Numa Updates & Release Notes

What's Changed

• docs(readme): split the quick start into three paths and list what uninstall leaves by @razvandimescu in #425
• ci(docker): build the image from the release binaries by @razvandimescu in #424
• fix(dnssec): bound signature checks and NSEC3 iterations by @razvandimescu in #426
• fix(dnssec): don't mark a response Secure when an RRset has no signature by @razvandimescu in #427
• fix(dnssec): share one upstream query budget across a validation by @razvandimescu in #428
• fix(recursive): charge the query budget per packet sent by @razvandimescu in #429
• fix(proxy): share the TCP/DoT accept loop with the HTTPS listener by @razvandimescu in #421
• fix(forward): normalize forwarding rule suffixes by @razvandimescu in #431
• fix(forward): share the framed exchange between TCP and DoT upstreams by @razvandimescu in #432
• test(forward): bind the TC-retry UDP and TCP stubs together by @razvandimescu in #433
• fix(doh): leave allow_from to the accept loop by @razvandimescu in #434
• fix(recursive): allow deprecated fetch_update until try_update is widespread by @razvandimescu in #435
• fix(deps): follow odoh-rs 1.0.5 to rand_core 0.10 by @razvandimescu in #437
• chore(deps): bump the minor-and-patch group across 1 directory with 11 updates by @dependabot[bot] in #438
• fix(tls): create the CA key owner-only instead of chmod after write by @razvandimescu in #430
• Add russian translation by @sysop200 in #439
• fix(odoh): escalate the config-fetch backoff instead of a fixed 60 s by @razvandimescu in #440

New Contributors

• @sysop200 made their first contribution in #439

Full Changelog: v0.24.0...v0.24.1

This release fixes DNS resolution on Linux home networks, UDP forwarding to IPv6 upstreams, and a DNS-rebinding hole in the dashboard API. It also adds numa token to help you find your dashboard token.

⚠️ Check before upgrading

Loopback requests now need the token unless Host is local. A page that DNS-rebinds its domain to 127.0.0.1 could previously read the query log and add overrides without a token. The loopback exemption now only applies when Host is localhost, *.localhost, an IP literal or a .numa name. (#420)

What to check: a same-host reverse proxy that passes the original Host through (Caddy and Traefik do by default) now gets a 401. Send the token upstream or rewrite Host to the upstream address. Opening the dashboard as http://<hostname>:5380 also asks for the token now.

🏠 Linux home networks

Search domains from resolv.conf (lan, fritz.box) forward to the system resolver instead of a hardcoded AWS VPC address that returned SERVFAIL everywhere else. Thanks @hb9eue (#414, #415)

Without systemd-resolved (Raspberry Pi OS, minimal Debian), the resolv.conf backup moves to /var/lib/numa so the unprivileged service can read it; existing backups migrate automatically (#418)

🌐 IPv6 upstreams

Plain-UDP IPv6 upstreams never worked, in forward or recursive mode, because the socket was always bound to 0.0.0.0. They do now. (#417)

📦 Smaller responses

Repeated names are now written as compression pointers. The 8-record answer from #404 was 598 bytes against the upstream's 206, so it came back truncated at 512 and UDP-only devices like SmartThings appliances lost connectivity. Thanks @Guara92 (#404, #405)

🔑 numa token

Prints the dashboard token and where it was loaded from. numa install also shows the token path. With Docker: docker exec numa numa token. Thanks @robogeek for the nudge (#408, #412, #416)

🩺 numa service status shows the OS resolver

It now prints the nameserver the OS actually uses, so you can tell if the system is no longer using Numa for DNS. (#406)

Also notable

If the API port is already in use (Technitium defaults to 5380), the dashboard no longer goes down silently: DNS keeps serving and the API retries every 5 s (#411, #423)

The ODoH relay caps target responses while streaming instead of after buffering the whole body (#419)

README: running Numa as primary DNS, network-wide setup recipe, ODoH threat model and service privileges (#401-#403, #409, #410)

All changes

What's Changed

docs: name the auto-mode DoH fallback and document relay logging and limits by @razvandimescu in #401

docs: list per-client rules in the comparison table by @razvandimescu in #402

docs: state the ODoH threat model, service privileges and AI use in the README by @razvandimescu in #403

fix(buffer): write repeated names as compression pointers by @razvandimescu in #405

fix(make): retry the deploy probe instead of one dig after one second by @razvandimescu in #407

feat(status): report whether the OS resolver points at numa by @razvandimescu in #406

docs(readme): add a section on running Numa as primary DNS by @razvandimescu in #410

fix(install): show where the API token lives by @razvandimescu in #408

docs(recipes): add network-wide setup by @razvandimescu in #409

feat(cli): add numa token by @razvandimescu in #412

fix(serve): fail startup when the API port is taken instead of panicking in a task by @razvandimescu in #411

fix(system_dns): forward Linux search domains to the system resolver by @razvandimescu in #415

fix(forward): bind UDP upstream sockets in the upstream's address family by @razvandimescu in #417

fix(system_dns): keep the Linux resolv.conf backup where the daemon can read it by @razvandimescu in #418

fix(relay): enforce target response cap while streaming by @razvandimescu in #419

fix(api): require the token for loopback requests with a foreign Host by @razvandimescu in #420

test(integration): use a blocked-domain fixture the default list still carries by @razvandimescu in #422

fix(serve): keep serving DNS when the API port is taken by @razvandimescu in #423

Full Changelog: v0.23.1...v0.24.0

A patch release with a security fix for forward mode, fewer false DNSSEC failures in strict mode, and a fix for a 0.23.0 regression in recursive mode.

🔒 Security

Forward mode now sends upstreams a random query ID instead of passing the client's through, closing a one-packet cache-poisoning path (#397)

rustls bumped to 0.23.45 for RUSTSEC-2026-0285 (#396)

🧭 Resolution

Recursive mode resolves names like multi.surbl.org again, fixing a 0.23.0 regression where replies naming the root were rejected (#387, reported in #386)

A cached SERVFAIL now lives for seconds instead of min_ttl, so one upstream hiccup no longer blackholes a domain for a minute (#388, #376)

NXDOMAIN takes its TTL from the authority SOA, per RFC 2308 (#389)

🚦 New limit on concurrent lookups

max_concurrent_resolutions (default 512, 0 disables) caps cache misses running at once across UDP, TCP, DoT and DoH. Cached, local and coalesced answers are never counted. Over the cap, UDP is dropped silently and stream transports get SERVFAIL. (#364)

If you run numa for many clients, watch queries.refused and resolutions in /stats after upgrading.

🔏 DNSSEC

Strict mode no longer SERVFAILs zones such as isc.org and .ai: RSA keys under 2048 bits verify, RSASHA512 and ECDSA P-384 are supported, and unsupported algorithms are treated as Insecure (#390, #393)

Denial-of-existence proofs are authenticated (#393)

DS queries go to the parent side of the zone cut, and signed RRsets are ordered by RDATA when rebuilt (#391, #392)

⚙️ Operations

numa exits cleanly on SIGTERM and SIGINT, so docker stop works (#368)

numa lan|block|dnssec on|off edits the config the running daemon loaded, not a numa.toml in the current directory. Thanks @hcars (#371)

ODoH errors now say whether the relay or the target failed, and the target config fetch is bounded by the query budget (#369, #377)

The ODoH relay answers unknown paths and a trailing slash on /relay with a usable response instead of an empty 404 (#369, #365)

Also notable

Chinese README, first contribution from @Lkhsss (#268)

Recipe for local DNS records and split DNS (#370)

Docker image builds again from a tag (#363)

Benchmark tooling fixes and a tag-baseline script (#361, #379)

All changes

What's Changed

fix(bench): unbreak the comparison modes, add tag-baseline tooling by @razvandimescu in #361

fix(docker): copy build.rs into the builder image by @razvandimescu in #363

fix(serve): handle SIGTERM and SIGINT so containers can stop numa by @razvandimescu in #368

docs(recipes): add local DNS records and split DNS recipe by @razvandimescu in #370

Fix Linux path resolution by @hcars in #371

chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #374

chore(deps): bump the minor-and-patch group with 11 updates by @dependabot[bot] in #373

chore(deps): bump rust from 1.97-alpine to 1.98-alpine in the minor-and-patch group by @dependabot[bot] in #372

fix(odoh): bound the target config fetch by the query budget by @razvandimescu in #377

fix(bench): use real key material in dnssec verify benches by @razvandimescu in #379

test(relay): cover a real forward end to end by @razvandimescu in #380

fix(odoh): name the hop that produced a failed ODoH status by @razvandimescu in #369

