Numa Updates & Release Notes

Ad blocking was broken for everyone on the default config since 1 August. This release fixes it, and hardens the recursive resolver against cache poisoning.

🛡️ Ad blocking was silently off since 1 August

HaGeZi discontinued the hosts/ and domains/ formats on 2026-08-01. The compiled-in default pointed at one, and downloads never checked HTTP status — so a 145-byte error page parsed to zero domains and logged like a healthy load. (#336)

Default moved to wildcard/pro-onlydomains.txt; non-2xx and non-list bodies now fail loudly (#337)

/blocking/stats reports per-source health, so the dashboard shows which list is down instead of blanking (#339)

Each good list is cached to disk, so a restart during an upstream outage keeps blocking (#338)

If your numa.toml pins a HaGeZi hosts/ or domains/ URL, switch it to wildcard/ — the new default only applies if you never overrode it.

🔒 Recursive resolver hardening (RFC 5452)

Out-of-bailiwick referrals rejected — no more injecting NS, glue or DS for zones you don't own (#354, #355)

Random TXIDs from OsRng + reply validation on receipt, closing DNSpooq (CVE-2020-25684/85/86) and residual Kaminsky/SAD-DNS (#358, #359)

Bogon nameserver addresses refused, so referrals can't aim the resolver at your LAN (#356)

Per-query work budget and NS fan-out cap against NXNS / NRDelegation amplification (#357)

ANY answered with a minimal HINFO, RFC 8482 (#343)

📦 EDNS correctness

Forward mode sends DO=1 upstream, so cached wires keep their RRSIGs (#329)

AD is only set for clients that asked for it (#340, #342)

UDP replies fit the client's advertised payload size, with a TC=1 retry over TCP (#347, #351, #352)

🌍 Dashboard translations

Drop one JSON file into site/locales/ — no Rust, no build step. English is the fallback, so a partial locale never breaks the UI. German and Simplified Chinese ship unreviewed (zh-cn by @maxsusu). More welcome: #266. (#360)

⚙️ numa config path / numa config edit

Print or open the config the running service actually reads. Thanks @Guflly (#346, #350).

Also notable

Centralized CLI colors — first contribution from @w3lld1 (#326)

Fuzzing extended to maximize_payload and the client UDP budget (#353)

Dependency bumps: base64 0.23, Rust 1.97 base image, 13-package minor group (#330–#334)

All changes

What's Changed

fix(cli): centralize terminal colors by @w3lld1 in #326
chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in #334
chore(deps): bump the minor-and-patch group with 13 updates by @dependabot[bot] in #333
chore(deps): bump actions/cache from 4 to 6 by @dependabot[bot] in #332
chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #331
chore(deps): bump rust from 1.96-alpine to 1.97-alpine in the minor-and-patch group by @dependabot[bot] in #330
fix(blocklist): replace dead hagezi default, reject non-2xx by @razvandimescu in #337
fix(dnssec): only send AD to clients that asked for it by @razvandimescu in #340
docs(dnssec): cite the section that carries the AD-on-replies rule by @razvandimescu in #342
feat(blocking): report per-source health instead of dropping failures by @razvandimescu in #339
fix(forward): send DO=1 upstream so cached wires always carry RRSIGs by @razvandimescu in #329
feat(blocking): keep a last-known-good copy of every remote list by @razvandimescu in #338
feat: refuse ANY queries with a minimal HINFO (RFC 8482) by @razvandimescu in #343
fix(blocking): regressions from the #336 hardening by @razvandimescu in #344
refactor(blocking): trim what later PRs made redundant by @razvandimescu in #345
feat(cli): add effective config commands by @Guflly in #346
fix(forward): TC=1 escape hatch and DO-bit walker hardening by @razvandimescu in #347
fix(cli): follow-ups to #346 — sudo in the restart hint, README pointer by @razvandimescu in #350
fix(ctx): truncate UDP replies to the client's advertised payload size by @razvandimescu in #352
fix(forward): harden the TC=1 retry from #347 by @razvandimescu in #351
test(fuzz): cover maximize_payload and the client UDP budget by @razvandimescu in #353
fix(recursive): reject out-of-bailiwick referrals (RFC 5452) by @razvandimescu in #354
fix(recursive): bailiwick-filter glue and DS records by @razvandimescu in #355
fix(recursive): reject bogon nameserver addresses by @razvandimescu in #356
fix(recursive): bound per-resolution query budget + NS fan-out width by @razvandimescu in #357
fix(recursive): randomize TXIDs and validate UDP replies (RFC 5452) by @razvandimescu in #358
fix(forward): validate the question on plain-UDP replies (RFC 5452) by @razvandimescu in #359
feat(dashboard): translatable UI via per-language JSON locales by @razvandimescu in #360

New Contributors

@w3lld1 made their first contribution in #326

@Guflly made their first contribution in #346

Full Changelog: v0.22.0...v0.23.0

Highlights

🔐 Dashboard & API authentication

The dashboard and REST API now require a token for any non-loopback client — HTTP Bearer or Basic (native browser prompt). No config needed: a token is minted on first start, logged once, and persisted with 0600 perms, so no deployment is ever unauthenticated. Set your own via [server] api_token or NUMA_API_TOKEN; /health stays open for probes. The .numa reverse proxy forwards the real client IP, so proxied dashboard access gets the same check. (#315)

Upgrading with a dashboard already exposed beyond localhost? Your next visit will ask for credentials — the token is in the startup log (printed once) and in api_token inside your data directory (e.g. /var/lib/numa/, /usr/local/var/numa/). Use it as the password with any username, or set your own in numa.toml.

🔏 DNSSEC: record types that were never actually verified

With [dnssec] enabled = true, answers for types Numa stores as raw rdata — TXT, HTTPS, SVCB, SRV, NAPTR, LOC — were reported Secure without any signature verification: their rrsets never matched their RRSIGs, so validation silently skipped them. They are now signature-checked like everything else, including RFC 4034 canonical-form downcasing for SRV/NAPTR targets. DNSSEC validation is opt-in, so only [dnssec] users were affected. (#325, closes #324)

🔗 CNAME chase correctness

Multi-link CNAME chains included in a single upstream response are now followed to the end before sub-querying, chased answers no longer duplicate chain links, and the chase terminates cleanly on record types without native parsing. (#323)

Also notable

The wire parser is now continuously fuzzed in CI (4 targets, seed corpus), and the repo gained a SECURITY.md disclosure policy (#319)

Parser hardening: DNSKEY/DS records with rdlength shorter than their fixed fields are rejected (found by the fuzzer, #301); OPT records whose owner name is a compression pointer are recognized (#319)

Per-client filter_aaaa override in [[client_policy]] (#307, closes #286)

Query-log entries carry a monotonic seq, so external scrapers (numa-metrics) can page reliably (#310)

Forward mode re-resolves an undetectable system DNS to DoH on network rescan (#321, closes #169)

Dashboard query log fills its column height (#302); AUR publishes are serialized (#298)

Dependency security bumps: quinn-proto (RUSTSEC-2026-0185), crossbeam-epoch (RUSTSEC-2026-0204)

All changes

fix(ci): serialize AUR publish runs by @razvandimescu in #298

fix(dashboard): query log fills column height instead of leaving a void by @razvandimescu in #302

fix(parser): reject DNSKEY/DS records with rdlength < fixed fields by @razvandimescu in #301

site: publish numa services over tailnet by @razvandimescu in #304

site: forgot image by @razvandimescu in #305

chore: updated readme.md and index.html by @razvandimescu in #306

feat(client_policy): per-client filter_aaaa override (#286) by @razvandimescu in #307

docs: clarify Numa has no separate PROXY protocol port by @razvandimescu in #308

feat(query-log): stamp a monotonic seq on each entry by @razvandimescu in #310

docs(readme): link numa-metrics for durable query history by @razvandimescu in #311

chore(deps): bump reqwest to 0.13, pin ring via rustls-no-provider by @razvandimescu in #312

chore(deps): bump the minor-and-patch group with 7 updates by @dependabot[bot] in #318

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #317

chore(deps): bump alpine from 3.23 to 3.24 in the minor-and-patch group by @dependabot[bot] in #316

Add SECURITY.md and CI fuzzing over the wire parser by @razvandimescu in #319

fix(forward): resolve undetectable system DNS to DoH on rescan (#169) by @razvandimescu in #321

test(integration): reap the resolver on exit, stop set -e hiding fail… by @razvandimescu in #322

feat(api): authenticate the HTTP control plane by @razvandimescu in #315

fix(ctx): stop duplicating CNAME chain links in chased answers by @razvandimescu in #323

fix(dnssec): verify rrsets of types without a DnsRecord variant by @razvandimescu in #325

Full Changelog: v0.21.0...v0.22.0

Highlights

🛡️ DNS rebinding protection (opt-in)

Strips private/special-use addresses from upstream answers so a public domain can't point your browser at your router, NAS, or localhost:

[server]
rebind_protect = true

Covers RFC 1918, loopback, link-local, CGNAT/Tailscale ranges, NAT64 and ULA — including glue records and HTTPS/SVCB address hints. Local zones, overrides and .numa domains are never touched.

Running split-horizon DNS (public names → LAN IPs, plex.direct, DNSBL zones)? Stripped queries show up tagged in the dashboard query log with a one-click allow; the allowlist persists across restarts. Also available via REST: GET/PUT /rebind, POST /rebind/allowlist. (#279, #287, #293, #295, #296)

🚫 Manual blocklist from the dashboard

Block any domain (and its subdomains) with one click from the query log — no config edit, no restart, survives restarts. Unblock the same way, or via POST/DELETE /blocking/blocklist. Closes #257. (#294)

Also notable

.numa reverse proxy now enforces allow_from and resolves services to the per-client egress IP (#263, #264)

Windows: static CRT — numa.exe runs without the VC++ Redistributable (#261, closes #236)

Release binary ~42% smaller (fat LTO + strip, single rustls crypto provider) (#269, #270)

Dashboard uptime now matches systemd wall-clock (#283)

All changes

fix(nix): refresh v0.20.0 vendor hash + automate it in release.sh by @razvandimescu in #259

docs(recipes): dnsdist ACL + public-resolver caveat (#243) by @razvandimescu in #260

fix(windows): static CRT so numa.exe runs without VC++ Redistributable (#236) by @razvandimescu in #261

blog: numa as tailnet resolver by @razvandimescu in #262

feat(proxy): resolve .numa services to the per-client egress IP by @razvandimescu in #263

chore: linked blogpost into readme by @razvandimescu in #265

fix(doh): log rejected peer on allow_from denial by @razvandimescu in #267

build: shrink release binary via fat LTO + strip by @razvandimescu in #269

chore(deps): bump rust from 1.95-alpine to 1.96-alpine in the minor-and-patch group by @dependabot[bot] in #271

chore(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #272

chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #273

chore(deps): bump nix-community/cache-nix-action from 6 to 7 by @dependabot[bot] in #274

chore(deps): bump the minor-and-patch group with 10 updates by @dependabot[bot] in #275

chore(deps): bump windows-sys from 0.59.0 to 0.61.2 by @dependabot[bot] in #276

chore(deps): bump quinn-udp from 0.5.14 to 0.6.1 by @dependabot[bot] in #277

build(deps): use ring as the sole rustls crypto provider by @razvandimescu in #270

feat(proxy): enforce allow_from on the .numa proxy listeners by @razvandimescu in #264

build(nix): bump cargoHash for current vendor tree by @razvandimescu in #280

fix(stats): report wall-clock uptime so dashboard matches systemd by @razvandimescu in #283

fix(install): end install on next-steps, suppress CA-tool noise by @razvandimescu in #284

feat(rebind): DNS rebinding protection (static filter, off by default) by @razvandimescu in #279

docs(config): document HaGeZi NSFW blocklist path in example config by @razvandimescu in #290

docs(config): document [[client_policy]] in example numa.toml by @razvandimescu in #291

fix(nix): vendor hash-free via cargoLock.lockFile; sync Cargo.lock by @razvandimescu in #292

refactor(persist): shared JSON helpers + PersistedDomainList store by @razvandimescu in #288

feat(rebind): runtime API, stripped-query visibility, stats counter by @razvandimescu in #287

feat(persist): durable rebind + blocking allowlists by @razvandimescu in #293

feat(rebind): cover CGNAT/Tailscale + NAT64 ranges, scrub all sections by @razvandimescu in #295

feat(blocking): manual blocklist from the dashboard (closes #257) by @razvandimescu in #294

feat(dashboard): surface rebind protection state and stripped queries by @razvandimescu in #296

