# Install knot with Homebrew, apk, apt, dnf, MacPorts, pacman, zypper High-performance authoritative-only DNS server. Version 3.5.5 via Homebrew; verified 2026-06-12. ## Install ```sh sudo av install brew:knot ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install knot ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install knot ``` Evidence: MacPorts ports tree: net/knot/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add knot ``` Evidence: Alpine Linux edge package indexes: knot from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install knot ``` Evidence: Debian stable package indexes: knot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install knot ``` Evidence: Fedora Rawhide package metadata: knot from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - pacman (92%): ```sh sudo pacman -S knot ``` Evidence: Arch Linux sync databases: knot from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install knot ``` Evidence: openSUSE Tumbleweed package metadata: knot from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:knot - **Package manager:** Homebrew - **Package manager page:** - **Version:** 3.5.5 - **Source summary:** High-performance authoritative-only DNS server - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-or-later AND 0BSD AND BSD-3-Clause AND LGPL-2.0-or-later AND MIT - **Source archive:** - **Last updated:** 2026-06-12T13:17:18Z - **Generated:** 2026-07-09T07:20:21+00:00 ## Executables - kcatalogprint (cli) - kdig (cli) - keymgr (cli) - khost (cli) - kjournalprint (cli) - knotc (cli) - knotd (cli) - knsec3hash (cli) - knsupdate (cli) - kzonecheck (cli) - kzonesign (cli) - kcatalogprint (alias) - kdig (alias) - keymgr (alias) - khost (alias) - kjournalprint (alias) - knotc (alias) - knotd (alias) - knsec3hash (alias) - knsupdate (alias) - kzonecheck (alias) - kzonesign (alias) ## Dependencies - fstrm - gnutls - libidn2 - libnghttp2 - lmdb - protobuf-c - userspace-rcu ## Build dependencies - pkgconf - sphinx-doc ## Uses from macOS - libedit ## Install behavior - Post-install hook: not defined - Service: declared - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-09 - Package-manager version: 3.5.5 - Package-manager updated: 2026-06-12 - Local data: ok - Upstream repository: https://www.knot-dns.cz/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Knot DNS is CZ.NIC's high-performance authoritative-only DNS server. In package-manager culture it is the serious authoritative sibling to recursive resolver packages: installing `knot` brings the daemon, control tool, zone utilities, DNSSEC key tooling, and DNS query tools used by operators. ### Project history CZ.NIC developed Knot DNS for authoritative DNS service, especially the demanding needs of registry and large-zone operators. The project site describes it as open source, GPL 3+ licensed, and targeted at Linux, BSD, macOS, and other POSIX systems. The 2.0.0 release on 2015-06-26 marked a major packaging and operations milestone: DNSSEC was split into a separate library, basic KASP support was introduced, configuration moved to a new YAML text format backed by LMDB storage, and documentation included HTML and PDF manual pages. The 3.0.0 release on 2020-09-09 added XDP-based high-performance networking, catalog zones, a kzonesign utility, DoH support in kdig, and other DNSSEC and operations improvements. ### Adoption history Knot DNS is associated with CZ.NIC, the .CZ registry, and was promoted early as a high-performance authoritative DNS server for TLD and DNS-hosting scenarios. Internet Society deployment material from 2013 described it as used by CZ.NIC for the .CZ TLD and aimed at network and DNS operators. Its spread through Homebrew, Debian, Fedora, Arch, Alpine, MacPorts, Ubuntu, and openSUSE matters because authoritative DNS operators often need the same tooling on workstations and servers. Package availability lowers the friction for testing zone signing, transfers, dynamic updates, and `kdig` diagnostics outside production. ### How it is used Knot DNS is used to serve authoritative zones, including DNSSEC-signed zones, with zone transfers, dynamic updates, response rate limiting, automatic signing, and rapid reconfiguration. The Homebrew package exposes both server components such as knotd and operational utilities such as knotc, keymgr, kzonecheck, kzonesign, kdig, khost, and knsupdate. A common package-level pattern is using Knot DNS tools even when the daemon is not the only DNS server in an environment. Utilities such as kdig and keymgr make the formula useful to DNS practitioners who need modern protocol testing or DNSSEC maintenance commands on macOS and Unix workstations. ### Why package nerds care Knot DNS is packaging-heavy software in the good sense: it has a daemon, config files, zone storage, LMDB-backed state, DNSSEC key material, optional modules, and command-line tooling. Correct packages have to get paths, service integration, crypto libraries, and permissions right. For package nerds, it is also one of the names that marks the DNS ecosystem beyond BIND. Seeing Knot DNS in a package index signals that a repository can support production-grade authoritative DNS alternatives, not only client lookup utilities. ### Timeline - 2013: Internet Society deployment material described Knot DNS as used by CZ.NIC for the .CZ TLD. - 2015-06-26: Knot DNS 2.0.0 introduced YAML configuration, LMDB-backed configuration storage, and basic KASP support. - 2017-06-05: Knot DNS 2.5.0 moved KASP data from JSON files to LMDB and expanded dynamic module support. - 2020-09-09: Knot DNS 3.0.0 added XDP networking, catalog zones, kzonesign, and DoH support in kdig. - 2026-06-12: CZ.NIC announced Knot DNS 3.5.5 on the project website. ### Related projects - Knot Resolver is the recursive/caching project in the Knot family. Operationally related alternatives include