Adding README in Chinese by @Lkhsss in #268

feat(admission): cap concurrent cache-miss resolutions across transports by @razvandimescu in #364

fix(wire): parse the root name as "." so root UDP replies match their query by @razvandimescu in #387

fix(cache): cap a cached resolution failure at seconds, not min_ttl by @razvandimescu in #388

fix(dnssec): verify RSA keys below 2048 bits, add RSASHA512 and ECDSA P-384 by @razvandimescu in #390

chore(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 by @razvandimescu in #396

fix(forward): send upstream a random TXID, not the client's by @razvandimescu in #397

fix(dnssec): order RRsets by RDATA alone when rebuilding signed data by @razvandimescu in #391

fix(recursive): send DS queries to the parent side of the zone cut by @razvandimescu in #392

fix(dnssec): treat unsupported algorithms as Insecure and authenticate denial proofs by @razvandimescu in #393

fix(cache): take the negative TTL from the authority SOA by @razvandimescu in #389

New Contributors

@hcars made their first contribution in #371

@Lkhsss made their first contribution in #268

Full Changelog: v0.23.0...v0.23.1

Ad blocking was broken for everyone on the default config since 1 August. This release fixes it, and hardens the recursive resolver against cache poisoning.

🛡️ Ad blocking was silently off since 1 August

HaGeZi discontinued the hosts/ and domains/ formats on 2026-08-01. The compiled-in default pointed at one, and downloads never checked HTTP status — so a 145-byte error page parsed to zero domains and logged like a healthy load. (#336)

Default moved to wildcard/pro-onlydomains.txt; non-2xx and non-list bodies now fail loudly (#337)

/blocking/stats reports per-source health, so the dashboard shows which list is down instead of blanking (#339)

Each good list is cached to disk, so a restart during an upstream outage keeps blocking (#338)

If your numa.toml pins a HaGeZi hosts/ or domains/ URL, switch it to wildcard/ — the new default only applies if you never overrode it.

🔒 Recursive resolver hardening (RFC 5452)

Out-of-bailiwick referrals rejected — no more injecting NS, glue or DS for zones you don't own (#354, #355)

Random TXIDs from OsRng + reply validation on receipt, closing DNSpooq (CVE-2020-25684/85/86) and residual Kaminsky/SAD-DNS (#358, #359)

Bogon nameserver addresses refused, so referrals can't aim the resolver at your LAN (#356)

Per-query work budget and NS fan-out cap against NXNS / NRDelegation amplification (#357)

ANY answered with a minimal HINFO, RFC 8482 (#343)

📦 EDNS correctness

Forward mode sends DO=1 upstream, so cached wires keep their RRSIGs (#329)

AD is only set for clients that asked for it (#340, #342)

UDP replies fit the client's advertised payload size, with a TC=1 retry over TCP (#347, #351, #352)

🌍 Dashboard translations

Drop one JSON file into site/locales/ — no Rust, no build step. English is the fallback, so a partial locale never breaks the UI. German and Simplified Chinese ship unreviewed (zh-cn by @maxsusu). More welcome: #266. (#360)

⚙️ numa config path / numa config edit

Print or open the config the running service actually reads. Thanks @Guflly (#346, #350).

Also notable

Centralized CLI colors — first contribution from @w3lld1 (#326)

Fuzzing extended to maximize_payload and the client UDP budget (#353)

Dependency bumps: base64 0.23, Rust 1.97 base image, 13-package minor group (#330–#334)

