Integrity
Limitations
Stated plainly, because a resolver that hides these is worse than one that names them. Nothing below is a bug report — each is a boundary that was chosen, and the reason it was chosen.
- 01
DNSSEC is not implemented
EDNS0 is present and the DO bit is decoded, but nothing is validated. A forged delegation from a compromised parent would not be detected. Half-done validation is worse than none, because a resolver reporting AD on evidence it did not check lies to everything downstream.
- 02
The cache does not survive the process
A restart starts cold.
- 03
A forwarded answer is trusted absolutely
Under --forward there is no delegation path to check, so choosing a forwarder is choosing whom to believe. No health checking either, so a dead first entry costs one timeout per query.
- 04
Adblock $ options are honoured without their conditions
Those blocks are broader than the rule asked for. Element hiding, @@ exceptions and regex rules are skipped and counted.
- 05
Resource limits are global, not per client
One client can occupy all 64 workers or all 256 connections. Rate limiting counts responses sent, not work done.
- 06
0x20 protects the path, not the server at the end of it
A compromised nameserver echoes the nonce correctly, and a short name carries little entropy.
- 07
Blocklists load once, at startup
No reload. Every control socket command reads and none change behaviour, which is what makes an unauthenticated loopback port defensible.
- 08
The dashboard cannot read terminal size
It does not notice a resize. Size comes from COLUMNS and LINES, then flags, then 100x30. No keyboard, because everything else needs raw mode.
- 09
Not authoritative
No zone file serving, no PTR from a local table.