# Install knot-resolver with Homebrew, apk, apt, dnf, MacPorts, pacman Minimalistic, caching, DNSSEC-validating DNS resolver. Version 6.4.0 via Homebrew; verified 2026-07-04. ## Install ```sh sudo av install brew:knot-resolver ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install knot-resolver ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install knot-resolver ``` Evidence: MacPorts ports tree: net/knot-resolver/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add knot-resolver ``` Evidence: Alpine Linux edge package indexes: knot-resolver from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install knot-resolver ``` Evidence: Debian stable package indexes: knot-resolver from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install knot-resolver ``` Evidence: Fedora Rawhide package metadata: knot-resolver from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - pacman (92%): ```sh sudo pacman -S knot-resolver ``` Evidence: Arch Linux sync databases: knot-resolver from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## Package facts - **Package key:** brew:knot-resolver - **Package manager:** Homebrew - **Package manager page:** - **Version:** 6.4.0 - **Source summary:** Minimalistic, caching, DNSSEC-validating DNS resolver - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** CC0-1.0 AND GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT - **Source archive:** - **Last updated:** 2026-07-04T13:13:40+09:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - knot-resolver (cli) - kres-cache-gc (cli) - kresctl (cli) - kresd (cli) - knot-resolver (alias) - kres-cache-gc (alias) - kresctl (alias) - kresd (alias) ## Dependencies - fstrm - gnutls - knot - libnghttp2 - libuv - libyaml - lmdb - luajit - protobuf-c - python@3.14 ## Build dependencies - meson - ninja - pkgconf ## Uses from macOS - libedit ## Install behavior - Post-install hook: not defined - Service: declared - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 6.4.0 - Package-manager updated: 2026-07-04 - Local data: ok - Upstream repository: https://www.knot-resolver.cz - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Knot Resolver is CZ.NIC's caching, DNSSEC-validating recursive resolver, built as the resolver-side member of the Knot DNS family. Its package-manager identity matters because it is both a server daemon and a scriptable DNS platform: the Homebrew formula installs command-line tools such as kresd, kresctl, and cache maintenance utilities, while Unix packages place it beside other serious recursive resolvers. ### Project history The project reached its first public 1.0.0 release on 2016-05-30. Its early design combined a small C core with Lua/LuaJIT scripting and optional modules, a contrast with larger monolithic resolver codebases. The 1.1.0 release on 2016-08-12 already added features that became important to modern recursive DNS operations, including DNS Cookies, DNS over TLS, Prometheus metrics, query minimisation improvements, and a DNS firewall module. Knot Resolver later split from the older ReadTheDocs-hosted documentation flow into CZ.NIC-controlled GitLab Pages documentation for the 6.x series, while keeping a stable public website and development repository under the CZ.NIC GitLab. The project remained tightly related to Knot DNS but serves the opposite side of DNS: recursive/caching resolution rather than authoritative zone service. ### Adoption history CZ.NIC presents Knot Resolver as scalable from home routers to large resolver farms. The project website records operational adoption beyond CZ.NIC, including CETIN using it in infrastructure since 2017 and Cloudflare describing it as a cornerstone of the 1.1.1.1 public resolver service. Its adoption story is package-nerd relevant because recursive resolver software is often chosen conservatively. A resolver that appears in Homebrew, Debian, Fedora, Arch, Alpine, MacPorts, and Ubuntu packaging occupies a practical testing and operations lane next to Unbound, BIND, PowerDNS Recursor, and systemd-resolved. ### How it is used Users install Knot Resolver to run local, organizational, ISP, or public recursive DNS service with DNSSEC validation and caching. Its module system is central to usage: policy rules, forwarding, DNS-over-TLS, DNS-over-HTTPS, metrics, cache behavior, and filtering can be adjusted without treating the daemon as a black box. The package also exposes companion tools for control and maintenance, so it is not just a background daemon formula. In package sets, that makes it useful to DNS operators who want reproducible installs on laptops, CI images, lab hosts, and production-like Unix systems. ### Why package nerds care Knot Resolver is interesting to package maintainers because it combines a network daemon, a scripting/runtime layer, DNSSEC crypto dependencies, system service integration, and changing configuration formats. Those are the things that expose weak packaging: wrong paths, missing service users, broken Lua module paths, or mismatched library versions show up quickly. It also represents the post-2010 shift in DNS software toward encrypted transports, observability, and programmable policy. For users browsing package indexes, it is the recursive counterpart to Knot DNS and one of the few widely packaged alternatives that is both modern and registry-backed. ### Timeline - 2016-05-30: Knot Resolver 1.0.0 initial release. - 2016-08-12: Knot Resolver 1.1.0 added DNS Cookies, DNS over TLS, Prometheus metrics, and query-minimisation improvements. - 2017: CETIN adoption is described by CZ.NIC's project site as part of its infrastructure history. - 2024-2025: The 5.7.x release series included KeyTrap-related DNSSEC hardening and maintenance updates. - 2026-06-16: CZ.NIC announced Knot Resolver 6.4.0 on the project website. ### Related projects - Knot DNS is the authoritative DNS server in the same CZ.NIC family. Knot Resolver commonly appears in comparisons with Unbound, BIND, PowerDNS Recursor, and systemd-resolved because all can occupy recursive DNS roles, though their architecture and operational tradeoffs differ. ### Sources - - - ## Security Notes formula declares a Homebrew service. - **Geiger risk:** orange / medium - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/knot-resolver/config.yaml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** knot-resolver - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - knot-resolver - 5.7.5-1: normalized package name match | Debian stable package indexes: knot-resolver from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | caching, DNSSEC-validating DNS resolver | https://www.knot-resolver.cz/ - Debian apt - knot-resolver-doc - 5.7.5-1: normalized package name match | Debian stable package indexes: knot-resolver-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Documentation for Knot Resolver | https://www.knot-resolver.cz/ - Debian apt - knot-resolver-module-http - 5.7.5-1: normalized package name match | Debian stable package indexes: knot-resolver-module-http from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | HTTP module for Knot Resolver | https://www.knot-resolver.cz/ - Ubuntu apt - knot-resolver - 5.7.2-1: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-resolver from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | caching, DNSSEC-validating DNS resolver | https://www.knot-resolver.cz/ - Ubuntu apt - knot-resolver-doc - 5.7.2-1: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-resolver-doc from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Documentation for Knot Resolver | https://www.knot-resolver.cz/ - Ubuntu apt - knot-resolver-module-http - 5.7.2-1: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-resolver-module-http from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | HTTP module for Knot Resolver | https://www.knot-resolver.cz/ - apk - knot-resolver - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation | https://www.knot-resolver.cz/ - apk - knot-resolver-dbg - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-dbg from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation (debug symbols) | https://www.knot-resolver.cz/ - apk - knot-resolver-dev - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-dev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation (development files) | https://www.knot-resolver.cz/ - apk - knot-resolver-doc - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation (documentation) | https://www.knot-resolver.cz/ - apk - knot-resolver-libs-static - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-libs-static from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation (static library) | https://www.knot-resolver.cz/ - apk - knot-resolver-mod-dnstap - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-mod-dnstap from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Knot Resolver - dnstap logging | https://www.knot-resolver.cz/ - apk - knot-resolver-mod-http - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-mod-http from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Knot Resolver - HTTP/2 services | https://www.knot-resolver.cz/ - apk - knot-resolver-openrc - 5.7.6-r0: normalized package name match | Alpine Linux edge package indexes: knot-resolver-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Minimalistic caching DNS resolver implementation (OpenRC init scripts) | https://www.knot-resolver.cz/ - dnf - knot-resolver - 5.7.6-3.fc44: normalized package name match | Fedora Rawhide package metadata: knot-resolver from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Caching full DNS Resolver | https://www.knot-resolver.cz/ - dnf - knot-resolver-devel - 5.7.6-3.fc44: normalized package name match | Fedora Rawhide package metadata: knot-resolver-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Development headers for Knot Resolver | https://www.knot-resolver.cz/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [fstrm](https://www.automicvault.com/pkg/brew/fstrm/) - Runtime dependency declared by Homebrew. - [gnutls](https://www.automicvault.com/pkg/brew/gnutls/) - Runtime dependency declared by Homebrew. - [knot](https://www.automicvault.com/pkg/brew/knot/) - Runtime dependency declared by Homebrew. - [lmdb](https://www.automicvault.com/pkg/brew/lmdb/) - Runtime dependency declared by Homebrew. - [luajit](https://www.automicvault.com/pkg/brew/luajit/) - Runtime dependency declared by Homebrew. - [meson](https://www.automicvault.com/pkg/brew/meson/) - Build dependency declared by Homebrew. - [ninja](https://www.automicvault.com/pkg/brew/ninja/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [massdns](https://www.automicvault.com/pkg/brew/massdns/) - Shares av.db curated category or tags: cli, dns, networking, resolver. - [unbound](https://www.automicvault.com/pkg/brew/unbound/) - Shares av.db curated category or tags: cli, dns, dnssec, networking, resolver. - [bind](https://www.automicvault.com/pkg/brew/bind/) - Shares av.db curated category or tags: cli, dns, dnssec, networking. - [c-ares](https://www.automicvault.com/pkg/brew/c-ares/) - Shares av.db curated category or tags: cli, dns, networking, resolver. - [ddclient](https://www.automicvault.com/pkg/brew/ddclient/) - Shares av.db curated category or tags: cli, daemon, dns, networking. - [getdns](https://www.automicvault.com/pkg/brew/getdns/) - Shares av.db curated category or tags: cli, dns, dnssec, networking, resolver. - [ldns](https://www.automicvault.com/pkg/brew/ldns/) - Shares av.db curated category or tags: cli, dns, dnssec, networking. ## Combined YAML source View the package source record on GitHub. [combined/knot-resolver.yml](https://github.com/automic-vault/db/blob/main/combined/knot-resolver.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph