A drop-in Unbound replacement, written in Rust.
Kernel-bypass packet processing for the hot path — zero syscalls per query when the NIC and driver support it, with a clean SKB fallback otherwise.
A homegrown validator and iterative resolver — RSA (8/10), ECDSA (13/14) and Ed25519 (15) supported, SHA-1 rejected fail-closed.
Full CRUD over zones, blocklists, feeds and stats, plus a live Server-Sent Events stream for node status.
An encrypted, HMAC-signed relay keeps slaves in sync, with automatic node registration.
A built-in admin UI for zones, blocklists, feeds, upstreams and logs — no separate install.
DoQ support via quinn, alongside classic UDP/TCP/DoT.
Static binaries for Linux, glibc and musl, x86_64 and aarch64. Every release is checksummed and signed — verify before you run anything in production.
| Platform | Checksum / Signature |
|---|---|
| runbound-x86_64-linux-gnu | binary.minisig |
| runbound-x86_64-linux-musl | binary.minisig |
| runbound-aarch64-linux-gnu | binary.minisig |
| runbound-aarch64-linux-musl | binary.minisig |
| SHA256SUMS | Checksum.minisig |
No binary is published for macOS or Windows. Build from source — see the docs.
Every asset — each binary and SHA256SUMS — carries its own minisign signature. Verify the signature, then the checksum, before you run anything.
curl -LO https://github.com/redlemonbe/Runbound/releases/latest/download/runbound-x86_64-linux-gnu
curl -LO https://github.com/redlemonbe/Runbound/releases/latest/download/runbound-x86_64-linux-gnu.minisig
curl -LO https://github.com/redlemonbe/Runbound/releases/latest/download/SHA256SUMS
curl -LO https://github.com/redlemonbe/Runbound/releases/latest/download/SHA256SUMS.minisig
minisign -Vm SHA256SUMS -P RWSBM9HzDiZpfCD82uTnkeP1Ui30LfWE96C8EtFyI4/WVyLAVxpLzYy/
minisign -Vm runbound-x86_64-linux-gnu -P RWSBM9HzDiZpfCD82uTnkeP1Ui30LfWE96C8EtFyI4/WVyLAVxpLzYy/
sha256sum -c SHA256SUMS --ignore-missingDual-licensed: AGPL-3.0 for self-hosted, open-source and academic use; a commercial license for organizations that need to deploy without AGPL obligations (SaaS, proprietary integrations, OEM).
Runbound has been through internal and adversarial AI-assisted security review, with findings tracked publicly. It has not yet undergone an external human security audit — that is planned before v1.0. Not recommended for production handling sensitive traffic until then.