[GH-ISSUE #1659] using sqlite for primary storage of DNS data? #729

New issue

Open

opened 2026-03-16 00:02:13 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 00:02:13 +03:00

Owner

Originally created by @davepacheco on GitHub (Mar 8, 2022).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1659

I'm looking to use trust-dns to build a pretty basic DNS server that's programmatically configurable (i.e., has a separate HTTP API for configuring the contents of the zone). I want the data to be persistent in sqlite. It's not clear to me whether I can use the built in sqlite storage provider to store all of the zone's information, or if it's only used for dynamic updates, or for journaling when using a file-based backend? If I can use the sqlite provider as the only storage for all of the DNS records, how does one do that? Thanks!

Originally created by @davepacheco on GitHub (Mar 8, 2022). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1659 I'm looking to use trust-dns to build a pretty basic DNS server that's programmatically configurable (i.e., has a separate HTTP API for configuring the contents of the zone). I want the data to be persistent in sqlite. It's not clear to me whether I can use the built in sqlite storage provider to store _all_ of the zone's information, or if it's only used for dynamic updates, or for journaling when using a file-based backend? If I can use the sqlite provider as the only storage for all of the DNS records, how does one do that? Thanks!

kerem added the

question

label

2026-03-16 00:02:13 +03:00

kerem commented

2026-03-16 00:02:24 +03:00

Author

Owner

@bluejekyll commented on GitHub (Mar 10, 2022):

So we have some example configs for this, and basically the trust-dns binary needs this features: sqlite and dnssec-ring.

With that enabled you can follow this example:

github.com/bluejekyll/trust-dns@dc5c414ec0/tests/test-data/named_test_configs/dnssec_with_update.toml (L46)

and you'll need a key for updating the records:

github.com/bluejekyll/trust-dns@dc5c414ec0/tests/test-data/named_test_configs/dnssec_with_update.toml (L61-L66)

This test setup should help in understanding all the moving parts:

github.com/bluejekyll/trust-dns@dc5c414ec0/tests/integration-tests/tests/client_future_tests.rs (L299-L309)

and the client setup:

github.com/bluejekyll/trust-dns@dc5c414ec0/tests/integration-tests/tests/client_future_tests.rs (L325-L328)

Currently sig0 auth is what is best supported. We definitely need better documentation around all of this, one of these days I'll get to that.

@bluejekyll commented on GitHub (Mar 10, 2022): So we have some example configs for this, and basically the `trust-dns` binary needs this features: `sqlite` and `dnssec-ring`. With that enabled you can follow this example: https://github.com/bluejekyll/trust-dns/blob/dc5c414ec0553af8a65441d0c747fb8e9f8e174e/tests/test-data/named_test_configs/dnssec_with_update.toml#L46 and you'll need a key for updating the records: https://github.com/bluejekyll/trust-dns/blob/dc5c414ec0553af8a65441d0c747fb8e9f8e174e/tests/test-data/named_test_configs/dnssec_with_update.toml#L61-L66 This test setup should help in understanding all the moving parts: https://github.com/bluejekyll/trust-dns/blob/dc5c414ec0553af8a65441d0c747fb8e9f8e174e/tests/integration-tests/tests/client_future_tests.rs#L299-L309 and the client setup: https://github.com/bluejekyll/trust-dns/blob/dc5c414ec0553af8a65441d0c747fb8e9f8e174e/tests/integration-tests/tests/client_future_tests.rs#L325-L328 Currently `sig0` auth is what is best supported. We definitely need better documentation around all of this, one of these days I'll get to that.

kerem commented

2026-03-16 00:02:29 +03:00

Author

Owner

@bluejekyll commented on GitHub (Mar 10, 2022):

I reread your question, and realize I didn't answer it properly.

Sqlite is currently only used for a journal in trust-dns. This has some limitations, especially in regards to zone size. What happens is we load all the zone into memory from the journal and serve from there. So for large zones this would be a problem. In general though, the sqlite backend is currently the only supported dynamic update backend, and it only works by the journaling method I described. We can of course create new backends. They are basically Authority implementations, and there is an extensive set of battery tests in the project to verify that the authorities are functioning properly.

@bluejekyll commented on GitHub (Mar 10, 2022): I reread your question, and realize I didn't answer it properly. Sqlite is currently only used for a journal in trust-dns. This has some limitations, especially in regards to zone size. What happens is we load all the zone into memory from the journal and serve from there. So for large zones this would be a problem. In general though, the sqlite backend is currently the only supported dynamic update backend, and it only works by the journaling method I described. We can of course create new backends. They are basically Authority implementations, and there is an extensive set of battery tests in the project to verify that the authorities are functioning properly.