Show HN: I built a DNS resolver from scratch in Rust – no DNS libraries

4/2/2026 at 10:09:19 AM

Since I needed it to be my primary DNS, I also added: recursive resolution from root nameservers, DNSSEC chain-of-trust validation, ad blocking (385K+ domains), and LAN service discovery.

I wrote about the DNSSEC implementation here: https://numa.rs/blog/posts/dnssec-from-scratch.html It's now my daily system DNS. Single binary (~8MB), macOS/Linux/Windows.

`sudo numa install`

by rdme

4/2/2026 at 2:50:06 PM

Very interesting project! I have a couple of questions. With all the default blocked domains loaded, what is the average memory usage? Currently, I am using Pi-hole on a low memory single board computer. Is it possible to use this instead of Pi-hole? If so, I’d like to use it for all of my devices."

by pyprism

4/2/2026 at 3:00:23 PM

With 390K blocked domains: ~31MB total process footprint. Breakdown: - Blocklist: 23.4MB (390K domains) - Cache: 3.8MB (4.4K entries) - Query log, SRTT, runtime: ~4MB

It binds to 0.0.0.0:53 by default, so just point your devices' DNS to the board's IP

by rdme

4/3/2026 at 10:05:52 AM

Romanian project. Instant upvote. Great work

by onel

4/2/2026 at 11:03:35 AM

Thanks! If you hit any issues during setup, feel free to open an issue — happy to help debug. The dashboard at localhost:5380 shows what's happening in real time.

by rdme

4/2/2026 at 2:19:04 PM

Why are you replying to your own coment?

by siruwastaken

4/2/2026 at 2:21:16 PM

I think it's a bot? There's an identical version of this comment in another reply, except it cuts off half way through a sentence.

by happytoexplain

4/2/2026 at 2:32:44 PM

I hit reply on the wrong post and you can't delete comments or at least I don't see how it can be done

by rdme

4/2/2026 at 4:12:35 PM

Above the comments I've written on HN I see:

5 minutes ago | parent | next | edit | delete

by dgb23

4/2/2026 at 4:22:54 PM

That only lasts for a few minutes until it’s locked and you can no longer delete after that.

by hxugufjfjf

4/3/2026 at 12:47:42 AM

It lasts 2 full hours, at least for edit. Delete stops working when someone replies afaik.

by eqvinox

4/2/2026 at 2:31:39 PM

because I clicked reply on the wrong one and you can't delete it...

by rdme

4/3/2026 at 9:21:18 AM

Of course I can’t prove it, but i am guessing some kind of “AI” is doing that. Humans rarely use emdashes.

by nalekberov

4/3/2026 at 10:43:45 AM

[flagged]

by BrandoElFollito

4/3/2026 at 5:33:29 PM

Please don't break the site guidelines, regardless of how wrong someone is or you feel they are.

You're right about em dashes of course (https://news.ycombinator.com/item?id=47154752) but being right on a point does not make it ok to attack another user or violate the rules of the site.

https://news.ycombinator.com/newsguidelines.html

by dang

4/3/2026 at 11:55:04 AM

[flagged]

by nalekberov

4/3/2026 at 5:34:24 PM

Please don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse.

https://news.ycombinator.com/newsguidelines.html

by dang

4/3/2026 at 12:10:32 PM

[flagged]

by BrandoElFollito

4/2/2026 at 3:09:01 PM

It's neither here nor there but can I ask about the name? I only ask because when I see "numa" in relation to computing I immediately think "Non-Uniform Memory Access".

Very cool project by the way. I wonder how this would run on an OpenWRT device.

I see in your install.sh that you support Linux and Darwin/MacOS, do you think there would be any major hurdles in supporting FreeBSD?

by voxadam

4/2/2026 at 3:13:27 PM

also in romanian nume = name(dns) and I also get the easter egg of that well known Romanian song numa numa :) https://www.youtube.com/watch?v=YnopHCL1Jk8

On OpenWRT — it's musl-based Linux so the binary should run the arm one would need a crosscompile Free BSD can be done (pr's welcome?)

by rdme

4/2/2026 at 3:10:16 PM

On the web site, it's named after the second King of Rome

by camdv

4/2/2026 at 6:01:51 PM

I have a couple of projects that once a month need to run a few million dns lookups as quickly as possible. I'm tempted to try this just to see how it performs and if it breaks.

by dwedge

4/2/2026 at 6:22:27 PM

let me know if you do it!

by rdme

4/2/2026 at 4:24:15 PM

The interface looks vibecoded. I have no problem with people vibecoding things. In fact, I have zero frontend skills, so I rely on AI to be able to make easy-to-use interfaces. However, I feel like this should be clearly and prominently displayed in the project page.

