Install ldns with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• ldns-chaos
• ldns-compare-zones
• ldns-config
• ldns-dane
• ldns-dpa
• ldns-gen-zone
• ldns-key2ds
• ldns-keyfetcher
• ldns-keygen
• ldns-mx
• ldns-notify
• ldns-nsec3-hash
• ldns-read-zone
• ldns-resolver
• ldns-revoke
• ldns-rrsig
• ldns-signzone
• ldns-test-edns
• ldns-testns
• ldns-update
• ldns-verify-zone
• ldns-version
• ldns-walk
• ldns-zcat
• ldns-zsplit
• ldnsd

Project history

The project appeared in 2005 during the period when DNSSEC tooling was maturing. Its changelog records a first usable 0.50 release in May 2005, an online repository in June 2005, and a 1.0.0 release in October 2005 that added drill to ldns, zonefile parsing, an experimental signer, and a BSD license.

ldns evolved into both a library and a toolbox. Drill, originally important enough that documentation says part of ldns was derived from it, became included in ldns releases from version 1.0.0 onward. The examples directory grew into a collection of practical DNSSEC and zone tools, including signers, validators, key helpers, and packet utilities.

Later releases tracked DNS standards work. The changelog records additions such as NSEC3-related utilities, DANE support in 2012, SVCB/HTTPS support in the 1.8 series, and newer resource-record handling in the 1.9 series. NLnet Labs stated that ldns entered maintenance mode in 2020, with ongoing fixes and occasional experimental use rather than broad feature expansion.

Adoption history

ldns gained adoption among DNS implementers, operators, and package maintainers because it offered a C API plus ready-to-run diagnostic tools. Distribution packaging reflects that split: some systems package the tools as ldnsutils or drill while others package the library and tools together.

The project also became a bridge between DNS research and production packaging. NLnet Labs explicitly notes use for proof-of-concept work around Internet Drafts, while the maintained command-line tools made it useful for operators who needed DNSSEC-aware zone inspection, signing, verification, and query tracing.

How it is used

Developers use the library through ldns structures such as resource records, packets, zones, and resolvers. Command-line users most often encounter drill as a dig-like DNS inspection tool and the ldns-* utilities for DNSSEC key, zone, signing, walking, comparison, and verification workflows.

The documentation stresses OpenSSL-backed cryptographic features, optional builds without OpenSSL, IPv4/IPv6 support, TSIG, DNSSEC signing and verification, manual pages, and API documentation.

Why package nerds care

ldns matters to package nerds because it is a compact DNSSEC lab in package form: a C library, a resolver/query tool, many small executables, optional crypto features, Python bindings, and a long changelog tied to RFC and draft support. It is also a good example of an upstream declaring a maintenance-mode successor path while keeping old Unix packages useful.

NLnet Labs names the Rust domain library as the natural successor to the ldns library, dnst as drop-in replacements for common example utilities, and dnsi as a reimagined DNS inspection tool. That makes ldns a legacy-but-alive package with clear lineage into newer NLnet Labs DNS tooling.

Timeline

• May 2005: First usable ldns 0.50 release with basic DNS and DNSSEC validation.
• 13 Jun 2005: 0.65 records the repository as online and adds documentation.
• 18 Oct 2005: 1.0.0 adds drill to ldns, zonefile parsing, an experimental signer, and BSD licensing.
• 7 Jul 2006: 1.1.0 adds tutorials, documentation, examples, and drill improvements.
• 28 Nov 2007: 1.2.2 adds ldns-compare-zones and DNSSEC utility fixes.
• 23 Oct 2012: 1.6.14 adds DANE support, including the ldns-dane example tool.
• 2020: NLnet Labs places ldns in maintenance mode.
• 26 Nov 2021: 1.8.0 adds ZONEMD support and SVCB/HTTPS draft support.
• 4 Dec 2025: 1.9.0 records compact denial of existence support and additional resource-record updates.

Related projects

• Related NLnet Labs projects include Unbound, NSD, the Rust domain library, dnst, and dnsi. Related DNS standards areas include DNSSEC, TSIG, DANE, NSEC3, ZONEMD, and SVCB/HTTPS.

Sources

• https://nlnetlabs.nl/documentation/ldns/
• https://nlnetlabs.nl/projects/ldns/about/
• https://raw.githubusercontent.com/NLnetLabs/ldns/master/Changelog
• https://raw.githubusercontent.com/NLnetLabs/ldns/master/README