I rebuild DNS infrastructure and measure what changed.

The front end. dnsdist answers plain DNS on port 53 and DoT and DoQ on 853, takes DoH from nginx, and applies the ad, tracker, phishing and malware blocklists. It replaced my own AdGuard Home build: one upstream program with configuration, instead of a patched fork to rebase on every release. The configuration, its build and the compiler that turns the blocklists into the database dnsdist reads are public, exported from my private working tree with a dated line for every export.

The part that proves an answer is genuine, and the only part that talks to the wider internet: it forwards over DoT to Cloudflare and Quad9. Checking DNSSEC signatures was eating close to half the server's CPU, so I rebuilt Unbound against BoringSSL - keeping a one-command rollback ready, and no Unbound source patched: the customisation is entirely build flags, config and systemd units.

+14% end-to-end DNSSEC throughput, −27% worst-case latency. The mechanism is roughly 30% faster signature verification - ECDSA P-256 +28.8%, RSA-2048 +34.2% against OpenSSL 3.0.16, over 8 paired rounds with the same benchmark compiled against both libraries. DNSSEC crypto was about 44% of Unbound's CPU, so a ~30% gain on 44% of the work predicts ~13% overall; the end-to-end flood measured +14%. The benchmark ships with the repo, so a library bump can be re-checked rather than assumed.

The front door, answering every encrypted request before anything else sees it. Building on BoringSSL buys three things a stock build cannot do. The name of the site you asked for is encrypted too, with Encrypted Client Hello, instead of travelling in the clear. Traffic recorded today can't be unlocked by a future quantum computer, because the key exchange is already post-quantum. And it speaks HTTP/3, so pages start a round trip sooner.

nginx implements ECH only against the OpenSSL 3.x API, so the repo carries a patch adding the BoringSSL path. The build verifies the PGP signature on every download before it compiles anything, and refuses to proceed on an unpinned signing key.

A DoH3 handshake here started failing about one attempt in twenty, and it was not my build. When the server's ServerHello spans two Initial packets and one of them is lost, nginx never retransmits it: the handshake deadlocks until the client gives up, and nothing is logged. I reported it with a reproduction, and nginx engineers reproduced and diagnosed it on the thread. A fix from an outside contributor is open as nginx/nginx#1617, not merged. Rebuilt here on the same nginx base, its current version did not reduce the failure rate, with either a default or a large post-quantum-sized certificate chain. Since October the build here carries its own two-hunk patch for it, which lets lost handshake data go out when the congestion window is full; it sits in nginx-edge beside the ECH patch, and a stock build is one switch away.

Redis holds the leak-test state, in memory only - no RDB, no AOF, nothing on disk. The update scripts for nginx, Unbound and Redis all verify checksums or signatures before building, test the new binary against the live config before installing it, and roll back automatically if the service doesn't answer afterwards. A watcher tracks every upstream and tells me when one moves, and only when there's something to actually do.

Until October 2026 the resolver ran on my own forks of AdGuard Home, dnsproxy, urlfilter and dnscrypt-proxy: allocation-free hot paths, lock-free data structures, ~13k lines stripped. Keeping four forks rebased on every upstream release cost more than it returned, so dnsdist and Unbound took over their jobs. The repositories are archived, read-only, with the benchmarks and notes kept for reference. Nothing changed for people using the service: same addresses, blocking still on.