Furthermore it is a little off-putting to see a vibecoded UI because I have very little confidence that the rest of the backend code is not vibecoded. I know I am possibly being unfair, but this is how it looks to me. If the developer tells me they didn't use AI at all, I would believe it.

by kevin061

4/2/2026 at 4:29:30 PM

It definitely is and you can see it in the git commits. The DNS wire protocol parser was the original learning project I wrote to understand the spec. Later features (recursive resolver, DNSSEC validation, the dashboard) were built with the help of AI

by rdme

4/2/2026 at 7:50:47 PM

That's fair, thanks for letting me know!

by kevin061

4/2/2026 at 4:30:35 PM

I dont get this criticism at all, would you prefer someone write a shittier UI? And since when were people writing amazing bug free software before hand where not being vibe coded meant you could trust its good software?

I guess to be fair, beforehand no body would be attempting this kind of thing and releasing it unless they knew what they were doing

by andoando

4/2/2026 at 7:50:10 PM

I literally said I'm fine with using LLMs for the frontend, but I think this should be disclosed clearly.

by kevin061

4/3/2026 at 5:39:17 AM

I don't think having conditions to certain things qualify as "I'm fine with it"

"I'm fine with people eating meat, as long as they declare so when we go out" like why? Why does it matter?

by bitpush

4/3/2026 at 2:58:38 PM

Both GP's and your example in effect mean "I'm fine with other people doing this, but I don't want to have anything to do with it, or at least be able to decide case-by-case."

Which is a valid stance IMO.

In the OP, a vibecoded UI when the whole project emphasizes "I did this myself, from scratch" is a bit awkward.

Does "I did this myself" mean they read all the relevant specs and then wrote the code - or did they just write the prompts themselves?

Edit: OP already answered and confirmed that they in fact did write the code themselves.

by xg15

4/2/2026 at 4:39:40 PM

Given the state of webdev it is not a surprise. LLMs are my rubber gloves when working with web technologies.

by dev_l1x_be

4/2/2026 at 2:18:09 PM

Nice idea. To test I ran a simple nextjs on port 3000. Added the service via the dashboard. However, when I visit the url, (using chrome latest version), https://{mygivenname}.numa/ I hit a DNS resolution fail error. If I do not use a trailing '/' then it is going to google search for {mygivenname}.numa and shows me some search results. Should I open an issue?

by p2hari

4/2/2026 at 2:27:26 PM

Is it possible you didn't start it as root ( sudo numa install)? Does dig {mygivenname}.numa @127.0.0.1 return 127.0.0.1 ? What OS are you on? Maybe you report it as an issue?

by rdme

4/2/2026 at 2:35:22 PM

Thanks for quick response. It started to work. I think it must be some caching issue. But it needs a trailing '/' . Maybe will raise the issue for this. Cool.

by p2hari

4/2/2026 at 3:08:59 PM

I believe that is actually browser specific behavior. I sometimes use a fake TLD for stuff hosted at home, and both chrome and firefox resort to search if I don't include a trailing '/'. My assumption is the browser does a quick match against known TLDs and if it doesn't match then it resorts to search.

by arcaen

4/2/2026 at 3:24:25 PM

exactly, I'll add a pr soon that tells the os (and browsers) that is'a a valid domain

by rdme

4/2/2026 at 6:55:07 PM

What's the reason you're not using hickory? Or was that the LLMs choice? Genuinely curious

by conradludgate

4/2/2026 at 7:09:32 PM

This was started as a learning project, went from the start to the lowest level then I've just added features I wanted one by one, it just made the most sense

by rdme

4/3/2026 at 6:32:25 PM

The first thing I look at in new DNS code is whether it’s vulnerable to DNS name compression loops. This code passes the test! However it’s vulnerable to dots embedded in labels: it doesn’t escape bytes properly when converting from wire format to text.

by fanf2

4/6/2026 at 6:43:41 PM

Thanks for pointing this out! I’ve created https://github.com/razvandimescu/numa/issues/36

by rdme

4/4/2026 at 2:52:08 PM

How does one handle dots embedded in a label ? Isn’t that not valid?

