Dnspb is based on my previous proof of concept program dns-balance. The description is still hosted at my site, read it if you want for an overview of concepts. The improvement points that are listed at the bottom of the dns-balance description have made it into the code base of dnspb.

Balancing
In general, here's what dnspb can do for you. If you have multiple UDP and/or TCP back ends, then you can put dnspb "in front of them" as a proxy/balancer. Clients contact dnspb to resolve names (or to do other DNS-related operations), and dnspb forwards the requests to the next-best back end it knows. This is the DNS server with the least connections at that time. The request is resolved at the true DNS server, upon which dnspb sends this answer to the client who had requested the operation. This is basic balancing: dnspb distributes the traffic over all the back ends that are "behind" it.

Fail-over
When a back end goes down, then dnspb detects this, and takes it out of rotation - i.e., it makes sure that next requests don't get forwarded to that back end. However, dnspb periodically checks "dead" back ends to see whether they've come alive. Once dnspb sees that such a back end has awoken, then it's automatically added to the pool. This is basic fail-over: if you have more DNS servers and one dies, then dnspb makes sure that clients don't suffer from it. (Live checks are on by default, but they can be turned off.)

Transaction ID randomization
Every DNS requests has a transaction ID in it. This is a number that the requesting client defines. Consecutive numbers (1, 2, 3 and so on) make the domain name system susceptible for attacks, as was illustrated by Dan Kaminski (google it if you want to know more, or see http://en.wikipedia.org/wiki/Dan_Kaminsky). Dnspb randomizes these ID's in the traffic to the true DNS servers, and in the case of UDP, randomizes the ports, which is also pretty important. This makes Kaminski-style attacks much more difficult (though the only real solution is to use dnssec).

Support of heterogenous dns
Normally your DNS back ends will be "equal" in the information that they can provide. But in cases where one group of back ends knows about one zone, and another group knows about another zone, dnspb can be put in front of these servers to combine such heterogenous zones, and to make them appear homogenous to clients. Dnspb does this by simply re-querying a next DNS back end upon receipt of a "name error" response. (This behavior can of course be turned on and off.)

Copyright and License

Dnspb is distributed in source form, as-is, licensed under GPLV3. See the file LICENSE in the source archive. This basically means that you're free to take dnspb and use it, you're free to modify it to suit your needs, and you're free to redistribute it, as you see fit - but only as long as you keep the licensing terms intact, and as long as you redistribute dnspb with all sources. If you do modify dnspb, then as a courtesy, I'd appreciate a note from you (if the modification is generic enough, I'd include it in the sources and re-distribute, including your name in the ChangeLog if you want).

Also, dnspb is distributed without explicit or implied warranty or fit of purpose. Use it at your own pleasure and risk.

How to install and start dnspb?

Obtain the source archive dnspb-0.06.tar.gz .
Unpack the archive in a 'sources' directory, e.g. /usr/local/src/. The archive spills its contents into a new subdirectory dnspb-version/.
Change-dir into the new directory dnspb-version/ and type
```
make local
```
If you want to run some tests before installing: run
```
build/dnspb tcp://1.2.3.4 udp://1.2.3.4
```
You will have to do this as root, since dnspb binds to port 53 which is privileged. Here, 1.2.3.4 are the IP addresses of your DNS server. You can specify several TCP back ends and several UDP back ends. Also you can put in a flag -d to see debugging output. Let this run; in an other window, run some lookups, such as
```
host www.google.com localhost
```
To test out TCP, run
```
host -T www.google.com localhost
```
Once you are done testing, just hit ^C in the window that runs dnspb. Alternatively, you can run
```
dig www.google.com @localhost        # UDP test
dig +tcp googleo.com @localhost      # TCP test
```
In order to install into /usr/sbin, run
```
make install
```
If you want to install into an other directory, run
```
BINDIR=/where/ever make install
```
This installs two utilities:
- dnspb, the program itself;
- dnspbctl, a control script.
Next copy etc/dnspb.cfg.sample to /etc/dnspb.cfg by running:
```
cp etc/dnspb.cfg.sample /etc/dnspb.cfg
```
After this edit /etc/dnspb.cfg to suit your needs, the configuration is pretty self-explanatory. Or see below for a description.
Finally fire up dnspb by running:
```
dnspbctl start
```

The worker dnspb

The actual balancer program dnspb can be started without using dnsbpctl, just as httpd can be started without apachectl. The worker supports the following options:

Generic:

--help, -h, -?: Shows usage information.
--version, -v: Shows the version ID and stops.
--log-debug, -d: This causes dnspb to generate verbose (debugging) information. Dnspb sends this information to stdout, which can be redirected to log files, or the system logger etc..
--log-performance, -p: This causes dnspb to generate performance-related information.
--heterogenous-dns, -H: If your DNS back ends represent separate zones, then with this flag, dnspb will continue asking back ends for a resolution when it receives a "name error" answer.

UDP-related:

--idle-udp-timeout SEC, -i SEC: dnspb will wait for an UDP answer from downstream servers for the stated number of seconds, default is 2. When no answer is received within the stated time, then dnspb considers the server to be down.
--udp-port PORT, -u PORT: This defines the UDP port that dnspb listens to. The default is 53. Setting this port to 0 causes dnspb not to start the UDP service.
--udp-port-retries TRIES, -U TRIES: This is the number of (re)tries that dnspb may take to find a local UDP port for the connections with downstream DNS servers. Normally you don't have to change this setting, the default is 40.000.
--udp-recheck-time SEC, -r SEC: When dnspb detects that downstream DNS servers are dead, then it will recheck each SEC seconds to see whether the server(s) have awoken yet. Setting this to 0 instructs dnspb not to check at all. The default is 1 sec.

TCP-related:

--idle-tcp-timeout SEC, -I SEC: dnspb will wait for the given number of seconds before deciding that a TCP back end is dead. The default is 120.
--tcp-port PORT, -t PORT: This defines the TCP listen port. The default is 53. Setting this value to 0 instructs dnspb not to start the TCP service.
--tcp-recheck-time SEC, -R SEC: When dnspb detects that downstream TCP servers are dead, then it will recheck each SEC seconds. Setting this value to 0 inhibits TCP server checks.

Following the flags, you must specify UDP and/or TCP back ends. UDP back ends are required, unless the UDP listen-port is set to 0; TCP back ends are required, unless the TCP listen-port is set to 0. Back ends are always stated as TYPE://IP-ADDRESS, optionally followed by /WEIGHT. The TYPE must be udp or tcp. The IP address is the dotted-decimal address of the DNS servers that dnspb will talk to. The weight is an optional specifier that tells dnspb which back ends are "stronger": the bigger the weight, the more traffic the back end will receive.

Any output of dnspb is prefixed with a timestamp (up to millisecond resolution), a thread ID, a message type, and text. The thread ID is mainly for debugging purposes (to see which thread did what). The message type is something like "debug", "perf" or "info". Warnings are shown with the message type "WARN".

Three important signals that dnspb listens to, are HUP, USR1 and USR2. Signal HUP (1) causes dnspb to show the state of its back ends. Signal USR1 (30) toggles performance logging output. Signal USR2 (31) toggles debugging output.

The control script dnspbctl

Dnspbctl is a fairly simple Perl script that parses a configuration file, prepares a command that fires up dnspb, and execs it. Once dnspbctl starts the worker dnspb, it exits - it doesn't use up any resources. The configuration file that dnspbctl reads is /etc/dnspb.cfg. The syntax of this configuration file is very simple and self-explanatory. For reference an example is shown here.

# ########################################################################
# Configuration for dnspb (/etc/dnspb.cfg)
# Used by dnspbctl to control the main program dnspb.
# Syntax:
#    Configurations are stated as "label = value"
#    Some configurations have a default, some must be stated. See below.
#    Comments are lines where the first character is a #
#    Empty lines are allowed
#    You can split long lines using a \ at the end. The next line may
#        be indented.
# ########################################################################

# ########################################################################
# General section
# ########################################################################

# Should debugging information be generated? Can be toggled later in the
# running server using kill -USR2  or using dnspbctl toggledebug.
# Values may be false or true, default false.
# log-debug = false

# Should performance information be generated? Can be toggled later in
# the running server using kill -USR1  or using dnspbctl toggleperf.
# Default false.
log-performance = true

# Logging output. Use |program to send into a pipe, or >file to rewrite
# files each startup, or >>file to append to a file. There is no default,
# must be specified. A good setting is e.g.: |logger -t dnspb
# To get verbose output on console, do: (a) set above log-debug to true,
# (b) set log-output to |cat
log-output = | /usr/local/bin/loglimit /tmp/dnspb.log 10000 3

# If your DNS servers represent distinct zones, then set the following
# flag to true. Dnspb will then continue to query back ends when it
# receives a "name error" answer. If your back ends provide equivalent
# information, then leave this flag "false", which is the default.
# heterogenous-dns = false

# ########################################################################
# UDP service section
# ########################################################################

# UDP server port (0 to disable the UDP service). Default is 53.
# udp-port = 53

# UDP back ends. Specify as IP:PORT/WEIGHT, e.g. 1.2.3.4:53/1
# The default port is 53, the default weight is 1, you can leave those out
# to write e.g. 1.2.3.4. Bigger weights are bigger servers and get
# proportionally more traffic.
# There is no default, must be specified (unless you suppress the UDP
# service by saying udp-port = 0)
udp-backends = 10.124.237.66 10.51.223.77 \
               8.8.8.8 8.8.4.4

# UDP timeout. When no answer arrives from a back end within the stated
# nr of secs, the back end is marked dead. Use 0 to suppress this state
# checks. Default is 2.
# udp-timeout = 2

# Rechecking of dead back ends. Once due to time outs back ends are
# marked dead, they will be rechecked every X secs to see whether they
# are online yet. Default is 1 sec. Set to 0 to suppress checks.
# udp-recheck-time = 1

# ########################################################################
# TCP service section
# ########################################################################

# TCP server port (0 to disable the TCP service). Default is 53.
# tcp-port = 53

# TCP back ends. Specify as IP:PORT/WEIGHT, e.g. 1.2.3.4:53/1
# The default port is 53, the default weight is 1, you can leave those out
# to write e.g. 1.2.3.4. Bigger weights are bigger servers and get
# proportionally more traffic.
# There is no default, must be specified (unless you suppress the TCP
# service by saying tcp-port = 0)
tcp-backends = 10.124.237.66 10.51.223.77 \
               8.8.8.8 8.8.4.4

# TCP timeout. When no answer arrives from a back end within the stated
# nr of secs, the back end is marked dead. Use 0 to suppress this state
# checks. Default is 2 mins. This is much longer than UDP timeouts to allow
# for complex TCP zone operations etc..
# tcp-timeout = 120

# Rechecking of dead back ends. Once due to time outs back ends are
# marked dead, they will be rechecked every X secs to see whether they
# are online yet. Default is 3 sec. Set to 0 to suppress checks.
# tcp-recheck-time = 3

Dnspbctl supports the following options:

-c CONF: Instructs dnspbctl to read the stated configuration file, instead of /etc/dnspb.cfg.
-v: Turns on script verbosity (for debugging).

Dnspbctl supports the following arguments:

start, stop, restart: These are the typical control scripts actions.
status: Shows whether the DNS proxy/balancer is running, and if yes, at which process ID.
configtest: Verifies whether the configuration /etc/dnspb.cfg is valid.
commandline: Shows how dnspbctl would start dnspb given the configuration.
backends: Causes the underlying dnspb worker to send its back end state to the log.
toggledebug, toggleperf: Sends the signal USR1 or USR2 to dnspb to toggle debugging or performance logging.