NoDNS

What is NoDNS?

NoDNS is a protocol that resolves DNS records from Nostr events. Instead of registering domains through a traditional registrar and configuring DNS through a control panel, you publish cryptographically-signed events to Nostr relays. A NoDNS-compatible nameserver reads these events and serves them as standard DNS responses.

Your npub (Nostr public key) is your domain. No registration, no fees, no approval. Generate a keypair and publish your records.

Try It Now

This is a live record from a real kind 11111 event published on Nostr:

$ dig npub1ykal2phgzf6ljmql6l8khmf0ekf6ny0582r89m00j9vjt8qezhjqqpa3dl.nodns.shop A

;; ANSWER SECTION:
npub1ykal2...pa3dl.nodns.shop. 300 IN A 193.99.144.80

That record came from this Nostr user's kind 11111 event. They published their DNS records to Nostr relays. Our nameserver picked them up and serves them via standard DNS. Try it in your terminal.

How It Works

1. You publish a kind 11111 Nostr event with your DNS records:
   { "kind": 11111, "tags": [
       ["record", "A", "@", "193.99.144.80", "", ...],
       ["record", "CNAME", "www", "heise.de", "", ...]
     ] }

2. Our bot subscribes to Nostr relays and receives your event in seconds.

3. Bot sends a DDNS update to Knot DNS (authoritative nameserver).

4. Your domain resolves globally via standard DNS.

   npub1{yourkey}.nodns.shop  →  your IP address

Architecture

  Nostr Relays                   nodns-bot              Knot DNS
  ┌──────────────┐              ┌──────────┐           ┌──────────────┐
  │ relay.damus  │──WebSocket──▶│          │──DDNS────▶│              │─── Internet
  │ nostr.band   │─────────────▶│ validate │  UPDATE   │  nodns.shop  │
  │ nos.lol      │─────────────▶│ parse    │  (TSIG)   │  zone        │
  │ nostr.wine   │─────────────▶│ push     │           │  DNSSEC      │
  └──────────────┘              └──────────┘           └──────┬───────┘
                                                              │ NOTIFY
                                                              ▼
                                                       ┌──────────────┐
                                                       │ puck.nether  │
                                                       │ (secondary)  │
                                                       └──────────────┘

The bot does NOT run a DNS server. It's a bridge: Nostr events in, DDNS updates out. Knot DNS handles all DNS serving, DNSSEC signing, zone transfers, and NOTIFY to secondaries. It uses Read-Copy-Update (RCU) for lock-free zone updates — zero query interruption during changes.

The Bot (Coming Next)

The nodns-bot is a Go daemon that automates the entire pipeline. Currently updates are manual while we finalize the implementation.

What it does

• Subscribes to multiple Nostr relays via persistent WebSocket connections (using go-nostr)
• Validates every event: cryptographic signature, record types, IP addresses, rate limits
• Pushes DNS records to Knot via DDNS UPDATE (RFC 2136, using miekg/dns)
• Persists state in SQLite for crash recovery and reconciliation

Security

• Record type whitelist: only A, AAAA, CNAME, TXT, MX allowed
• IP validation: blocks all private/reserved ranges (prevents DNS rebinding)
• Rate limiting: max events per npub per minute
• Record limits: max records per npub
• TTL clamping: 60s minimum, 86400s maximum
• Deletion: only the original publisher can delete their records
• DDNS authentication: TSIG shared secret between bot and Knot

Protocol Spec

NoDNS uses kind 11111 Nostr events with a fixed tag format:

// Legacy format (11 elements, currently in use):
["record", "TYPE", "name", "rdata", "", "", "", "", "", "", "ttl"]

// Examples:
["record", "A",      "@",    "193.99.144.80", "", "", "", "", "", "", "3600"]
["record", "CNAME",  "www",  "example.com",   "", "", "", "", "", "", "3600"]
["record", "MX",     "@",    "10", "mail.example.com", "", "", "", "", "", "3600"]

// New format (5 elements, zone-file style):
["record", "A", "@", "3600", "193.99.144.80"]

The protocol also defines kind 30003 for TLS certificate distribution and kind 5 for record deletion. Full spec: relay.ngit.dev (repos: nodns-protocol-spec and no-dns).

Roadmap

• ✓ Knot DNS deployed on nodns.shop with secondary DNS
• ✓ First npub record resolving globally
• ✓ Landing page at nodns.shop
• ● nodns-bot: automated Nostr-to-DNS bridge
• ○ CLI tool for publishing kind 11111 events
• ○ DNSSEC chain of trust (DS in parent zone)
• ○ Custom names: alice.nodns.shop via Cashu payment
• ○ .cv ccTLD integration with ARME
• ○ EPP-Nostr bridge for permissionless domain registration

Infrastructure