A DNS Server and Client Implementation in Pure JavaScript with no dependencies.
- Server and Client
- Lot of Type Supported
- Extremely lightweight
- DNS over UDP, TCP, HTTPS Supported
$ npm install dns2Lookup any records available for the domain lsong.org.
DNS client will use UDP by default.
constdns2=require('dns2');constoptions={// nameServers: ['8.8.8.8'] — array of DNS server IPs (default: Google + 114dns)// port: 53 — DNS server port (number)// recursive: true — Recursion Desired flag (boolean, default true)// timeout: 3000 — per-name-server timeout in milliseconds};constdns=newdns2(options);(async()=>{constresult=awaitdns.resolveA('google.com');console.log(result.answers);})();The high-level DNS class exposes convenience methods for common record types:
| Method | Record type | Key answer fields |
|---|---|---|
resolveA(domain) | A | address |
resolveAAAA(domain) | AAAA | address |
resolveMX(domain) | MX | exchange, priority |
resolveCNAME(domain) | CNAME | domain |
resolveSOA(domain) | SOA | primary, admin, serial, refresh, retry, expiration, minimum |
resolvePTR(domain) | PTR | domain |
resolveDNSKEY(domain) | DNSKEY | publicKey, algorithm |
resolveRRSIG(domain) | RRSIG | varies |
For any record type not listed above, use dns.resolve(domain, 'TYPE') directly.
Every name server is queried in parallel and the first successful reply wins. If all of them fail, the rejection names each server and its reason.
Packet.parse throws a Packet.DecodeError when a message cannot be decoded at
all — it is shorter than a 12-octet header, or not a Buffer:
try{Packet.parse(buffer);}catch(err){// "message is 7 octets, too short for the 12-octet header (RFC 1035 §4.1.1)"console.error(err.message);}Once the header decodes, a malformed record no longer disappears silently.
Records that cannot be decoded are dropped — a half-populated record would be
worse than none — and the reason is reported on packet.errors:
constpacket=Packet.parse(buffer);for(consterrofpacket.errors){console.error(err.message);// "answers[0] at offset 12: TXT decode: character-string of 10 octets// overruns RDATA (4 octets remaining)"err.section;// 'questions' | 'answers' | 'authorities' | 'additionals'err.index;// position within that sectionerr.offset;// octet offset in the message where the record startederr.recovered;// see below}packet.errors is empty for a clean parse, so packet.errors.length is the test
for "did anything go wrong". Comparing a section's length against its header
count (packet.answers.length vs packet.header.ancount) shows how much of the
message survived.
err.recovered distinguishes the two kinds of failure:
true— the damage was confined to one record's RDATA. RDLENGTH says where the next record begins, so decoding continued and later records are intact.false— the failure left the reader misaligned (a truncated message, or a name that ran off the end). Nothing after that point can be located, so decoding stopped there instead of emitting junk records.
Servers surface the same information. A query that cannot be decoded at all
raises requestError; one that partially decodes reaches the handler with
request.errors populated, which is enough to answer FORMERR if you prefer:
dns2.createServer({udp: true,handle: (request,send)=>{if(request.errors.length){constresponse=Packet.createResponseFromRequest(request);response.header.rcode=Packet.RCODE.FORMERR;returnsend(response);}// ...},}).on('requestError',err=>console.error('undecodable query:',err.message));FORMERR says "malformed" in four bits and nothing more. RFC 8914 Extended DNS
Errors add an EDNS option carrying an INFO-CODE plus free-form text, which is
where a decode reason belongs. Packet.EDE.INVALID_DATA (24) is the code for
data that could not be interpreted.
Packet.createErrorResponseFromRequest composes the whole reply:
constserver=dns2.createServer({udp: true,handle: (request,send)=>{if(request.errors.length){returnsend(Packet.createErrorResponseFromRequest(request,Packet.RCODE.FORMERR,{infoCode: Packet.EDE.INVALID_DATA,extraText: request.errors.map(e=>e.message).join('; '),}),);}// ... normal handling},});A client reads it back off any response:
constresponse=awaitresolve('example.com');constopt=response.additionals.find(r=>r.type===Packet.TYPE.EDNS);for(constoptionofopt?.rdata??[]){if(option.ednsCode!==Packet.EDNS_OPTION_CODE.EDE)continue;console.error(`${Packet.EDE_NAME[option.infoCode]??option.infoCode}: ${option.extraText}`,);// "INVALID_DATA: answers[0] at offset 12: TXT decode: character-string ..."}Extended errors are additive — they annotate a response without changing its
RCODE, and appear on NOERROR responses too. Three details the builder handles:
- The option is attached only when the request carried an OPT record (RFC 8914 §3), since a client that didn't signal EDNS cannot be sent EDNS options. A request too malformed to have a readable OPT gets a bare RCODE.
- An OPT is added regardless when the RCODE exceeds 15, so its high byte
survives serialization — otherwise
BADVERSwould go out asNOERROR. extraTextis truncated toPacket.EDE_MAX_TEXT(256), because the reply still has to fit the negotiated UDP payload size.
Packet.EDE holds the full registry of INFO-CODEs and Packet.EDE_NAME maps a
received code back to its name.
SOA (Start of Authority) records contain the authoritative zone information for a domain.
