[


{ "title": "Quick Start", "url": "https://cya.hu/docs/quick-start/", "description": "Get BoronDNS running from a fresh clone or prebuilt binary in minutes.", "category": "docs", "content": "Get BoronDNS running in under 5 minutes using the prebuilt installer, or follow the full build path from source.\nOption A — Installer archive (recommended)\nDownload the static installer archive for your platform from the releases page, then:\ntar -xf borondns-0.2.0-x86_64-unknown-…" }


,{ "title": "Installation", "url": "https://cya.hu/docs/installation/", "description": "Installer archive, Docker image, source build, and systemd service setup.", "category": "docs", "content": "BoronDNS ships as a single statically-linked musl binary for x86_64-linux. No runtime dependencies, no shared libraries. The release archive also includes a Docker image and an installer script.\nSystem requirements\n\nCPU: x86-64 (static musl build)\nOS: Current Linux LTS kernel or …" }


,{ "title": "Configuration", "url": "https://cya.hu/docs/configuration/", "description": "All config.toml options explained with examples.", "category": "docs", "content": "BoronDNS is configured through a single TOML file, typically at /etc/borondns-secondary/config.toml. The path is set with --config at startup (or via BORONDNS_CONFIG environment variable). When both are omitted, the default path is used.\nValidate and inspect\n# Validate config wit…" }


,{ "title": "config.toml Reference", "url": "https://cya.hu/docs/config-reference/", "description": "Exhaustive field-level documentation for every config.toml option.", "category": "docs", "content": "Complete reference for every field in config.toml. All fields are optional unless marked required.\n[server]\nFieldTypeDefaultDescription\nlistenstring\"0.0.0.0:53\"Bind address and port\nworker_threadsintegerCPU countOS threads for the async runtime\nmax_tcp_connectionsinteger1000Maxim…" }


,{ "title": "CLI Reference", "url": "https://cya.hu/docs/cli-reference/", "description": "borondns server flags and check commands.", "category": "docs", "content": "BoronDNS is a single binary. The primary command is serve. Config inspection commands run without binding sockets or starting the server.\nTop-level flags\nborondns [flags] <command>\n\nFlags:\n  --config PATH         Path to the TOML config file.\n                        Default…" }


,{ "title": "TSIG Setup", "url": "https://cya.hu/docs/tsig/", "description": "Configure TSIG keys to authenticate zone transfers.", "category": "docs", "content": "TSIG (Transaction Signature) authenticates DNS messages between your primary nameserver and BoronDNS. Without it, any host that can reach your primary on port 53 can pull your zones.\nHow TSIG works\nBoth sides share a secret key. Each DNS message is HMAC-signed using that key and …" }


,{ "title": "Monitoring", "url": "https://cya.hu/docs/monitoring/", "description": "Health endpoints, Prometheus metrics, and structured logs.", "category": "docs", "content": "BoronDNS exposes health probes and a Prometheus-compatible /metrics endpoint on its management HTTP listener. All endpoints are plain HTTP/1.1, unauthenticated by default, and intended for private management networks or an orchestrator-side proxy.\nManagement HTTP listener\nConfigu…" }


,{ "title": "Security Hardening", "url": "https://cya.hu/docs/security/", "description": "Recommended configuration, OS-level controls, and a hardening checklist.", "category": "docs", "content": "BoronDNS is designed to be secure by default. It is authoritative-only, refuses recursion unconditionally, and is written in safe Rust — unsafe code is forbidden by lint across the core and server crates, and the small amount of unsafe needed for the high-rate packet path is isol…" }


,{ "title": "RFC Compliance", "url": "https://cya.hu/docs/rfcs/", "description": "DNS standards and RFCs implemented in BoronDNS, with honest compliance posture.", "category": "docs", "content": "BoronDNS implements the DNS standards relevant to a secondary-only authoritative nameserver. This page records the compliance posture as of v0.2.0, synchronized with SRS v0.9.1.\nAll items marked Partial reflect the current Engineering MVP posture — implementation is in place and …" }


,{ "title": "BoronGun", "url": "https://cya.hu/docs/borongun/", "description": "DNS load generator — overview, quick start, and shot configuration.", "category": "docs", "content": "BoronGun is a high-rate DNS load generator designed for testing authoritative nameservers under realistic conditions. Use it to validate capacity, measure latency distributions, and verify that BoronDNS (or any authoritative server) holds up before attackers find out.\nOverview\nBo…" }


,{ "title": "Documentation", "url": "https://cya.hu/docs/", "description": "Everything you need to install, configure, and operate BoronDNS in production.", "category": "docs", "content": "" }




,{ "title": "BoronGun 0.9 preview: scriptable attack profiles", "url": "https://cya.hu/news/borongun-preview/", "description": "Custom query mixes, weighted record types, and a Lua-scriptable profile format land in the next BoronGun release.", "category": "news", "content": "BoronGun exists so you find your DNS server's breaking point before an attacker does. 0.9 makes the load profiles themselves a lot more expressive.\nWhat's landing\n\nWeighted query mixes — define what fraction of traffic is A, AAAA, ANY, or garbage qtypes, instead of a flat round-r…" }


,{ "title": "BoronDNS 1.0.0-beta.1 released", "url": "https://cya.hu/news/beta-1/", "description": "First public beta. AXFR, IXFR, XoT, RFC 9018 cookies, and RRL out of the box.", "category": "news", "content": "We're happy to announce the first public beta of BoronDNS.\nWhat's in beta.1\n\nZone transfers — AXFR and IXFR, with incremental diff tracking\nZone Transfer over TLS (XoT, RFC 9103) — encrypted transfers end-to-end\nDNS cookies (RFC 9018) — stateless client verification\nResponse Rate…" }


,{ "title": "Hardening advisory: tighten default RRL thresholds before you expose port 53", "url": "https://cya.hu/news/rrl-hardening-advisory/", "description": "The out-of-the-box Response Rate Limiting defaults are tuned for compatibility, not for hostile networks. Here's what to change before going to production.", "category": "news", "content": "This is a hardening advisory, not a vulnerability disclosure — but it's important enough that we're putting it in the news feed rather than burying it in the docs.\nThe issue\nBoronDNS ships with conservative RRL (Response Rate Limiting) defaults so that legitimate high-volume reso…" }


,{ "title": "Why we built a secondary-only DNS server", "url": "https://cya.hu/news/secondary-only-philosophy/", "description": "Authoritative-only, secondary-only: the design constraint that shaped every line of BoronDNS.", "category": "news", "content": "Most authoritative DNS servers try to do everything: primary and secondary, dynamic updates, DNSSEC signing, sometimes even recursive resolution bolted on as an afterthought. BoronDNS does one thing.\nThe constraint\nBoronDNS only ever serves zones it received via AXFR/IXFR from an…" }


,{ "title": "News", "url": "https://cya.hu/news/", "description": "Releases, security advisories, and updates from the BoronDNS team.", "category": "news", "content": "" }



,{ "title": "Downloads", "url": "https://cya.hu/downloads/", "description": "Release binaries, packages, and source archives for BoronDNS. Signed and checksummed.", "category": "releases", "content": "" }




,{ "title": "BoronDNS 1.0.0-beta.1", "url": "https://cya.hu/downloads/", "description": "Released 2026-06-13 — sha256 a1b2c3d4e5f6…", "category": "releases", "content": "" }





,{ "title": "BoronDNS — Secondary-Only DNS by INTEGRITY Ltd.", "url": "https://cya.hu/", "description": "A memory-safe, secondary-only authoritative DNS server. Purpose-built for the public secondary tier of modern DNS.", "category": "pages", "content": "" }



,{ "title": "BoronDNS", "url": "https://cya.hu/borondns/", "description": "The secondary-only authoritative DNS server. Memory-safe Rust, lock-free reads, hardened against floods, reflection and slowloris by design.", "category": "pages", "content": "" }



,{ "title": "BoronGun", "url": "https://cya.hu/borongun/", "description": "Generate high-rate DNS load against your own infrastructure to verify capacity before attackers do.", "category": "pages", "content": "" }



,{ "title": "Services", "url": "https://cya.hu/services/", "description": "Managed secondary DNS by Integrity Ltd. — geographically separate nameservers for your zones, monitored around the clock.", "category": "pages", "content": "" }



,{ "title": "The Integrity Suite", "url": "https://cya.hu/solutions/", "description": "BoronDNS · BoronGun · Services — three tools, one purpose: reliable secondary DNS.", "category": "pages", "content": "" }



,{ "title": "Support", "url": "https://cya.hu/support/", "description": "Community support via GitHub and IRC. Commercial SLA options available from Integrity Ltd.", "category": "pages", "content": "" }


]