All changes

What's Changed

fix(cli): centralize terminal colors by @w3lld1 in #326
chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in #334
chore(deps): bump the minor-and-patch group with 13 updates by @dependabot[bot] in #333
chore(deps): bump actions/cache from 4 to 6 by @dependabot[bot] in #332
chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #331
chore(deps): bump rust from 1.96-alpine to 1.97-alpine in the minor-and-patch group by @dependabot[bot] in #330
fix(blocklist): replace dead hagezi default, reject non-2xx by @razvandimescu in #337
fix(dnssec): only send AD to clients that asked for it by @razvandimescu in #340
docs(dnssec): cite the section that carries the AD-on-replies rule by @razvandimescu in #342
feat(blocking): report per-source health instead of dropping failures by @razvandimescu in #339
fix(forward): send DO=1 upstream so cached wires always carry RRSIGs by @razvandimescu in #329
feat(blocking): keep a last-known-good copy of every remote list by @razvandimescu in #338
feat: refuse ANY queries with a minimal HINFO (RFC 8482) by @razvandimescu in #343
fix(blocking): regressions from the #336 hardening by @razvandimescu in #344
refactor(blocking): trim what later PRs made redundant by @razvandimescu in #345
feat(cli): add effective config commands by @Guflly in #346
fix(forward): TC=1 escape hatch and DO-bit walker hardening by @razvandimescu in #347
fix(cli): follow-ups to #346 — sudo in the restart hint, README pointer by @razvandimescu in #350
fix(ctx): truncate UDP replies to the client's advertised payload size by @razvandimescu in #352
fix(forward): harden the TC=1 retry from #347 by @razvandimescu in #351
test(fuzz): cover maximize_payload and the client UDP budget by @razvandimescu in #353
fix(recursive): reject out-of-bailiwick referrals (RFC 5452) by @razvandimescu in #354
fix(recursive): bailiwick-filter glue and DS records by @razvandimescu in #355
fix(recursive): reject bogon nameserver addresses by @razvandimescu in #356
fix(recursive): bound per-resolution query budget + NS fan-out width by @razvandimescu in #357
fix(recursive): randomize TXIDs and validate UDP replies (RFC 5452) by @razvandimescu in #358
fix(forward): validate the question on plain-UDP replies (RFC 5452) by @razvandimescu in #359
feat(dashboard): translatable UI via per-language JSON locales by @razvandimescu in #360

New Contributors

@w3lld1 made their first contribution in #326

@Guflly made their first contribution in #346

Full Changelog: v0.22.0...v0.23.0

Highlights

🔐 Dashboard & API authentication

The dashboard and REST API now require a token for any non-loopback client — HTTP Bearer or Basic (native browser prompt). No config needed: a token is minted on first start, logged once, and persisted with 0600 perms, so no deployment is ever unauthenticated. Set your own via [server] api_token or NUMA_API_TOKEN; /health stays open for probes. The .numa reverse proxy forwards the real client IP, so proxied dashboard access gets the same check. (#315)

Upgrading with a dashboard already exposed beyond localhost? Your next visit will ask for credentials — the token is in the startup log (printed once) and in api_token inside your data directory (e.g. /var/lib/numa/, /usr/local/var/numa/). Use it as the password with any username, or set your own in numa.toml.

🔏 DNSSEC: record types that were never actually verified

With [dnssec] enabled = true, answers for types Numa stores as raw rdata — TXT, HTTPS, SVCB, SRV, NAPTR, LOC — were reported Secure without any signature verification: their rrsets never matched their RRSIGs, so validation silently skipped them. They are now signature-checked like everything else, including RFC 4034 canonical-form downcasing for SRV/NAPTR targets. DNSSEC validation is opt-in, so only [dnssec] users were affected. (#325, closes #324)

🔗 CNAME chase correctness

Multi-link CNAME chains included in a single upstream response are now followed to the end before sub-querying, chased answers no longer duplicate chain links, and the chase terminates cleanly on record types without native parsing. (#323)

Also notable

The wire parser is now continuously fuzzed in CI (4 targets, seed corpus), and the repo gained a SECURITY.md disclosure policy (#319)

Parser hardening: DNSKEY/DS records with rdlength shorter than their fixed fields are rejected (found by the fuzzer, #301); OPT records whose owner name is a compression pointer are recognized (#319)

Per-client filter_aaaa override in [[client_policy]] (#307, closes #286)

Query-log entries carry a monotonic seq, so external scrapers (numa-metrics) can page reliably (#310)

Forward mode re-resolves an undetectable system DNS to DoH on network rescan (#321, closes #169)

Dashboard query log fills its column height (#302); AUR publishes are serialized (#298)

Dependency security bumps: quinn-proto (RUSTSEC-2026-0185), crossbeam-epoch (RUSTSEC-2026-0204)

All changes

fix(ci): serialize AUR publish runs by @razvandimescu in #298

fix(dashboard): query log fills column height instead of leaving a void by @razvandimescu in #302

fix(parser): reject DNSKEY/DS records with rdlength < fixed fields by @razvandimescu in #301

site: publish numa services over tailnet by @razvandimescu in #304

site: forgot image by @razvandimescu in #305

chore: updated readme.md and index.html by @razvandimescu in #306

feat(client_policy): per-client filter_aaaa override (#286) by @razvandimescu in #307

docs: clarify Numa has no separate PROXY protocol port by @razvandimescu in #308

feat(query-log): stamp a monotonic seq on each entry by @razvandimescu in #310

docs(readme): link numa-metrics for durable query history by @razvandimescu in #311

chore(deps): bump reqwest to 0.13, pin ring via rustls-no-provider by @razvandimescu in #312

chore(deps): bump the minor-and-patch group with 7 updates by @dependabot[bot] in #318

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #317

chore(deps): bump alpine from 3.23 to 3.24 in the minor-and-patch group by @dependabot[bot] in #316

Add SECURITY.md and CI fuzzing over the wire parser by @razvandimescu in #319

fix(forward): resolve undetectable system DNS to DoH on rescan (#169) by @razvandimescu in #321

test(integration): reap the resolver on exit, stop set -e hiding fail… by @razvandimescu in #322

feat(api): authenticate the HTTP control plane by @razvandimescu in #315

fix(ctx): stop duplicating CNAME chain links in chased answers by @razvandimescu in #323

fix(dnssec): verify rrsets of types without a DnsRecord variant by @razvandimescu in #325

Full Changelog: v0.21.0...v0.22.0

Highlights

🛡️ DNS rebinding protection (opt-in)

Strips private/special-use addresses from upstream answers so a public domain can't point your browser at your router, NAS, or localhost:

[server]
rebind_protect = true

Covers RFC 1918, loopback, link-local, CGNAT/Tailscale ranges, NAT64 and ULA — including glue records and HTTPS/SVCB address hints. Local zones, overrides and .numa domains are never touched.

Running split-horizon DNS (public names → LAN IPs, plex.direct, DNSBL zones)? Stripped queries show up tagged in the dashboard query log with a one-click allow; the allowlist persists across restarts. Also available via REST: GET/PUT /rebind, POST /rebind/allowlist. (#279, #287, #293, #295, #296)

🚫 Manual blocklist from the dashboard

Block any domain (and its subdomains) with one click from the query log — no config edit, no restart, survives restarts. Unblock the same way, or via POST/DELETE /blocking/blocklist. Closes #257. (#294)

Also notable

.numa reverse proxy now enforces allow_from and resolves services to the per-client egress IP (#263, #264)

Windows: static CRT — numa.exe runs without the VC++ Redistributable (#261, closes #236)

Release binary ~42% smaller (fat LTO + strip, single rustls crypto provider) (#269, #270)

Dashboard uptime now matches systemd wall-clock (#283)

All changes

fix(nix): refresh v0.20.0 vendor hash + automate it in release.sh by @razvandimescu in #259

docs(recipes): dnsdist ACL + public-resolver caveat (#243) by @razvandimescu in #260

fix(windows): static CRT so numa.exe runs without VC++ Redistributable (#236) by @razvandimescu in #261

blog: numa as tailnet resolver by @razvandimescu in #262

feat(proxy): resolve .numa services to the per-client egress IP by @razvandimescu in #263

chore: linked blogpost into readme by @razvandimescu in #265

fix(doh): log rejected peer on allow_from denial by @razvandimescu in #267

build: shrink release binary via fat LTO + strip by @razvandimescu in #269

chore(deps): bump rust from 1.95-alpine to 1.96-alpine in the minor-and-patch group by @dependabot[bot] in #271

chore(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #272

chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #273

chore(deps): bump nix-community/cache-nix-action from 6 to 7 by @dependabot[bot] in #274

chore(deps): bump the minor-and-patch group with 10 updates by @dependabot[bot] in #275

chore(deps): bump windows-sys from 0.59.0 to 0.61.2 by @dependabot[bot] in #276

chore(deps): bump quinn-udp from 0.5.14 to 0.6.1 by @dependabot[bot] in #277

build(deps): use ring as the sole rustls crypto provider by @razvandimescu in #270

feat(proxy): enforce allow_from on the .numa proxy listeners by @razvandimescu in #264

build(nix): bump cargoHash for current vendor tree by @razvandimescu in #280

fix(stats): report wall-clock uptime so dashboard matches systemd by @razvandimescu in #283

fix(install): end install on next-steps, suppress CA-tool noise by @razvandimescu in #284

feat(rebind): DNS rebinding protection (static filter, off by default) by @razvandimescu in #279

docs(config): document HaGeZi NSFW blocklist path in example config by @razvandimescu in #290

docs(config): document [[client_policy]] in example numa.toml by @razvandimescu in #291

fix(nix): vendor hash-free via cargoLock.lockFile; sync Cargo.lock by @razvandimescu in #292

refactor(persist): shared JSON helpers + PersistedDomainList store by @razvandimescu in #288

feat(rebind): runtime API, stripped-query visibility, stats counter by @razvandimescu in #287

feat(persist): durable rebind + blocking allowlists by @razvandimescu in #293

feat(rebind): cover CGNAT/Tailscale + NAT64 ranges, scrub all sections by @razvandimescu in #295

feat(blocking): manual blocklist from the dashboard (closes #257) by @razvandimescu in #294

feat(dashboard): surface rebind protection state and stripped queries by @razvandimescu in #296

fix(release): drop obsolete cargoHash refresh by @razvandimescu in #297

Full Changelog: v0.20.0...v0.21.0

What's Changed

• feat(zones): chase CNAMEs in local zone resolution (#237) by @razvandimescu in #241
• fix(acl): canonicalize peer IP for dual-stack allow_from matching by @razvandimescu in #246
• feat(server): per-client domain policy [[client_policy]] by @razvandimescu in #239
• fix(stats): report process memory on Windows (#238) by @razvandimescu in #248
• feat(dashboard): add dark mode support via CSS media queries by @HemahWeb in #233
• feat(dashboard): theme toggle + restore exact light palette by @razvandimescu in #251
• feat(proxy): GET handler for DOH by @F-TD5X in #249
• fix(nix): vendor crates via cargoHash to fix nix-build 403 by @razvandimescu in #252
• refactor(ctx): unify synthesized local answers; clean NODATA for non-address qtypes by @razvandimescu in #247
• Revert "refactor(ctx): unify synthesized local answers; clean NODATA for non-address qtypes" by @razvandimescu in #255
• refactor(ctx): unify synthesized local answers as answer_record (#247) by @razvandimescu in #254
• fix(dnssec): authenticate DS RRsets and root self-signature by @razvandimescu in #250
• fix(dashboard): link services as https:// when BYO cert is configured by @razvandimescu in #245
• fix(install): write annotated numa.toml on install so config is discoverable (#244) by @razvandimescu in #256
• fix(dnssec): pin KSK-2024 trust anchor ahead of 2026-10-11 root rollover by @razvandimescu in #258

New Contributors

• @HemahWeb made their first contribution in #233
• @F-TD5X made their first contribution in #249

Full Changelog: v0.19.0...v0.20.0

What's Changed

• blog: add ODoH anonymous DNS without an account post by @razvandimescu in #209
• Update Arch Linux install instructions by @kpcyrd in #210
• fix: ignore root resolv search domain by @CaseyLabs in #212
• refactor: inline normalize_search_domain helper by @razvandimescu in #213
• ci: match nested markdown in paths-ignore by @razvandimescu in #215
• docs: enable PROXY v2 in dnsdist-front recipe by @razvandimescu in #216
• Add Nix Flake by @bubylou in #217
• chore(nix): source version from Cargo.toml, drop auto-update workflow by @razvandimescu in #218
• fix(dashboard): honor configured proxy TLD in service names by @razvandimescu in #219
• fix(freebsd): unblock cargo build, hint at rc.d setup by @razvandimescu in #220
• ci: cross-build for x86_64-unknown-freebsd on every PR by @razvandimescu in #221
• ci: cache nix store + cancel superseded PR runs by @razvandimescu in #223
• feat(server): accept a list of bind addresses by @razvandimescu in #222

New Contributors

• @kpcyrd made their first contribution in #210
• @bubylou made their first contribution in #217

