC 8509)

root dnssec anyOf item 1 trust-anchor-signal-query
Type: boolean Default: true

Signaling Trust Anchor Knowledge in DNSSEC Using Key Tag Query, according to (RFC 8145#section-5).

root dnssec anyOf item 1 time-skew-detection
Type: boolean Default: true

Detection of difference between local system time and expiration time bounds in DNSSEC signatures for '. NS' records.

root dnssec anyOf item 1 keep-removed
Type: integer Default: 0

How many removed keys should be held in history (and key file) before being purged.

Value must be greater or equal to 0

root dnssec anyOf item 1 refresh-time
Type: string or null Default: null

Force trust-anchors to be updated every defined time periodically instead of relying on (RFC 5011) logic and TTLs. Intended only for testing purposes.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root dnssec anyOf item 1 hold-down-time
Type: string Default: "30d"

Modify hold-down timer (RFC 5011). Intended only for testing purposes.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root dnssec anyOf item 1 trust-anchors
Type: array of string or null Default: null

List of trust-anchors in DS/DNSKEY records format.

 No Additional Items

Each item of this array must be:

root dnssec anyOf item 1 trust-anchors trust-anchors items
Type: string

root dnssec anyOf item 1 negative-trust-anchors
Type: array of string or null Default: null

List of domain names representing negative trust-anchors. (RFC 7646)

 No Additional Items

Each item of this array must be:

root dnssec anyOf item 1 negative-trust-anchors negative-trust-anchors items
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root dnssec anyOf item 1 trust-anchors-files
Type: array of object or null Default: null

List of zonefiles where trust-anchors are stored.

 No Additional Items

Each item of this array must be:

root dnssec anyOf item 1 trust-anchors-files trust-anchors-files items
Type: object

Trust-anchor zonefile configuration.

root dnssec anyOf item 1 trust-anchors-files trust-anchors-files items file
Type: string

Path to the zonefile that stores trust-anchors.

root dnssec anyOf item 1 trust-anchors-files trust-anchors-files items read-only
Type: boolean Default: false

Blocks zonefile updates according to RFC 5011.

root dns64
Default: false

Disable DNS64 (RFC 6147), enable with defaults or set new configuration.

root dns64 anyOf item 0
Type: boolean
root dns64 anyOf item 1
Type: object

DNS64 (RFC 6147) configuration.

root dns64 anyOf item 1 prefix
Type: string Default: "64:ff9b::/96"

IPv6 prefix to be used for synthesizing AAAA records.

root dns64 anyOf item 1 rev-ttl
Type: string or null Default: null

TTL in CNAME generated in the reverse 'ip6.arpa.' subtree.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root dns64 anyOf item 1 exclude-subnets
Type: array of string or null Default: null

IPv6 subnets that are disallowed in answer.

 No Additional Items

Each item of this array must be:

root dns64 anyOf item 1 exclude-subnets exclude-subnets items
Type: string

root logging
Type: object Default: {"level": "notice", "target": "stdout", "groups": null, "dnssec_bogus": false, "dnstap": false, "debugging": {"assertion_abort": false, "assertion_fork": "5m"}}

Logging and debugging configuration.

root logging level
Type: enum (of string) Default: "notice"

Global logging level.

Must be one of:

  • "crit"
  • "err"
  • "warning"
  • "notice"
  • "info"
  • "debug"

root logging target
Default: "from-env"

Global logging stream target. "from-env" uses $KRESLOGGINGTARGET and defaults to "stdout".

root logging target anyOf item 0
Type: enum (of string)

Must be one of:

  • "syslog"
  • "stderr"
  • "stdout"
root logging target anyOf item 1
Type: enum (of string)

Must be one of:

  • "from-env"

root logging groups
Type: array of enum (of string) or null Default: null

List of groups for which 'debug' logging level is set.

