Command

hollow serve

Runs the caching, filtering DNS server on UDP and TCP at once. The default address needs no privileges. Blocklists load once at startup, and the control socket that stats and dash attach to is opt-in: nothing extra binds without --control.

Usage

hollow serve [flags]

Flags

--addr <string>
default "127.0.0.1:15353"
address to listen on, UDP and TCP
--allow <value>
allowlist file in the same formats, overriding every block; repeatable
--block <value>
blocklist file in hosts, domain-per-line or adblock format; repeatable
--block-mode <string>
default "nxdomain"
how a blocked name is answered: nxdomain, null or nodata
--cache-size <int>
default 100000
answers to hold in the cache; 0 disables caching
--control <string>
address for the control socket that hollow stats and hollow dash attach to, for example 127.0.0.1:15354
--dns0x20
default true
randomise the case of each outgoing query name, and refuse a reply that does not echo it
--forward <value>
resolve by asking this server instead of walking from the root; repeatable, tried in order
--hints <string>
root hints in named.root format; default is the compiled-in list
--rrl <int>
default 20
responses per second to one client network before rate limiting starts; 0 disables
--rrl-slip <int>
default 2
answer every Nth rate-limited response truncated instead of dropping it; 0 drops them all
--rrl-trusted <value>
network exempt from rate limiting; repeatable, and replaces the loopback default
--serve-stale <duration>
how long past expiry an answer may still be served when resolution fails; 0 disables
--timeout <duration>
default 5s
deadline for answering one query
--verbose
log every query answered
--workers <int>
default 64
size of the UDP worker pool

Real output

Captured from the binary, verbatim. Timings and addresses are whatever that particular run returned.

hollow serve --addr 127.0.0.1:15399 --control 127.0.0.1:15398 --block hosts.txt

$ hollow serve --addr 127.0.0.1:15399 --control 127.0.0.1:15398 --block hosts.txthollow listening on 127.0.0.1:15399, udp and tcpresolving iteratively from the rootquery names go out with randomised case, and a reply that does not echo it is refusedcache holding 100000 answersblocking 2 names and 1 domains with everything under them, 0 allowed past, answering nxdomainrate limiting responses past 20 a second to one client network, every second one answered truncated so a real client retries over tcp; 127.0.0.0/8, ::1/128 exemptcontrol socket on 127.0.0.1:15398, for hollow stats and hollow dash^Ccache: 0 hits, 1 misses, 0 served stale, 1 entries, 0 evictedqueries: 2 in 4s, 1 blocked, 0 upstream failureslatency: p50 461ms, p99 461mstop names:       1  ads.example.net.       1  example.com.control: 0 clients attached over this runhollow stopped