# Install stubby with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman

DNS privacy enabled stub resolver service based on getdns. Version 0.4.3 via Homebrew; verified from local package data.

## Install

```sh
sudo av install brew:stubby
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install stubby
```

  Evidence: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install stubby
```

  Evidence: MacPorts ports tree: net/stubby/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add stubby
```

  Evidence: Alpine Linux edge package indexes: stubby from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install stubby
```

  Evidence: Debian stable package indexes: stubby from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install stubby
```

  Evidence: Fedora Rawhide package metadata: stubby from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#stubby
```

  Evidence: nixpkgs package indexes: pkgs/by-name/st/stubby/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S stubby
```

  Evidence: Arch Linux sync databases: stubby from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

## Package facts

- **Package key:** brew:stubby
- **Package manager:** Homebrew
- **Package manager page:** <https://formulae.brew.sh/formula/stubby>
- **Version:** 0.4.3
- **Source summary:** DNS privacy enabled stub resolver service based on getdns
- **Homepage:** <https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby>
- **Repository:** <https://github.com/getdnsapi/stubby>
- **Upstream docs:** <https://dnsprivacy.org/dns_privacy_daemon_-_stubby>
- **License:** BSD-3-Clause
- **Source archive:** <https://github.com/getdnsapi/stubby/archive/refs/tags/v0.4.3.tar.gz>
- **Generated:** 2026-07-08T07:18:31+00:00

## Executables

- stubby (cli)
- stubby-setdns-macos.sh (cli)
- stubby (alias)
- stubby-setdns-macos.sh (alias)

## Dependencies

- getdns
- libidn2
- libyaml
- openssl@3
- unbound

## Build dependencies

- cmake
- libtool

## Install behavior

- Post-install hook: not defined
- Service: declared
- Bottle: available on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, monterey, sonoma, ventura, x86_64_linux

## Freshness

- Page generated: 2026-07-08
- Package-manager version: 0.4.3
- Local data: ok
- Upstream repository: https://github.com/getdnsapi/stubby
- Upstream latest detected: v0.4.3 (current)
- info: No package-manager update timestamp was available.
## Project history and usage

Stubby is a local DNS Privacy stub resolver that sends client DNS queries over DNS-over-TLS. In package-manager terms it is the small daemon people install when they want encrypted first-hop DNS without running a full recursive resolver.

### Project history

Stubby was developed by the getdns project and documented by the DNS Privacy Project as a daemon for encrypted DNS stub resolution. The official Stubby documentation says that as of August 2017 Stubby moved into its own repository while getdns became the library dependency.

The project grew out of DNS privacy work around DNS-over-TLS, standardized as RFC 7858. NLnet describes Stubby as an open source project intended to put DNS-over-TLS protection on client devices.

### Adoption history

The input package facts list Stubby across Homebrew, Debian, Ubuntu, Fedora/DNF, Alpine, Arch, MacPorts, and Nix, which reflects its adoption as a normal operating-system package rather than only a source build.

Its common packaging shape is a daemon plus a YAML configuration file, making it fit the Unix service model used by Linux distributions and Homebrew services.

### How it is used

Stubby listens on loopback addresses, accepts local DNS queries, and forwards them to DNS Privacy resolvers over TLS. The official docs describe strict and opportunistic privacy profiles, upstream resolver configuration, EDNS0 padding, and round-robin upstream behavior.

Users typically install it beside system DNS configuration, point local DNS at Stubby, and edit stubby.yml to choose upstream resolvers and privacy mode.

### Why package nerds care

Stubby matters to package nerds because it is a compact example of post-Snowden privacy infrastructure becoming a packaged background service. It turns a protocol feature, DNS-over-TLS, into something a user can install, configure, and supervise with the same tools used for other Unix daemons.

It is also useful as a comparison point with Unbound, dnscrypt-proxy, and system resolver integrations: each solves private DNS with a different packaging, service, and configuration tradeoff.

### Timeline

- 2017: Stubby moved to its own GitHub repository while using getdns as a library dependency.
- 2022: DNS Privacy Project documentation noted the decommissioning of older dnsovertls*.sinodun.com test nameservers.
- 2026: Input package facts list Stubby in multiple Unix-like package managers, including Homebrew, Debian, Ubuntu, Fedora, Alpine, Arch, MacPorts, and Nix.

### Related projects

- getdns provides the library functionality used by Stubby.
- Unbound and DNSCrypt are discussed in the Stubby FAQ as related approaches to encrypted or privacy-preserving DNS.

### Sources

- <https://dnsprivacy.org/dns_privacy_daemon_-_stubby/>
- <https://dnsprivacy.org/dns_privacy_daemon_-_stubby/about_stubby/>
- <https://dnsprivacy.org/dns_privacy_daemon_-_stubby/configuring_stubby/>
- <https://nlnet.nl/project/stubby/>
- input.source_facts.package-manager


## Security Notes

formula declares a Homebrew service.

- **Geiger risk:** orange / medium
- formula declares a Homebrew service


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: /usr/local/etc/stubby/stubby.yml
## Source Database Details

- **Source Database:** Homebrew formula API
- **Tap:** homebrew/core
- **Full Name:** stubby
- **Version Scheme:** 0
- **Revision:** 1
- **Head Version:** HEAD
- **Bottle Stable Root URL:** <https://ghcr.io/v2/homebrew/core>
- **Deprecated:** no
- **Disabled:** no
- **Keg Only:** no
- **URL Keys:** head, stable

## Other Package-Manager Records

- Debian apt - stubby - 1.6.0-3.2: normalized package name match | Debian stable package indexes: stubby from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | modern asynchronous DNS API (stub resolver) | https://getdnsapi.net/
- Nix - stubby: normalized package name match | nixpkgs package indexes: pkgs/by-name/st/stubby/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - stubby - 1.6.0-3.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: stubby from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | modern asynchronous DNS API (stub resolver) | https://getdnsapi.net/
- apk - stubby - 0.4.3-r2: normalized package name match | Alpine Linux edge package indexes: stubby from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | DNS Privacy stub resolver | https://dnsprivacy.org/dns_privacy_daemon_-_stubby/
- apk - stubby-doc - 0.4.3-r2: normalized package name match | Alpine Linux edge package indexes: stubby-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | DNS Privacy stub resolver (documentation) | https://dnsprivacy.org/dns_privacy_daemon_-_stubby/
- apk - stubby-openrc - 0.4.3-r2: normalized package name match | Alpine Linux edge package indexes: stubby-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | DNS Privacy stub resolver (OpenRC init scripts) | https://dnsprivacy.org/dns_privacy_daemon_-_stubby/
- dnf - stubby - 0.4.3-8.fc44: normalized package name match | Fedora Rawhide package metadata: stubby from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Application that act as a local DNS Privacy stub resolver | https://github.com/getdnsapi/stubby
- pacman - stubby - 0.4.3-2: normalized package name match | Arch Linux sync databases: stubby from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | DNS Privacy stub resolver | https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby
- MacPorts - stubby: normalized package name match | MacPorts ports tree: net/stubby/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Related links

- [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals.
- [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata.
- [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata.
- [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata.
- [getdns](https://www.automicvault.com/pkg/brew/getdns/) - Runtime dependency declared by Homebrew.
- [libidn2](https://www.automicvault.com/pkg/brew/libidn2/) - Runtime dependency declared by Homebrew.
- [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew.
- [unbound](https://www.automicvault.com/pkg/brew/unbound/) - Runtime dependency declared by Homebrew.
- [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew.
- [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew.
- [dnscrypt-proxy](https://www.automicvault.com/pkg/brew/dnscrypt-proxy/) - Shares av.db curated category or tags: cli, dns, networking, privacy.
- [dnscrypt-wrapper](https://www.automicvault.com/pkg/brew/dnscrypt-wrapper/) - Shares av.db curated category or tags: cli, dns, networking, privacy.
- [doge](https://www.automicvault.com/pkg/brew/doge/) - Shares av.db curated category or tags: cli, dns, dns-over-tls, networking.
- [sdns](https://www.automicvault.com/pkg/brew/sdns/) - Shares av.db curated category or tags: cli, dns, networking, privacy.
- [technitium-dns](https://www.automicvault.com/pkg/brew/technitium-dns/) - Shares av.db curated category or tags: cli, dns, networking, privacy.
- [adns](https://www.automicvault.com/pkg/brew/adns/) - Shares av.db curated category or tags: cli, dns, networking.
- [aliddns](https://www.automicvault.com/pkg/brew/aliddns/) - Shares av.db curated category or tags: cli, dns, networking.
- [bind](https://www.automicvault.com/pkg/brew/bind/) - Shares av.db curated category or tags: cli, dns, networking.

## Combined YAML source

View the package source record on GitHub. [combined/stubby.yml](https://github.com/automic-vault/db/blob/main/combined/stubby.yml)


## Sources

- Nucleus package database
- Geiger risk classifier
- package-page enrichment
- curated configuration and credential file locations
- curated package history
- package version freshness
- av.db category and tag curation
- package relationship graph
- external package-manager database matches
- cross-ecosystem install command graph