 No Additional Items

Each item of this array must be:

root logging groups groups items
Type: enum (of string)

Must be one of:

  • "manager"
  • "supervisord"
  • "cache-gc"
  • "system"
  • "cache"
  • "io"
  • "net"
  • "ta"
  • "tasent"
  • "tasign"
  • "taupd"
  • "tls"
  • "gnutls"
  • "tls_cl"
  • "xdp"
  • "doh"
  • "dnssec"
  • "hint"
  • "plan"
  • "iterat"
  • "valdtr"
  • "resolv"
  • "select"
  • "zoncut"
  • "cookie"
  • "statis"
  • "rebind"
  • "worker"
  • "policy"
  • "daf"
  • "timejm"
  • "timesk"
  • "graphi"
  • "prefil"
  • "primin"
  • "srvstl"
  • "wtchdg"
  • "nsid"
  • "dnstap"
  • "tests"
  • "dotaut"
  • "http"
  • "contrl"
  • "module"
  • "devel"
  • "renum"
  • "exterr"
  • "rules"
  • "prlayr"
  • "defer"

root logging dnssec-bogus
Type: boolean Default: false

Logging a message for each DNSSEC validation failure.

root logging dnstap
Default: false

Logging DNS requests and responses to a unix socket.

root logging dnstap anyOf item 0
Type: enum (of boolean)

Must be one of:

  • false
root logging dnstap anyOf item 1
Type: object

Logging DNS queries and responses to a unix socket.

root logging dnstap anyOf item 1 unix-socket
Type: string

Path to unix domain socket where dnstap messages will be sent.

root logging dnstap anyOf item 1 log-queries
Type: boolean Default: true

Log queries from downstream in wire format.

root logging dnstap anyOf item 1 log-responses
Type: boolean Default: true

Log responses to downstream in wire format.

root logging dnstap anyOf item 1 log-tcp-rtt
Type: boolean Default: true

Log TCP RTT (Round-trip time).

root logging debugging
Type: object Default: {"assertion_abort": false, "assertion_fork": "5m"}

Advanced debugging parameters for kresd (Knot Resolver daemon).

root logging debugging assertion-abort
Type: boolean Default: false

Allow the process to be aborted in case it encounters a failed assertion.

root logging debugging assertion-fork
Type: string Default: "5m"

Fork and abord child kresd process to obtain a coredump, while the parent process recovers and keeps running.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root monitoring
Type: object Default: {"enabled": "lazy", "graphite": false}

Metrics exposisition configuration (Prometheus, Graphite)

root monitoring enabled
Type: enum (of string) Default: "lazy"

configures, whether statistics module will be loaded into resolver

Must be one of:

  • "manager-only"
  • "lazy"
  • "always"

root monitoring graphite
Default: false

optionally configures where should graphite metrics be sent to

root monitoring graphite anyOf item 0
Type: enum (of boolean)

Must be one of:

  • false
root monitoring graphite anyOf item 1
Type: object

root monitoring graphite anyOf item 1 host

root monitoring graphite anyOf item 1 host anyOf item 0
Type: string
root monitoring graphite anyOf item 1 host anyOf item 1
Type: string
root monitoring graphite anyOf item 1 host anyOf item 2
Type: string
Must match regular expression: (?=^.{,253}\.?$)(^(?!\.)((?!-)\.?[a-zA-Z0-9-]{,62}[a-zA-Z0-9])+\.?$)|^\.$

root monitoring graphite anyOf item 1 port
Type: integer Default: 2003

Value must be greater or equal to 1 and lesser or equal to 65535

root monitoring graphite anyOf item 1 prefix
Type: string Default: ""

root monitoring graphite anyOf item 1 interval
Type: string Default: "5s"
Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root monitoring graphite anyOf item 1 tcp
Type: boolean Default: false

root rate-limiting
Type: object or null Default: null

Configuration of rate limiting.

root rate-limiting capacity
Type: integer Default: 524288

Expected maximal number of blocked networks/hosts at the same time.

Value must be greater or equal to 1

root rate-limiting rate-limit
Type: integer

Maximal number of allowed queries per second from a single host.

Value must be greater or equal to 1

root rate-limiting instant-limit
Type: integer Default: 50

Maximal number of allowed queries at a single point in time from a single host.

Value must be greater or equal to 1

root rate-limiting slip
Type: integer Default: 2

Number of restricted responses out of which one is sent as truncated, the others are dropped.

Value must be greater or equal to 0 and lesser or equal to 32

root rate-limiting log-period
Type: string Default: "0s"

Minimal time between two log messages, or '0s' to disable.

Must match regular expression: ^(\d+)(us|ms|s|m|h|d)$

root rate-limiting dry-run
Type: boolean Default: false

Perform only classification and logging but no restrictions.

root lua
Type: object Default: {"script_only": false, "script": null, "script_file": null}

Custom Lua configuration.

root lua script-only
Type: boolean Default: false

Ignore declarative configuration and use only Lua script or file defined in this section.

root lua script
Type: string or null Default: null

Custom Lua configuration script.

root lua script-file
Type: string or null Default: null

Path to file that contains Lua configuration script.