BIND, NSD, PowerDNS Authoritative Server, YADIFA, and DNS utility packages that provide dig-like clients. ### Sources - - - - - ## Security Notes broad file, network, media, or database tool signal. formula declares a Homebrew service. - **Geiger risk:** orange / medium - broad file, network, media, or database tool signal - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: @config_dir@/knot.conf ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** knot - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - knot - 3.4.6-2: normalized package name match | Debian stable package indexes: knot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Authoritative domain name server | https://www.knot-dns.cz/ - Debian apt - knot-dnssecutils - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-dnssecutils from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNSSEC tools provided with Knot DNS (kzonecheck, kzonesign, knsec3hash) | https://www.knot-dns.cz/ - Debian apt - knot-dnsutils - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-dnsutils from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Clients provided with Knot DNS (kdig, knsupdate, kxdpgun) | https://www.knot-dns.cz/ - Debian apt - knot-doc - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Documentation for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-exporter - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-exporter from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Prometheus exporter for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-host - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-host from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Version of 'host' bundled with Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-module-dnstap - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-module-dnstap from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dnstap module for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-module-geoip - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-module-geoip from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | geoip module for Knot DNS | https://www.knot-dns.cz/ - Debian apt - libdnssec9t64 - 3.4.6-2: normalized package name match | Debian stable package indexes: libdnssec9t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNSSEC shared library from Knot DNS | https://www.knot-dns.cz/ - Debian apt - libknot-dev - 3.4.6-2: normalized package name match | Debian stable package indexes: libknot-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Knot DNS shared library development files | https://www.knot-dns.cz/ - Debian apt - libknot15 - 3.4.6-2: normalized package name match | Debian stable package indexes: libknot15 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Authoritative domain name server (shared library) | https://www.knot-dns.cz/ - Debian apt - libzscanner4t64 - 3.4.6-2: normalized package name match | Debian stable package indexes: libzscanner4t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNS zone-parsing shared library from Knot DNS | https://www.knot-dns.cz/ - Debian apt - python3-libknot - 3.4.6-2: normalized package name match | Debian stable package indexes: python3-libknot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Python bindings for libknot | https://www.knot-dns.cz/ - Ubuntu apt - knot - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Authoritative domain name server | https://www.knot-dns.cz/ - Ubuntu apt - knot-dnssecutils - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-dnssecutils from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | DNSSEC tools provided with Knot DNS (kzonecheck, kzonesign, knsec3hash) | https://www.knot-dns.cz/ - Ubuntu apt - knot-dnsutils - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-dnsutils from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Clients provided with Knot DNS (kdig, knsupdate, kxdpgun) | https://www.knot-dns.cz/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [fstrm](https://www.automicvault.com/pkg/brew/fstrm/) - Runtime dependency declared by Homebrew. - [gnutls](https://www.automicvault.com/pkg/brew/gnutls/) - Runtime dependency declared by Homebrew. - [libidn2](https://www.automicvault.com/pkg/brew/libidn2/) - Runtime dependency declared by Homebrew. - [lmdb](https://www.automicvault.com/pkg/brew/lmdb/) - Runtime dependency declared by Homebrew. - [protobuf-c](https://www.automicvault.com/pkg/brew/protobuf-c/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [sphinx-doc](https://www.automicvault.com/pkg/brew/sphinx-doc/) - Build dependency declared by Homebrew. - [knot-resolver](https://www.automicvault.com/pkg/brew/knot-resolver/) - Popular package that depends on this formula. - [nsd](https://www.automicvault.com/pkg/brew/nsd/) - Shares av.db curated category or tags: authoritative-dns, authoritative-server, cli, daemon, dns. - [bind](https://www.automicvault.com/pkg/brew/bind/) - Shares av.db curated category or tags: cli, dns, dnssec, networking. - [ddclient](https://www.automicvault.com/pkg/brew/ddclient/) - Shares av.db curated category or tags: cli, daemon, dns, networking. - [ldns](https://www.automicvault.com/pkg/brew/ldns/) - Shares av.db curated category or tags: cli, dns, dnssec, networking. - [unbound](https://www.automicvault.com/pkg/brew/unbound/) - Shares av.db curated category or tags: cli, dns, dnssec, networking. - [c-ares](https://www.automicvault.com/pkg/brew/c-ares/) - Shares av.db curated category or tags: cli, dns, networking. - [chinadns-c](https://www.automicvault.com/pkg/brew/chinadns-c/) - Shares av.db curated category or tags: cli, dns, networking. ## Combined YAML source View the package source record on GitHub. [combined/knot.yml](https://github.com/automic-vault/db/blob/main/combined/knot.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph