go53 authoritative DNS

Authoritative query handling, TCP fallback paths, CHAOS version response, and no recursive service scope.

Configurable EDNS enablement and UDP payload sizing for modern resolver interoperability.

EDNS NSID response support for node identification and anycast-style operations.

Controlled ANY response behavior reduces amplification exposure while preserving useful diagnostics.

HTTP API routes for zone record creation, lookup, deletion, TSIG keys, DNSSEC keys, and runtime config.

Zone transfer handling, SOA serial behavior, transfer ACLs, DNSSEC material in AXFR, and NOTIFY scheduling.

RFC 9432 catalog-zone workflow for secondary provisioning and fleet-scale zone membership.

TSIG key storage, API management, transfer enforcement option, and distributed TSIG key replication.

DNSKEY/RRSIG support, query-time signing cache, NSEC/NSEC3 chains, wildcard denial, and no-data proofs.

KSK/ZSK metadata, rollover helpers, revoke/retire timing, DS, CDS, and CDNSKEY endpoints.

Signed answer-chain handling and denial coverage around target and no-data cases.

Canonical owner-name comparison for escaped labels, case folding, IDNA, root, and wildcard names.

Signed event replication over persistent TCP/TLS, vector clocks, Merkle repair, and config/key/zone event coverage.

JWT invite creation, one-time invite consume, self-registering joins, and generated distributed node keys.

Zone and DNSSEC key material are loaded for read-heavy serving, while Badger persists changes.

Optional per-source-IP token-bucket QPS limiting on the UDP query path, with silent drops and bounded memory to blunt query floods. TCP and zone transfers are exempt.

Unauthenticated /healthz and /readyz HTTP endpoints for liveness and readiness checks behind load balancers and orchestrators.

Full backups and write-ahead-log exports over the local admin socket, archiver-aware retention, and restore to a point in time including DNSSEC key state.

Import master-file zones and export the served zone through the API, including for DNSSEC-signed zones.

Apex-safe ALIAS pseudo-records flattened to A/AAAA from multiple resolvers, refreshed on a freshness window and served like ordinary signed RRsets.

Zone and owner names are stored and matched in canonical lower case with exact key lookups; existing data is migrated in place on upgrade.

Selectable API auth mode (disabled, none, x-auth-key) on the TCP listener, with the local Unix admin socket as the always-available break-glass path.