Automic VaultAutomic Vault

brew

Install stubby with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman

DNS privacy enabled stub resolver service based on getdns. Version 0.4.3 via Homebrew; verified from local package data.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install stubby

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install stubby

MacPorts ports tree · net/stubby/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%
sudo apk add stubby

Alpine Linux edge package indexes · stubby · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install stubby

Debian stable package indexes · stubby · source: deb.debian.org

Fedora dnfverified · 92%
sudo dnf install stubby

Fedora Rawhide package metadata · stubby · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#stubby

nixpkgs package indexes · pkgs/by-name/st/stubby/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S stubby

Arch Linux sync databases · stubby · source: geo.mirror.pkgbuild.com

overview

Package summary

DNS privacy enabled stub resolver service based on getdns

Commands and aliases

  • stubby
  • stubby-setdns-macos.sh

history

Project history and usage

Stubby is a local DNS Privacy stub resolver that sends client DNS queries over DNS-over-TLS. In package-manager terms it is the small daemon people install when they want encrypted first-hop DNS without running a full recursive resolver.

Project history

Stubby was developed by the getdns project and documented by the DNS Privacy Project as a daemon for encrypted DNS stub resolution. The official Stubby documentation says that as of August 2017 Stubby moved into its own repository while getdns became the library dependency.

The project grew out of DNS privacy work around DNS-over-TLS, standardized as RFC 7858. NLnet describes Stubby as an open source project intended to put DNS-over-TLS protection on client devices.

Adoption history

The input package facts list Stubby across Homebrew, Debian, Ubuntu, Fedora/DNF, Alpine, Arch, MacPorts, and Nix, which reflects its adoption as a normal operating-system package rather than only a source build.

Its common packaging shape is a daemon plus a YAML configuration file, making it fit the Unix service model used by Linux distributions and Homebrew services.

How it is used

Stubby listens on loopback addresses, accepts local DNS queries, and forwards them to DNS Privacy resolvers over TLS. The official docs describe strict and opportunistic privacy profiles, upstream resolver configuration, EDNS0 padding, and round-robin upstream behavior.

Users typically install it beside system DNS configuration, point local DNS at Stubby, and edit stubby.yml to choose upstream resolvers and privacy mode.

Why package nerds care

Stubby matters to package nerds because it is a compact example of post-Snowden privacy infrastructure becoming a packaged background service. It turns a protocol feature, DNS-over-TLS, into something a user can install, configure, and supervise with the same tools used for other Unix daemons.

It is also useful as a comparison point with Unbound, dnscrypt-proxy, and system resolver integrations: each solves private DNS with a different packaging, service, and configuration tradeoff.

Timeline

  • 2017: Stubby moved to its own GitHub repository while using getdns as a library dependency.
  • 2022: DNS Privacy Project documentation noted the decommissioning of older dnsovertls*.sinodun.com test nameservers.
  • 2026: Input package facts list Stubby in multiple Unix-like package managers, including Homebrew, Debian, Ubuntu, Fedora, Alpine, Arch, MacPorts, and Nix.

Related projects

  • getdns provides the library functionality used by Stubby.
  • Unbound and DNSCrypt are discussed in the Stubby FAQ as related approaches to encrypted or privacy-preserving DNS.

security posture

Risk level: orange

formula declares a Homebrew service.

Risk classifier

orange risk · medium confidence · infrastructure

Why

  • formula declares a Homebrew service

Signals

  • metadata:service

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Formula metadata declares a service or daemon block.
  • Homebrew bottle metadata is available for 12 platform targets.
  • Installs with 5 runtime dependencies.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
/usr/local/etc/stubby/stubby.yml

executables

Installed executables

CommandKindExposureNote
stubbycliglobal executable
stubby-setdns-macos.shcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.4.3
manager updated
local dataok
upstreamcurrent
latest detectedv0.4.3

