🩺 Vitals
- 🟢 Last active: 2026-08-03
- 📦 Latest release: NSD_4_15_0_REL (2026-07-07)
- 🐞 Open issues: 73
- 🌟 Stars: 565
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: nlnetlabs.nl/projects/nsd
- Source: github.com/NLnetLabs/nsd
- License: BSD-3-Clause
- Deployment: Docker | Native Binary
- Data Model: RFC-compliant text zonefiles (no database)
- Jurisdiction: Netherlands 🇳🇱 / EU 🇪🇺 (NLnet Labs, non-profit foundation)
- Compliance (SaaS): N/A (No Vendor Cloud)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - CLI and Zonefile Configuration
- Maintenance: Low (2/5) - Stable Authoritative Daemon
- Enterprise Ready: High (4/5) - Root/TLD-Grade, Paid Support Tier
1. The Executive Summary
What is it? NSD is an authoritative-only DNS server. It answers for the zones you own and nothing else; it never performs recursion. That single-role design keeps the codebase small and the attack surface narrow, which is exactly why NSD is chosen for the highest-assurance positions in the system: several of the internet's DNS root servers and many top-level-domain registries run it. It is the authoritative half of NLnet Labs' two-daemon model, paired with Unbound on the recursive side and kept as a separate program on purpose, so that a bug or compromise in one role cannot reach the other. Developed by NLnet Labs, a Dutch non-profit foundation, it is the EU-governed, foundation-stewarded counterpart to BIND on the authoritative side.
The Strategic Verdict:
- 🔴 For Recursion or an All-in-One: Caution. NSD serves zones and does nothing else. It does not resolve recursively and has no web console. If you want a single daemon that covers both roles, BIND 9 or Technitium fit; for the recursive side, pair NSD with Unbound.
- 🟢 For Hardened Authoritative DNS: Strong Buy. The authoritative server proven at DNS root and TLD scale, minimal by design, BSD-3, and stewarded by an EU non-profit with no corporate roadmap. When serving your own zones must be fast, secure, and under your control, NSD is the reference-grade choice.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | AWS Route 53 (SaaS) | NSD (Self-Hosted) |
|---|---|---|
| Service Fee | Per hosted zone plus per-query | $0 (BSD-3-Clause) |
| Infrastructure | $0 (AWS-managed) | Commodity servers you run |
| Zone Custody | Zones served from AWS | Zones served by you, root-grade software |
Managed DNS is convenient and metered. Your authoritative zones are the public map of your entire infrastructure's naming, and on a hyperscaler they live on the provider's platform while the bill scales with every query your users make. NSD serves the same zones from your own hardware, using the software that runs the DNS root itself. The saving is the per-query meter; the point is custody of the zone data and independence from a provider's control plane.
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Packaged for every major Linux and BSD distribution and available as a Docker image. The daemon is lightweight and quick to install; the work is in authoring zonefiles, configuring zone transfers to secondaries, and managing DNSSEC signing.
- Scalability: NSD is engineered for raw authoritative query throughput and predictable performance under load, which is why it holds up at root and TLD volumes. It scales the way authoritative DNS is meant to, through primary and secondary servers distributing zones, rather than through a database tier or a clustering layer. Its small footprint keeps each node cheap to run.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction and The EU Foundation: NLnet Labs is a Dutch non-profit foundation (ANBI) in Amsterdam, with commercial support through Open Netlabs B.V. As with its sibling Unbound, this is the strongest jurisdictional position among the DNS options: an EU-domiciled foundation, insulated from the US CLOUD Act, with no corporate parent and no acquisition exit. Where BIND's steward is a US non-profit, NSD offers the same foundation-grade continuity under EU law, which is a direct sovereignty advantage for a European registry or public-sector operator.
- The Compliance Shift and Single-Role Discipline: Self-hosted infrastructure, so every control is yours to build and evidence. NSD's design choice shapes the security story: by refusing to do recursion, it keeps a deliberately small and auditable codebase, which is an asset rather than a limitation. It is CLI and zonefile only, with no console and no user-level controls, and NLnet Labs holds no formal ISO 27001 or SOC 2 certification for the software, so any such attestation is yours to earn on your own systems. Budget for DNS expertise; NSD assumes it and rewards it.
- License and The Support Tax: BSD-3-Clause is maximally permissive: no copyleft, no network clause, and no feature paywall. NLnet Labs gates nothing technical behind payment. The only commercial layer is professional support, where Bronze, Silver, and Gold contracts buy response-time SLAs and, at the higher tiers, earlier notice of vulnerabilities ahead of public disclosure. That early-warning window is the one line worth pricing for a root or TLD-grade deployment; everything needed to run NSD in production ships in the free release.
4. Market Landscape
🏢 Proprietary Incumbents
- AWS Route 53: The dominant managed authoritative DNS, billed per hosted zone and per query. Convenient and highly available, but your zone data lives on AWS and the meter runs with your traffic.
- NS1: Enterprise managed authoritative DNS with advanced traffic steering. Strong for global load distribution, but it places your authoritative layer on a vendor's platform where NSD keeps it on yours.
🤝 Open Source Ecosystem
- BIND 9: The all-in-one reference server. BIND handles authoritative and recursive roles in one large codebase under a US non-profit; NSD is the authoritative-only, minimal-surface counterpart under an EU non-profit.
- PowerDNS: The database-backed authoritative alternative with an API and commercial backing. NSD trades PowerDNS's SQL backends and management tooling for a lean, zonefile-based daemon proven at root and TLD scale.