Roadmap¶

Current release: v0.9.17

The milestone list below is included verbatim from ROADMAP.md in the repository root, which is the single source of truth for what is shipped. Edit that file — this page cannot drift from it, and the docs build fails if the include is removed or the version above stops matching Cargo.toml.

🗺️ Roadmap¶

✅ v0.1.0 - Foundation¶

• Project structure with Clean Architecture
• Rust workspace with 5 crates + tests
• Axum web server integration
• Modern dashboard with HTMX + Alpine.js
• REST API endpoints structure
• SQLite persistence
• Basic DNS server implementation
• Full DNS resolver (A, AAAA, CNAME, MX, TXT, PTR, RFC...)
• Upstream DNS forwarding UDP
• Upstream DNS-over-HTTPS (DoH)
• Upstream DNS-over-TLS (DoT)
• Load balancing across upstreams
• Query caching with TTL
• Local DNS records (domain.local)
• Cache L1/L2
• Cache LFUK eviction (sliding window)
• Bloom filter
• Core tests coverage

✅ v0.2.0 - Blocklist & Whitelist¶

• Auto detect client IP and MAC address
• Client groups
• Wildcard domain blocking (*.ads.com)
• Whitelist support
• Blocklist functionality
• Blocklist URL import
• Blocklist regex support
• Allow and block buttons in query log
• Conditional forwarding

✅ v0.3.0 - Advanced Features¶

• Advanced analytics and graphs (upstream latency, top sites, blocked sites)
• DNS-over-QUIC (DoQ) upstream
• HTTP/3 upstream
• IPv6 upstreams
• DNS name upstreams (e.g. dns.google.com)
• CNAME cloaking detection
• Safe Search enforcement
• Blockable services (1-click)

✅ v0.4.0 - Parental Controls¶

• Per-group blocklist assignment (assign specific blocklists to client groups)
• Scheduling per group + Parental Controls UI

✅ v0.5.0 - Server Advanced Features¶

• DoH/DoT server (listener-side, serve encrypted DNS to clients)
• PROXY Protocol v2 (real client IP behind load balancers)
• PTR auto-generation from A records (192.168.1.10 → server.local creates 10.1.168.192.in-addr.arpa PTR)
• DNS Rebinding Protection

✅ v0.6.0 - Performance & Scale¶

• Pi-hole compatible API
• Performance benchmarks vs. competitors
• dashboard Setting system status, pools dns status, cache ouverview, system information, kernel, uptime, load etc..

✅ v0.7.0 - Security¶

• Login / Auth
• HTTPS for Web UI
• API Key / token
• Rate limiting DNS (token bucket per-subnet, slip TC=1, dry-run, NXDOMAIN budget)
• DoS protection (TCP/DoT per-IP connection limiting, RAII guards)
• DNS Tunneling Detection (two-phase: hot-path O(1) guard + background statistical analysis)
• NXDomain hijack detection (detect ISP/upstream NXDOMAIN redirection)
• Response IP filtering (block known C2 IPs in DNS responses)
• DGA Detection (Domain Generation Algorithm — entropy + n-gram + lexical analysis)
• Separate listening ports for DoH and Admin UI

🎯 v0.8.0 - Export & Observability (Current)¶

• Config export/import (backup and restore)
• Prometheus metrics
• OpenAPI / Swagger docs
• Predictive prefetch — delivered via cache_optimistic_refresh (popularity/recency-weighted near-expiry refresh + serve-stale); speculative Markov co-occurrence prefetch evaluated and dropped as low-value/privacy-risk for a forwarder