https://github.com/getdnsapi/stubby

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:stubby
Version0.4.3
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/stubby
Homepagehttps://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby
Repositoryhttps://github.com/getdnsapi/stubby
Upstream docshttps://dnsprivacy.org/dns_privacy_daemon_-_stubby
LicenseBSD-3-Clause
Source archivehttps://github.com/getdnsapi/stubby/archive/refs/tags/v0.4.3.tar.gz
Dependenciesgetdns, libidn2, libyaml, openssl@3, unbound
Build dependenciescmake, libtool
Bottleavailable (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, monterey, sonoma, ventura, x86_64_linux)
Homebrew post-installnot defined
Servicedeclared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namestubby
Version Scheme0
Revision1
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

stubby 1.6.0-3.2

modern asynchronous DNS API (stub resolver)

https://getdnsapi.net/

sudo apt install stubby
  • Section: net
  • Architecture: amd64
  • Source Package: getdns
  • 6 dependencies
  • normalized package name match
  • Matched by: Stubby
Debian stable package indexes · deb.debian.org · Debian stable package indexes: stubby from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

stubby

nix profile install nixpkgs#stubby
  • normalized package name match
  • Matched by: Stubby
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/st/stubby/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

stubby 1.6.0-3.1build3

modern asynchronous DNS API (stub resolver)

https://getdnsapi.net/

sudo apt install stubby
  • Section: universe/net
  • Architecture: amd64
  • Source Package: getdns
  • 5 dependencies
  • normalized package name match
  • Matched by: Stubby
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: stubby from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
apk95%

stubby 0.4.3-r2

DNS Privacy stub resolver

https://dnsprivacy.org/dns_privacy_daemon_-_stubby/

sudo apk add stubby
  • License: BSD-3-Clause
  • Architecture: x86_64
  • Source Package: stubby
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Stubby
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: stubby from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

stubby-doc 0.4.3-r2

DNS Privacy stub resolver (documentation)

https://dnsprivacy.org/dns_privacy_daemon_-_stubby/

sudo apk add stubby-doc
  • License: BSD-3-Clause
  • Architecture: x86_64
  • Source Package: stubby
  • normalized package name match
  • Matched by: Stubby
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: stubby-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

stubby-openrc 0.4.3-r2

DNS Privacy stub resolver (OpenRC init scripts)

https://dnsprivacy.org/dns_privacy_daemon_-_stubby/

sudo apk add stubby-openrc
  • License: BSD-3-Clause
  • Architecture: x86_64
  • Source Package: stubby
  • normalized package name match
  • Matched by: Stubby
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: stubby-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
dnf95%

stubby 0.4.3-8.fc44

Application that act as a local DNS Privacy stub resolver

https://github.com/getdnsapi/stubby

sudo dnf install stubby
  • License: BSD-3-Clause
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: stubby
  • 6 dependencies
  • 3 provides
  • normalized package name match
  • Matched by: Stubby
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: stubby from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
MacPorts95%

stubby

sudo port install stubby
  • normalized package name match
  • Matched by: Stubby
MacPorts ports tree · api.github.com · MacPorts ports tree: net/stubby/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • getdnsRuntime dependency declared by Homebrew.
  • libidn2Runtime dependency declared by Homebrew.
  • openssl@3Runtime dependency declared by Homebrew.
  • unboundRuntime dependency declared by Homebrew.
  • cmakeBuild dependency declared by Homebrew.
  • libtoolBuild dependency declared by Homebrew.

Same workflow

  • dnscrypt-proxyShares av.db curated category or tags: cli, dns, networking, privacy.
  • dnscrypt-wrapperShares av.db curated category or tags: cli, dns, networking, privacy.
  • dogeShares av.db curated category or tags: cli, dns, dns-over-tls, networking.
  • sdnsShares av.db curated category or tags: cli, dns, networking, privacy.
  • technitium-dnsShares av.db curated category or tags: cli, dns, networking, privacy.
  • adnsShares av.db curated category or tags: cli, dns, networking.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment