What is VeraDNS?

VeraDNS is an on-premise, enterprise-grade DNS security platform. Unlike cloud DNS services, it runs entirely on your own infrastructure — giving your organisation complete control over DNS traffic, filtering policy, and audit data, with nothing ever leaving your network.

How it works

When a device on your network sends a DNS request, that request is routed to VeraDNS instead of a public resolver. VeraDNS evaluates it against your blocklists and policies, then either resolves it (returning the IP) or blocks it (returning a non-routable answer). This happens before any connection is established — at sub-millisecond speed.

Data sovereignty by design

VeraDNS runs on any Linux host with Docker. Your DNS queries, configuration and audit logs are never transmitted to external servers. You own your data — guaranteed by architecture, not by policy.

Ready to deploy? Continue to Getting Started

Getting Started

Install VeraDNS, complete the setup wizard, and point your network's DNS at your new resolver — typically live in under 60 minutes.

System requirements

• Linux server (Ubuntu 20.04+, Debian 11+, RHEL 9+, or equivalent)
• Docker Engine 20.10+ and Docker Compose v2
• Minimum: 2 vCPU, 2 GB RAM, 10 GB disk (see sizing guidance)
• A static IP address on your network
• Ports 53 (UDP/TCP), 443 (DoH/console) and 853 (DoT) reachable from your clients

Installation

Install with the bootstrap script:

curl -sSL https://install.veradns.io | bash

Or run it manually with Docker Compose:

docker pull veradns/veradns:latest
docker compose up -d

First start — setup wizard

Open http://<your-server-ip>:3000 in a browser. The wizard guides you through:

Run as a service & update

Enable automatic start on boot, and update in place when a new release ships (your config persists in a named volume):

sudo systemctl enable --now veradns      # start on boot
docker compose pull && docker compose up -d   # update in place

Next: point your devices or router

Deployment Topologies

VeraDNS scales from a single branch resolver to a multi-region, high-availability fleet. Choose the topology that matches your network size, uptime requirements and internal-zone needs.

1. Single resolver

One VeraDNS instance serves all clients on a site. Ideal for small offices and single-location teams. Point clients (or the router/DHCP) at the resolver's IP, and set a public fallback (e.g. 1.1.1.1) as secondary so the network degrades gracefully during maintenance.

2. High-availability pair

Two (or more) VeraDNS nodes share a virtual IP (VIP) via keepalived (VRRP) or an anycast route. Clients target the VIP; if the active node fails, the standby takes over with no client reconfiguration. Configuration is replicated between nodes so policy stays consistent.

vrrp_instance VERA_VIP {
  state MASTER
  interface eth0
  virtual_router_id 53
  priority 200
  virtual_ipaddress { 10.0.0.53/24 }
}

3. Multi-site / distributed

Each location runs a local resolver (or HA pair) for low latency and site survivability, while a central console manages policy and aggregates logs. This mirrors how distributed enterprises run recursive DNS — local resolution, central control. Internal/private zones are handled with conditional forwarding (below).

Conditional forwarding & split-horizon

Forward queries for your internal domains to your authoritative DNS (e.g. Active Directory) while everything else is filtered and resolved upstream. Configure this at Settings → DNS Settings → Conditional forwarding:

• corp.internal → 10.0.0.10 (AD / internal authoritative)
• 10.in-addr.arpa → internal reverse-DNS server
• everything else → filtered, then your chosen upstream

Sizing guidance

Approximate capacity per node. Real throughput depends on cache hit-rate, blocklist size and encryption overhead — size up for headroom.

Configuring Devices

Point your devices or router at VeraDNS as their DNS server. Configuring the router is fastest — it automatically covers every device on the network, including those you can't change manually.

[Resolve]
DNS=<your-veradns-ip>
DNSStubListener=no

sudo systemctl restart systemd-resolved

DNS Filtering

DNS filtering intercepts DNS requests and decides whether to resolve or block them based on your policy. VeraDNS sits as a filtering proxy between your devices and the upstream resolver.

Why filter at the DNS layer?

Every connection — web, app, or background service — begins with a DNS lookup. Filtering at this layer is extremely efficient: VeraDNS can block an entire domain before any packet is sent, regardless of device type, app or protocol. Some threats (such as CNAME-cloaked trackers) can only be stopped at the DNS level.

The decision pipeline

1. Receive the DNS query from a client.
2. Check the domain against active blocklists, user rules and threat intelligence.
3. If blocked → return a non-routable answer (0.0.0.0 / NXDOMAIN). The connection never starts.
4. If allowed → forward to the configured upstream resolver and return the result (cached when possible).

Every decision is recorded in the Query Log with domain, client, status, latency and the matched rule.

Upstream resolvers

Allowed queries are forwarded to your chosen upstream. Configure one or more (for redundancy) at Settings → DNS Settings → Upstream DNS:

• Standard DNS — 8.8.8.8, 1.1.1.1
• DNS-over-HTTPS (DoH) — https://dns.cloudflare.com/dns-query
• DNS-over-TLS (DoT) — tls://1.1.1.1
• DNS-over-QUIC (DoQ) — supported where available

User rule syntax

Beyond managed lists, write your own rules using the widely-adopted adblock-style DNS syntax:

||example.com^             # block example.com and all subdomains
@@||allowed.example.com^   # allowlist exception (overrides blocks)
127.0.0.1 ads.example.com  # rewrite to a specific IP
||track.*^$dnstype=A       # block only A-record lookups

Manage these at Filters → User Rules.

Blocklists

Blocklists are curated sets of rules that tell VeraDNS which domains to block. They're maintained by the community and security researchers, and VeraDNS keeps them updated automatically.

Activating a blocklist

Categories

General

Regional

Security

Custom blocklists

Add any blocklist available as a URL at Filters → Blocklists → Custom → Add custom blocklist — give it a name, the URL, and an optional description.

Threat Protection

Beyond blocklists, VeraDNS applies continuously-updated threat intelligence to stop phishing, malware, command-and-control and data-exfiltration at the resolver — before any connection is made.

Threat categories

Enable categories at Settings → Security. Each maps to live intelligence feeds and heuristic detection:

Newly-registered domain (NRD) filtering

Attackers frequently register a domain hours before launching a campaign. VeraDNS checks the registration/first-seen date of each queried domain and blocks those younger than your configured threshold (default 30 days).

Typosquatting & DGA detection

VeraDNS scores domains for similarity to known brands (e.g. gooogle.com, paypa1.com) and for algorithmically-generated patterns (high-entropy DGA names used by malware). High-confidence matches are blocked at the DNS level. Tune sensitivity at Settings → Security → Heuristics.

DNS encryption

Encrypt DNS between clients and VeraDNS to prevent interception and tampering on the local network:

• DNS-over-HTTPS (DoH) — DNS inside HTTPS on 443. Configure at Settings → Encryption.
• DNS-over-TLS (DoT) — DNS over TLS on 853.
• DNS-over-QUIC (DoQ) — low-latency encrypted transport.
• DNSSEC — validates upstream responses cryptographically to stop spoofing and cache poisoning.

Query Log

A real-time view of every DNS request on your network. Filter, search, block or allow domains directly from the log — without leaving the page.

What each entry shows

• Domain — the queried name
• Client — device name and source IP (with ASN where available)
• Status — ALLOWED, BLOCKED or CACHED
• Record type — A, AAAA, CNAME, MX, HTTPS, etc.
• Latency — round-trip resolution time in milliseconds
• Matched rule — the blocklist or user rule that caused a block

Block or allow inline

Expand any entry and use Block domain / Unblock domain to update your User Rules instantly. Add user rule lets you write a custom rule (e.g. allow a subdomain while blocking the root).

Filtering & retention

Filter by status, record type, client, time window or domain search. Retention depends on your plan:

Role-Based Access Control

Invite team members with scoped permissions. Each member logs in individually — no shared credentials, no shared sessions — and every role is enforced at the API, not just the interface.

Roles

Inviting members

Revoking access

Change a role or remove a member at any time. Revocation invalidates their session immediately — they're logged out on their next request. All changes are written to the Audit Log.

Audit Log

A tamper-evident record of every administrative action — configuration changes, logins, rule edits and authentication events — with full before/after traceability.

What is logged

• Logins, logouts and failed login attempts
• Configuration changes (DNS settings, upstreams, encryption)
• Blocklist add / remove / update
• User-rule add / edit / delete
• Member invitations, role changes, removals
• API key generation and revocation

Entry fields

• Timestamp — exact UTC time
• Actor — the user who performed the action
• Event type — Config, Auth, User or Rule
• Detail — what changed, with before/after values where applicable

Export & compliance

Export as CSV/JSON from Audit Log → Export, or stream to your SIEM via the REST API. The audit log supports ISO 27001, SOC 2 and internal compliance evidence.

API & Integrations

Automate VeraDNS and stream its data into your existing stack. The REST API exposes query logs, audit events, blocklists and rules; Business and Enterprise plans add SIEM streaming, SSO and SCIM.

Authentication

Generate an API key at Settings → API. Pass it as a Bearer token. Keys inherit the role of the member who created them and every call is recorded in the audit log.

curl https://veradns.internal/api/v1/query-log?status=blocked&limit=100 \
  -H "Authorization: Bearer $VERA_API_KEY" \
  -H "Accept: application/json"

Core endpoints

SIEM streaming

Export query and audit data in JSON or CSV, compatible with Splunk, Microsoft Sentinel and Elastic. Enterprise plans support a real-time push stream so events arrive in your SIEM within seconds.

Identity (Enterprise)

• SSO — SAML 2.0 and OIDC for centralised login.
• SCIM 2.0 — automated user provisioning and de-provisioning from your IdP.
• LDAP / Active Directory — directory-based authentication and group mapping.

Frequently Asked Questions

Common questions about deployment, capabilities and configuration.

What does "on-premise DNS proxy" mean for my organisation?

VeraDNS runs entirely within your own infrastructure — on-premise, private cloud or your own VMs. No queries, configuration or audit logs are transmitted to external servers. Data sovereignty is guaranteed by architecture, not policy.

How does VeraDNS differ from a cloud DNS service?

Cloud DNS routes your queries through external servers, creating a third-party dependency and potential visibility into your activity. VeraDNS resolves within your perimeter — you retain full control over blocklists, policy and query data, with no dependency on external availability.

Which DNS protocols are supported?

Standard DNS (port 53), DoH, DoT, DoQ and DNSSEC validation. Encrypted protocols can be enforced for internal clients to prevent query interception.

Can VeraDNS integrate with our SIEM or identity provider?

Yes — see API & Integrations. Business and Enterprise plans export logs to Splunk, Sentinel and Elastic; Enterprise adds SSO (SAML 2.0), OIDC, SCIM and LDAP/AD.

A legitimate domain is being blocked. How do I fix it?

Add an allowlist exception at Filters → User Rules:

@@||yourdomain.com^

You can also unblock directly from the Query Log entry.

Can I run VeraDNS in high availability?

Yes — see Deployment Topologies. Enterprise plans support multi-site and HA with automatic failover via a shared VIP or anycast.

Who do I contact for support?

Email support@veradns.io, or use the Contact Sales form on the main site. Business and Enterprise plans include priority support with guaranteed response times.