$ compendium — one C source, two targets▊

An authoritative DNS server, configured in Dhall

A small, self-contained authoritative DNS server for UDP (RFC 1035). The same C code ships two ways: a single native binary that runs on every major OS, and a WebAssembly build that serves records right here in your browser.

Compiled once for C. Delivered two ways.

// one source · two targets

Your zones are a Dhall program, evaluated at startup by the interpreter core dnsd shares with dhall-c. The same src/*.c build into two artifacts that cover the whole spectrum — from your terminal to a browser tab.

src/*.c  — the server · Dhall config loader · DNS wire codec
├─ src/main.c    → cosmocc    → dnsd.com   one binary, many OSes
└─ src/dnsd-wasm.c → emscripten → dnsd.wasm  zero-install, in your browser

Native binary — dnsd.com

A single self-contained ~1 MB Actually Portable Executable built with cosmocc. The same file runs natively on Linux, macOS, Windows, and the BSDs — no runtime, no VM, no recompile.

In the browser — dnsd.wasm

The same server compiled to a ~125 KB .wasm module. It runs 100% client-side — edit the config and query the real server, no upload.

A server that is deliberately boring

// records · semantics · Dhall config · hardening · one binary

records

Eight record types

A, AAAA, CNAME, TXT, MX, NS, SOA, and CAA (RFC 8659).

semantics

Correct DNS semantics

Authoritative answer / NODATA / NXDOMAIN, ANY, and suffix name-compression.

config

The config is code

Zones are a Dhall program, typechecked and evaluated at startup — a typo is a type error, not a runtime surprise.

hardening

Public-server hardening

Per-source + global rate limits, bounded answers with TC truncation, no recursion, full bounds-checking.

portable

One portable binary

cosmocc → dnsd.com (APE) plus dnsd.com.dbg (ELF).

unprivileged

Least privilege

Runs unprivileged under MemoryDenyWriteExecute + a seccomp allowlist, with exactly one capability.