If the authoritative nameserver returns the SOA record in the answer section, it will appear
in result.answers. Otherwise check result.authorities.
constdns2=require('dns2');constdns=newdns2({nameServers: ['8.8.8.8']});(async()=>{constresult=awaitdns.resolveSOA('google.com');constsoa=result.answers[0]||result.authorities[0];if(soa){console.log(soa.primary);// ns1.google.comconsole.log(soa.admin);// dns-admin.google.comconsole.log(soa.serial);// zone serial numberconsole.log(soa.refresh);// refresh interval (seconds)console.log(soa.retry);// retry interval (seconds)console.log(soa.expiration);// expiry (seconds)console.log(soa.minimum);// minimum TTL (seconds)}})();Another way to instanciate dns2 UDP Client:
const{ UDPClient }=require('dns2');constresolve=UDPClient();(async()=>{constresponse=awaitresolve('google.com');console.log(response.answers);})();Lookup any records available for the domain lsong.org. By default, DNS requests will use UDP.
const{ TCPClient }=require('dns2');constresolve=TCPClient();(async()=>{try{constresponse=awaitresolve('lsong.org');console.log(response.answers);}catch(error){// some DNS servers (i.e cloudflare 1.1.1.1, 1.0.0.1)// may send an empty response when using TCPconsole.log(error);}})();You can pass your own DNS Server.
const{ TCPClient }=require('dns2');constresolve=TCPClient({dns: '1.1.1.1',});(async()=>{try{constresult=awaitresolve('google.com');console.log(result.answers);}catch(error){console.log(error);}})();You can use the first DNS server from your OS with native node dns.
constdns=require('dns');const{ TCPClient }=require('dns2');constresolve=TCPClient({dns: dns.getServers()[0],});(async()=>{try{constresult=awaitresolve('google.com');console.log(result.answers);}catch(error){console.log(error);}})();constdns2=require('dns2');const{ Packet }=dns2;constserver=dns2.createServer({udp: true,handle: (request,send,rinfo)=>{constresponse=Packet.createResponseFromRequest(request);const[question]=request.questions;const{ name }=question;response.answers.push({
name,type: Packet.TYPE.A,class: Packet.CLASS.IN,ttl: 300,address: '8.8.8.8',});send(response);},});server.on('request',(request,response,rinfo)=>{console.log(request.header.id,request.questions[0]);});server.on('requestError',error=>{console.log('Client sent an invalid request',error);});server.on('listening',()=>{console.log(server.addresses());});server.on('close',()=>{console.log('server closed');});server.listen({// Optionally specify port, address and/or the family of socket() for udp server:udp: {port: 5333,address: '127.0.0.1',},// Optionally specify port and/or address for tcp server:tcp: {port: 5333,address: '127.0.0.1',},});// eventuallyserver.close();Then you can test your DNS server:
$ dig @127.0.0.1 -p5333 lsong.orgNote that when implementing your own lookups, the contents of the query
will be found in request.questions[0].name.
Use Packet.RCODE to send standard DNS error responses from your handler:
| Constant | Value | Meaning |
|---|---|---|
Packet.RCODE.NOERROR | 0 | No error |
Packet.RCODE.FORMERR | 1 | Format error |
Packet.RCODE.SERVFAIL | 2 | Server failure |
Packet.RCODE.NXDOMAIN | 3 | Non-existent domain |
Packet.RCODE.NOTIMP | 4 | Not implemented |
Packet.RCODE.REFUSED | 5 | Query refused |
Packet.RCODE.YXDOMAIN | 6 | Name exists when it should not |
Packet.RCODE.YXRRSET | 7 | RRset exists when it should not |
Packet.RCODE.NXRRSET | 8 | RRset that should exist does not |
Packet.RCODE.NOTAUTH | 9 | Not authoritative / not authorized |
Packet.RCODE.NOTZONE | 10 | Name not contained in zone |
Packet.RCODE.DSOTYPENI | 11 | DSO-TYPE not implemented |
Packet.RCODE.BADVERS | 16 | Bad OPT version |
Packet.RCODE.BADSIG | 16 | TSIG signature failure |
Packet.RCODE.BADKEY | 17 | Key not recognized |
Packet.RCODE.BADTIME | 18 | Signature out of time window |
Packet.RCODE.BADMODE | 19 | Bad TKEY mode |
Packet.RCODE.BADNAME | 20 | Duplicate key name |
Packet.RCODE.BADALG | 21 | Algorithm not supported |
Packet.RCODE.BADTRUNC | 22 | Bad truncation |
Packet.RCODE.BADCOOKIE | 23 | Bad or missing server cookie |
Codes above 15 do not fit the header's 4-bit RCODE field — their high byte
travels in an OPT record's TTL (RFC 6891 §6.1.3), so a response using one must
carry an OPT. Packet.createErrorResponseFromRequest attaches one for you.
Note that 16 has two names in the IANA registry: they share the code point on
the wire, and only context distinguishes them.
constdns2=require('dns2');const{ Packet }=dns2;constserver=dns2.createServer({udp: true,handle: (request,send)=>{constresponse=Packet.createResponseFromRequest(request);const[question]=request.questions;if(question.name.endsWith('.internal')){// Refuse queries for internal namesresponse.header.rcode=Packet.RCODE.REFUSED;returnsend(response);}if(!isKnownDomain(question.name)){// Domain does not existresponse.header.rcode=Packet.RCODE.NXDOMAIN;returnsend(response);}// Normal answer ...response.answers.push({name: question.name,type: Packet.TYPE.A,class: Packet.CLASS.IN,ttl: 300,address: '1.2.3.4',});send(response);},});- RFC-1034 - Domain Names - Concepts and Facilities
- RFC-1035 - Domain Names - Implementation and Specification
- RFC-2782 - A DNS RR for specifying the location of services (DNS SRV)
- RFC-7766 - DNS Transport over TCP - Implementation Requirements
- RFC-8484 - DNS Queries over HTTPS (DoH)
- Fork this Repo first
- Clone your Repo
- Install dependencies by
$ npm install - Checkout a feature branch
- Feel free to add your features
- Make sure your features are fully tested
- Publish your local branch, Open a pull request
- Enjoy hacking <3
Copyright (c) 2016 LIU SONG song940@gmail.com & contributors.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.