Full Changelog: v0.17.0...v0.18.0

What's Changed

feat(udp): PROXY protocol v2 inbound on plain DNS-over-UDP listener by @razvandimescu in #165

feat(install): --no-system-dns flag by @razvandimescu in #184

fix(cache): restore question + rd/ra on cache-hit responses (#188) by @razvandimescu in #190

fix(macos): service status uses system-domain target by @razvandimescu in #189

fix(macos): restart via launchctl kickstart, not pkill on current_exe (#194) by @razvandimescu in #195

fix(macos): write /etc/resolver/numa for VPN-resilient .numa resolution by @razvandimescu in #185

fix(windows): split IPv4/IPv6 on uninstall restore (#182) by @razvandimescu in #183

refactor(windows): fold restore apply logic into RestorePlan by @razvandimescu in #196

fix(proxy-tld): NXDOMAIN for unknown names; native v6 for v6-only peers by @razvandimescu in #199

refactor(proxy-tld): fold v4 peer arms into sinkhole_record by @razvandimescu in #201

feat(forward): TCP fallback for UDP-hostile networks by @razvandimescu in #197

feat(windows): NRPT coexistence — stop disabling Dnscache by @razvandimescu in #203

feat: add CLI toggles for blocking and dnssec with unit tests by @Etoile-Bleu in #187

fix(cli): share default config path with the service (#202) by @razvandimescu in #204

New Contributors

@Etoile-Bleu made their first contribution in #187

Full Changelog: v0.15.1...v0.16.0

What's Changed

• feat(tcp): plain DNS-over-TCP listener by @razvandimescu in #161
• feat(proxy): PROXY protocol v2 inbound on DoT, DoH, and plain TCP by @razvandimescu in #156
• refactor: gate cognitive complexity and split 4 hot functions by @razvandimescu in #167
• chore(deps): bump hickory to 0.26.1 (unblocks CI from today's RustSec advisories) by @razvandimescu in #180
• chore(deps): bump the minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #176
• chore(deps): bump windows-service from 0.7.0 to 0.8.0 by @dependabot[bot] in #178
• chore(deps): bump rust from 1.94-alpine to 1.95-alpine in the minor-and-patch group across 1 directory by @dependabot[bot] in #170
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #171
• chore(deps): bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #172
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #175
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #174
• chore(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #173
• fix(windows): preserve manually-configured DNS on uninstall (#160) by @razvandimescu in #166
• fix: --version + banner show full build version (with SHA suffix) by @razvandimescu in #181
• feat(blocklist): support local file:// sources and multi-alias hosts lines by @razvandimescu in #159

Full Changelog: v0.14.3...v0.15.1

What's Changed

• docs(config): fix ODoH relay path in numa.toml example by @razvandimescu in #139
• fix(packet): parse SOA natively to stop malformed replies (#128) by @razvandimescu in #137
• docs: lift user-facing guides to recipes/, drop dangling docs/ refs by @razvandimescu in #145
• fix(api): Cache-Control: no-cache on dashboard HTML by @razvandimescu in #148
• ci(aur): attach to master after clone to avoid detached HEAD by @razvandimescu in #149
• fix: title alignment by @gatozee in #152
• fix(cache): refresh honors forwarding rules (#147) by @razvandimescu in #150
• fix(zones): accept PTR records in [[zones]] config (#154) by @razvandimescu in #155
• fix(windows): use PowerShell for adapter enumeration (locale-invariant) by @razvandimescu in #153

New Contributors

• @gatozee made their first contribution in #152

Full Changelog: v0.14.2...v0.14.3

What's Changed

• fix(bootstrap): route numa HTTPS via IP-literal bootstrap resolver (#122) by @razvandimescu in #126
• refactor(bootstrap): BTreeMap for overrides + simplify review by @razvandimescu in #127
• chore: gitignore .claude/ harness state by @razvandimescu in #129
• chore: bump rustls-webpki to 0.103.13 (RUSTSEC-2026-0104) by @razvandimescu in #133
• chore(site): live-reload dev server by @razvandimescu in #132
• docs(config): ODoH upstream examples with relay_ip/target_ip pinning by @razvandimescu in #130
• feat(packaging): ODoH client Docker deploy recipe by @razvandimescu in #131
• fix(upstream): default hedge_ms=0 to avoid silent 2x upstream query count by @razvandimescu in #135

Full Changelog: v0.14.1...v0.14.2