RCVD
RCVD (Resilient, Cryptographic, Verifiable DNS) is a privacy-first DNS engine I designed and built from scratch: a single, statically-linked Go binary that forwards and serves DNS over encrypted transports only — DNS-over-QUIC, DNS-over-TLS, and DNS-over-HTTPS — with a hard rule that no query ever leaves the host in plaintext.
Most of the open-source work elsewhere on this site is about finding and fixing gaps in other people’s projects.
RCVD is a different angle: an original project, that heavily leverages existing OpenSource projects, while being deployed on on real hardware, handling live traffic. It grew out of years as a sysadmin and network operator wanting one tool that just encrypts DNS and never falls back to cleartext — instead of assembling a fragile stack of single-purpose programs, each with its own willingness to cause issues.
The project has its own home, oriented to the codebase and design:
- Project site: rcvd.net
- Whitepaper (design + implementation): rcvd.net/whitepaper
The pages below are the operator’s-eye view: What it is, why it exists, and what it’s been like to run it in the field.
RCVD has been running on a real ARM router handling live DNS traffic for roughly two months. Field notes on the bugs I caught myself, the dependency discipline, and the day a real network outage proved the zero-cleartext guarantee held.
RCVD is a single-binary, privacy-first DNS engine that speaks DoQ, DoT, and DoH. An overview of what it does, the design principles, and why a network operator would want it.