fix(release): drop obsolete cargoHash refresh by @razvandimescu in #297

Full Changelog: v0.20.0...v0.21.0

What's Changed

• feat(zones): chase CNAMEs in local zone resolution (#237) by @razvandimescu in #241
• fix(acl): canonicalize peer IP for dual-stack allow_from matching by @razvandimescu in #246
• feat(server): per-client domain policy [[client_policy]] by @razvandimescu in #239
• fix(stats): report process memory on Windows (#238) by @razvandimescu in #248
• feat(dashboard): add dark mode support via CSS media queries by @HemahWeb in #233
• feat(dashboard): theme toggle + restore exact light palette by @razvandimescu in #251
• feat(proxy): GET handler for DOH by @F-TD5X in #249
• fix(nix): vendor crates via cargoHash to fix nix-build 403 by @razvandimescu in #252
• refactor(ctx): unify synthesized local answers; clean NODATA for non-address qtypes by @razvandimescu in #247
• Revert "refactor(ctx): unify synthesized local answers; clean NODATA for non-address qtypes" by @razvandimescu in #255
• refactor(ctx): unify synthesized local answers as answer_record (#247) by @razvandimescu in #254
• fix(dnssec): authenticate DS RRsets and root self-signature by @razvandimescu in #250
• fix(dashboard): link services as https:// when BYO cert is configured by @razvandimescu in #245
• fix(install): write annotated numa.toml on install so config is discoverable (#244) by @razvandimescu in #256
• fix(dnssec): pin KSK-2024 trust anchor ahead of 2026-10-11 root rollover by @razvandimescu in #258

New Contributors

• @HemahWeb made their first contribution in #233
• @F-TD5X made their first contribution in #249

Full Changelog: v0.19.0...v0.20.0

What's Changed

• blog: add ODoH anonymous DNS without an account post by @razvandimescu in #209
• Update Arch Linux install instructions by @kpcyrd in #210
• fix: ignore root resolv search domain by @CaseyLabs in #212
• refactor: inline normalize_search_domain helper by @razvandimescu in #213
• ci: match nested markdown in paths-ignore by @razvandimescu in #215
• docs: enable PROXY v2 in dnsdist-front recipe by @razvandimescu in #216
• Add Nix Flake by @bubylou in #217
• chore(nix): source version from Cargo.toml, drop auto-update workflow by @razvandimescu in #218
• fix(dashboard): honor configured proxy TLD in service names by @razvandimescu in #219
• fix(freebsd): unblock cargo build, hint at rc.d setup by @razvandimescu in #220
• ci: cross-build for x86_64-unknown-freebsd on every PR by @razvandimescu in #221
• ci: cache nix store + cancel superseded PR runs by @razvandimescu in #223
• feat(server): accept a list of bind addresses by @razvandimescu in #222

New Contributors

• @kpcyrd made their first contribution in #210
• @bubylou made their first contribution in #217

Full Changelog: v0.17.0...v0.18.0

What's Changed

feat(udp): PROXY protocol v2 inbound on plain DNS-over-UDP listener by @razvandimescu in #165

feat(install): --no-system-dns flag by @razvandimescu in #184

fix(cache): restore question + rd/ra on cache-hit responses (#188) by @razvandimescu in #190

fix(macos): service status uses system-domain target by @razvandimescu in #189

fix(macos): restart via launchctl kickstart, not pkill on current_exe (#194) by @razvandimescu in #195

fix(macos): write /etc/resolver/numa for VPN-resilient .numa resolution by @razvandimescu in #185

fix(windows): split IPv4/IPv6 on uninstall restore (#182) by @razvandimescu in #183

refactor(windows): fold restore apply logic into RestorePlan by @razvandimescu in #196

fix(proxy-tld): NXDOMAIN for unknown names; native v6 for v6-only peers by @razvandimescu in #199

refactor(proxy-tld): fold v4 peer arms into sinkhole_record by @razvandimescu in #201

feat(forward): TCP fallback for UDP-hostile networks by @razvandimescu in #197

feat(windows): NRPT coexistence — stop disabling Dnscache by @razvandimescu in #203

feat: add CLI toggles for blocking and dnssec with unit tests by @Etoile-Bleu in #187

fix(cli): share default config path with the service (#202) by @razvandimescu in #204

