rcvd is a privacy-first encrypted DNS engine: a single Go binary driven by purpose-built configuration files. It speaks DNS over QUIC (DoQ), DNS over TLS (DoT), and DNS over HTTPS (DoH/DoH3), and never falls back to cleartext DNS. If every encrypted upstream fails it returns SERVFAIL rather than leaking a query over port 53. Features include multi-upstream fallback with health checks, DNSSEC validation, domain blocklists and allowlists (plain-list and hosts formats, with wildcard support; an allowlist switches to default-deny), a built-in cache, runtime statistics, and both forwarder and encrypted-upstream service modes. TLS can be automated via ACME (certmagic) so any encrypted endpoint (DoH, DoT, or DoQ) presents a real CA certificate with a DNS-ID in its SAN. A forwarder normally verifies its upstream against the Web-PKI, so a Mode 1 instance can point at any public CA-issued resolver unchanged. For a private link between two rcvd instances on a trusted LAN, it can instead pin the upstream service's public key (SPKI pin), accepting a self-signed certificate while still failing closed on any key mismatch.
| OS | Architecture | Version |
|---|---|---|
| (none) |
Binary packages can be installed with the high-level tool pkgin (which can be installed with pkg_add) or pkg_add(1) (installed by default). The NetBSD packages collection is also designed to permit easy installation from source.
The pkg_admin audit command locates any installed package which has been mentioned in security advisories as having vulnerabilities.
Please note the vulnerabilities database might not be fully accurate, and not every bug is exploitable with every configuration.
Problem reports, updates or suggestions for this package should be reported with send-pr.