by BobbyTables2

4/2/2026 at 1:22:04 PM

Same hack here ; I have no DSN running by default - much more handy than having to set up nginx as it has no opinion on the targeted infrastructure. And the bonus point is that you can see every sneaky request that happens when you browse ; so another side-project connected to this is to make an inventory and policy filter

by 6r17

4/2/2026 at 1:29:39 PM

Yes sir! The query log is at GET /querylog (or on the dashboard) shows every request with domain, type, path (forwarded/recursive/cached/blocked) and latency

by rdme

4/2/2026 at 1:54:25 PM

feature request: libnuma so i can use it programmatically with configuration. also, multiple user defined blocklists.

by bahador

4/2/2026 at 2:39:52 PM

Multiple blocklists already work -https://github.com/razvandimescu/numa/blob/main/numa.toml#L4... The pieces are already there for libnuma, it could be done, would you share what use case you have in mind?

by rdme

4/3/2026 at 6:42:05 AM

I have a project that requires DNS lookups and block ads. I am going to try this for it.

by BugsBunnyCodes

4/3/2026 at 7:24:05 AM

let me know how it goes

by rdme

4/2/2026 at 4:39:03 PM

How is to compare to AdGuard? If it gets those features I would be switching over.

by dev_l1x_be

4/2/2026 at 4:45:49 PM

Numa can do recursive resolution from root nameservers + DNSSEC, .numa local domains with auto HTTPS for dev, and LAN service discovery. What features would you be interested in?

by rdme

4/6/2026 at 9:15:45 PM

Just normal ad filtering.

by dev_l1x_be

4/2/2026 at 6:03:06 PM

What about split horizon dns so I can locally resolve home servers instead of going to tailscale

by dwedge

4/2/2026 at 9:08:06 PM

Split DNS already works — Numa auto-detects Tailscale forwarding rules from the system config. Queries matching .<ts.net> go to Tailscale’s DNS, everything else goes through Numa

If you want to skip Tailscale entirely for home servers, Numa’s LAN discovery auto-finds machines running Numa on the same network. Or add static records in numa.toml for machines that don’t run it.

by rdme

4/2/2026 at 10:12:45 AM

Cool idea, every developer running apps in dev on their machine knows this pain for sure. I'll give it a spin and let you know how it goes!

by rbluethl

4/2/2026 at 1:12:36 PM

Thanks! If you hit any issues during setup, feel free to open an issue — happy to help debug. The dashboard at localhost:5380 (or at https://numa.numa)

by rdme

4/2/2026 at 6:23:47 PM

Nice work. What made you choose this license?

by Asuka-wx

4/2/2026 at 10:16:28 AM

I think I need to give this a go. Cool project.

by lyfeninja

4/2/2026 at 11:02:51 AM

Thanks! Let me know how it goes.

by rdme

4/2/2026 at 12:53:00 PM

very interesting. how does the blocklist work? can one manage the lists? like StevenBlack or others.

by _kidlike

4/2/2026 at 1:11:17 PM

Yes, it is configurable as a list https://github.com/razvandimescu/numa/blob/main/numa.toml#L4...

There's also a per-domain allowlist and you can pause/unpause blocking from the dashboard or API.

Here's how the resolution pipeline looks like: https://numa.rs/blog/posts/dns-from-scratch.html#the-resolut...

by rdme

4/2/2026 at 5:29:56 PM

nice

by bulanel

4/2/2026 at 1:27:22 PM

Great idea, pity about the slop.

by voltagex_

4/2/2026 at 3:05:26 PM

we need a [slop] flag in the headlines

by goodpoint

4/3/2026 at 1:41:05 PM

[flagged]

by derodero24

4/3/2026 at 1:40:56 PM

[flagged]

by derodero24

4/3/2026 at 1:40:49 PM

[flagged]

by derodero24

4/2/2026 at 2:10:40 PM

[flagged]

by arafeq

4/2/2026 at 2:23:11 PM

Actually, if you point a container's DNS at the host (dns: [host.docker.internal] in compose), it works for resolution + ad blocking for the reverse however, I've added it on the radar, thanks!

by rdme

4/2/2026 at 3:03:06 PM

How does auto-TLS work? It makes a self signed certificate automatically?

by Kaliboy

4/2/2026 at 3:05:22 PM

Yes — numa install generates a local CA and stores it in the system trust store. When you register a .numa service, it generates a per-service TLS cert signed by that CA

by rdme

4/2/2026 at 4:03:56 PM

I don't want to hijack the thread, because that's a cool project.

Still, if you're looking for something that "just works" and is widely used, have a look at caddy.

by dgb23

4/2/2026 at 2:09:31 PM

[flagged]

by EdoardoIaga