New Contributors

@Etoile-Bleu made their first contribution in #187

Full Changelog: v0.15.1...v0.16.0

What's Changed

• feat(tcp): plain DNS-over-TCP listener by @razvandimescu in #161
• feat(proxy): PROXY protocol v2 inbound on DoT, DoH, and plain TCP by @razvandimescu in #156
• refactor: gate cognitive complexity and split 4 hot functions by @razvandimescu in #167
• chore(deps): bump hickory to 0.26.1 (unblocks CI from today's RustSec advisories) by @razvandimescu in #180
• chore(deps): bump the minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #176
• chore(deps): bump windows-service from 0.7.0 to 0.8.0 by @dependabot[bot] in #178
• chore(deps): bump rust from 1.94-alpine to 1.95-alpine in the minor-and-patch group across 1 directory by @dependabot[bot] in #170
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #171
• chore(deps): bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #172
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #175
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #174
• chore(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #173
• fix(windows): preserve manually-configured DNS on uninstall (#160) by @razvandimescu in #166
• fix: --version + banner show full build version (with SHA suffix) by @razvandimescu in #181
• feat(blocklist): support local file:// sources and multi-alias hosts lines by @razvandimescu in #159

Full Changelog: v0.14.3...v0.15.1

What's Changed

• docs(config): fix ODoH relay path in numa.toml example by @razvandimescu in #139
• fix(packet): parse SOA natively to stop malformed replies (#128) by @razvandimescu in #137
• docs: lift user-facing guides to recipes/, drop dangling docs/ refs by @razvandimescu in #145
• fix(api): Cache-Control: no-cache on dashboard HTML by @razvandimescu in #148
• ci(aur): attach to master after clone to avoid detached HEAD by @razvandimescu in #149
• fix: title alignment by @gatozee in #152
• fix(cache): refresh honors forwarding rules (#147) by @razvandimescu in #150
• fix(zones): accept PTR records in [[zones]] config (#154) by @razvandimescu in #155
• fix(windows): use PowerShell for adapter enumeration (locale-invariant) by @razvandimescu in #153

New Contributors

• @gatozee made their first contribution in #152

Full Changelog: v0.14.2...v0.14.3

What's Changed

• fix(bootstrap): route numa HTTPS via IP-literal bootstrap resolver (#122) by @razvandimescu in #126
• refactor(bootstrap): BTreeMap for overrides + simplify review by @razvandimescu in #127
• chore: gitignore .claude/ harness state by @razvandimescu in #129
• chore: bump rustls-webpki to 0.103.13 (RUSTSEC-2026-0104) by @razvandimescu in #133
• chore(site): live-reload dev server by @razvandimescu in #132
• docs(config): ODoH upstream examples with relay_ip/target_ip pinning by @razvandimescu in #130
• feat(packaging): ODoH client Docker deploy recipe by @razvandimescu in #131
• fix(upstream): default hedge_ms=0 to avoid silent 2x upstream query count by @razvandimescu in #135

Full Changelog: v0.14.1...v0.14.2

What's Changed

• feat: distinguish UPSTREAM vs FORWARD in logs and stats by @razvandimescu in #103
• chore(deps): bump rustls-webpki to 0.103.12 by @razvandimescu in #105
• feat(dashboard): version in header, restructure footer by @razvandimescu in #109
• feat: embed git SHA in version string by @razvandimescu in #110
• fix(dashboard): allowlist input erased by polling refresh by @razvandimescu in #111
• feat(windows): run as a real SCM service, not a Run-key autostart by @razvandimescu in #107
• feat: accept array of upstreams in [[forwarding]] by @razvandimescu in #104
• feat(linux): run systemd service as unprivileged numa user by @razvandimescu in #118
• feat(resolver): filter_aaaa for IPv4-only networks by @razvandimescu in #119
• feat(question): name SVCB/LOC/NAPTR record types in logs by @razvandimescu in #120
• feat(odoh): ship ODoH client + self-hosted relay (RFC 9230) by @razvandimescu in #121

Full Changelog: v0.13.1...v0.14.0

What's Changed

• fix: config path advisory ignores XDG file on interactive root (#81) by @razvandimescu in #83
• feat: per-suffix conditional forwarding rules (#82) by @razvandimescu in #84
• feat: DoT (DNS over TLS) client upstream by @razvandimescu in #89
• feat: wire-level forwarding, cache, and request hedging by @razvandimescu in #85
• feat: transport protocol tracking with dashboard visualization by @razvandimescu in #90
• fix: DoH endpoint accepts loopback, TLS cert includes IP SANs by @razvandimescu in #88
• bench: add --vs-adguard comparison mode by @razvandimescu in #92
• docs: update README with v0.13.0 features by @razvandimescu in #91

Full Changelog: v0.12.0...v0.13.0