🎯 v0.9.0 - Protocol Hardening & Privacy¶

• Upstream anti-spoofing — off-path forgery validation on every plain-UDP (Do53) upstream response, for every record type: transaction-ID + question name/type checks always on; DNS Cookies (RFC 7873) always sent and validated gracefully; opt-in 0x20 QNAME case randomization (draft-vixie-dns-0x20) via qname_case_randomization, stripped from the response before it is cached so it never reaches clients. Encrypted transports (DoT/DoH/DoQ) skip cookie/0x20 validation (TLS already authenticates the upstream), tolerating upstreams that normalize QNAME case. Upstream source ports rotate so a discovered port goes stale
• DNSSEC downgrade detection — an empty DS answer is checked against the parent's authenticated NSEC/NSEC3 denial (RFC 4035 §5.2); a signed proof that contradicts the answer is Bogus. Detection, not enforcement: a missing or unauthenticated authority section fails open to the previous insecure-delegation behaviour, so an attacker who composes the whole response can still downgrade by omitting the proof. Fail-opens are counted at GET /api/dnssec/stats (ds_denial_fail_opens) so the gap is visible; making it enforcing needs an opt-in strict knob, still to do
• EDNS UDP payload size negotiation + correct TC truncation (RFC 6891 §6.2.5 / RFC 7766) — honor client-advertised buffer, set TC=1 on oversized responses
• DNSSEC validation enforcement (RFC 4035 / RFC 6840) — SERVFAIL on Bogus, AD bit set/clear from validation, honor client CD bit (upgrade from current advisory dnssec_status tagging)
• DNS-over-QUIC (DoQ) server listener (RFC 9250) — serve encrypted DNS to clients over QUIC (upstream DoQ already supported)
• DNS64 / NAT64 AAAA synthesis (RFC 6147) — [dns64] enabled / prefix (well-known 64:ff9b::/96, /96 only) synthesizes AAAA from A records for IPv6-only clients; reverse PTR synthesis; dns64_synthesized query-log tag + Prometheus metric. NAT64 packet translation remains the network gateway's job
• EDNS Client Subnet (RFC 7871) — strip client ECS by default for privacy; optional configurable subnet injection upstream for CDN-correct results
• Custom sinkhole IP for blocked responses (configurable A/AAAA target beyond 0.0.0.0 / ::) — [blocking] sinkhole_ipv4 / sinkhole_ipv6, applied to null_ip blocked answers
• TOTP / 2FA — two-phase login (TOTP enrollment + /auth/2fa/verify) plus WebAuthn passkeys as a second factor or passwordless login, gated on [auth.webauthn]; API keys are exempt

🌟 v1.0.0 - Production Ready¶

• Supply-chain scanning & vulnerability disclosure (cargo audit + Trivy image scan + Dependabot + secret scanning + SECURITY.md private reporting)
• Security audit (threat model + manual review / pentest of the DNS parsing, auth and API attack surface)
• Comprehensive test coverage (>80%)
• Production deployment guide
• API v1 stable
• Full documentation

🎯 v1.1.0 - Next Features¶

• Suspicious TLD blocking (high-risk TLDs with dedicated UI — .tk, .top, .xyz, .buzz, .gq)
• Threat Intelligence feeds (abuse.ch, OpenPhish, PhishTank — native CSV/JSON ingestion + fast refresh)
• Newly Registered Domain (NRD) blocking (< 30 days, dedicated UI + configurable quarantine window)
• Time-based Blocking (per blocklist and per domain)
• Blocklist Dry-Run / Simulation Mode
• Blocklist Impact Analysis
• Per-blocklist hit stats (24h / 7d / 30d)
• DDNS HTTP endpoint
• ACME DNS-01 challenge endpoint
• Split-horizon DNS (Views)
• Per-group upstream DNS
• Webhook / push notifications
• Audit log for configuration changes
• WebSocket dashboard for slow query monitoring
• Query anomaly detection
• DoH bypass detection (detect malware using direct DoH to public resolvers)
• mDNS / Bonjour device discovery — passive UDP 5353 listener (multicast 224.0.0.251) to label clients by device name instead of bare IPs (listener landed; name parsing + UI labeling in progress)

RFC Compliance¶

See Security Hardening for what each of the security-related entries actually does and where it stops.

Release history¶

Per-version highlights live in the Changelog; full release notes are published on GitHub Releases.