Numa

DNS you own. Portable DNS resolver with caching, ad blocking, .numa local domains, and a .

Numa is a DNS resolver packaged as a single portable binary built in Rust, designed to give users local control over name resolution. It addresses the reliance on ISP or cloud resolvers by running entirely on the user's machine, handling caching, ad and tracker blocking, and local service naming without requiring dedicated hardware, cloud accounts, or complex setups like dnsmasq and nginx.

The resolver runs in forward mode by default as a transparent proxy with TTL-aware caching, and offers optional recursive resolution from root nameservers with DNSSEC validation (RSA, ECDSA, Ed25519) and NSEC/NSEC3 denial proofs. It includes ad and tracker blocking via Hagezi Pro, a DNS-over-TLS listener, TCP fallback for hostile networks, and a REST API with a live dashboard. Developer features cover local service proxying with .numa domains, path-based routing, ephemeral DNS overrides with auto-revert, mDNS LAN discovery, and conditional forwarding for Tailscale/VPN split-DNS. It runs on macOS, Linux, and Windows.

Numa is aimed at developers and users who want local control over DNS resolution and local service naming. It is distributed as open source under the MIT License and installed via Homebrew, Cargo, or a shell script; no paid plans, trials, or seat-based editions are indicated.

12 alternatives to Numa

Ranked by how well each tool replaces Numa: shared features, audience, price and popularity.

Quad9
A free public DNS service enhancing your security and privacy.
Covers 0 of 15 key features.
Free plan
63 out of 100 matchFree
Yandex DNS
Make your internet connection fast and secure.
Covers 3 of 15 key features.
Free planDns resolutionDns over httpsDns over tls
59 out of 100 matchFree
DNSPod
Free, fast and stable DNS service
Covers 0 of 15 key features.
Free plan
57 out of 100 match$0.88/mo
Technitium DNS Server
Authoritative/recursive DNS server with ad blocking functionality.
Covers 3 of 15 key features.
Free planOpen sourceAd blockingDns over tlsDns over https
56 out of 100 matchFree
No-IP
Smarter DNS services for reliable domain management.
Covers 0 of 15 key features.
Free plan
56 out of 100 match$2.92/mo
DNS Unlimited
Secondary DNS hosting with unlimited zones and pay-per-query pricing
Covers 0 of 15 key features.
56 out of 100 match$5/mo
NLnet Labs
Open source innovation. Mission critical reliability.
Covers 0 of 15 key features.
Free planOpen source
53 out of 100 matchFree
帝恩思 (51DNS)
DNS comprehensive service provider covering domain resolution, registration, SSL and DNS
Covers 1 of 15 key features.
Free planDns resolution
51 out of 100 match$15/mo
Naminum
A blazingly fast domain-name search engine
Covers 0 of 15 key features.
Free plan
51 out of 100 matchFree
NextDNS
The new firewall for the modern Internet.
Covers 2 of 15 key features.
Free planAd blockingTracker blocking
49 out of 100 match$11/mo
DNSCrypt
Secure Your DNS
Covers 0 of 15 key features.
48 out of 100 match—
PowerDNS
A faster, safer, and more secure internet
Covers 0 of 15 key features.
Open source
47 out of 100 matchContact sales

Key facts

Starts at: Contact sales
Free plan: Yes
Free trial: No
Open source: Yes

What it does

Dns resolution
Caching
Ad blocking
Tracker blocking
Dnssec validation
Recursive resolution
Forward mode
Dns over tls
Dns over https
Oblivious doh
Local service proxy
Path based routing
Ephemeral dns overrides
Mdns lan discovery
Conditional forwarding rest api dns overrides with auto expiry lan service discovery via mdns conditional forwarding plays nice with tailscale vpn split dns rest api script everything automate anything live dashboard with real time stats and controls the vision self sovereign dns pkarr integration dns via mainline dht no registrar needed global numa names self publish dht backed onion bridge human readable names for tor hidden services ed25519 same key binding zero new trust assumptions no blockchain required for core naming architecture resolution pipeline every query walks through the same deterministic pipeline local data takes priority the network is the fallback query overrides numa tld blocklist local zones cache recursive forward doh dnssec validate respond comparison why numa is different comparison of numa with existing dns solutions pi hole nextdns cloudflare adguard home numa recursive resolver no needs unbound cloud only cloud only no root hints full dnssec dnssec validation passthrough cloud only cloud only passthrough full chain of truth ad tracker blocking yes yes limited yes hagezi pro portable travels with laptop no raspberry pi cloud only cloud only no network appliance single binary developer overrides no no no no rest api auto expiry local service proxy no no no no numa domains websocket data stays local yes cloud cloud yes 100 local live dashboard yes yes no yes real time controls dns over https upstream no yes yes no built in http 2 rustls dns over tls listener no cloud only cloud only yes cert required self signed or byo conditional forwarding no no no manual auto detects tailscale vpn zero config needed complex setup yes yes docker setup works out of the box performance measured not claimed benchmarked with dig against public resolvers on the same machine cached queries resolve in under a microsecond dns resolver latency comparison resolver avg p50 p99 numa cached 1ms 1ms 1ms numa cold 9ms 9ms 18ms system resolver 9ms 8ms 44ms quad9 15ms 13ms 43ms cloudflare 19ms 14ms 132ms google 22ms 17ms 37ms numa 1ms system 9ms quad9 15ms cloudflare 19ms google 22ms 689 ns cached round trip parse query cache lookup serialize response 2 0m queries per second single threaded pipeline throughput batched 0 allocations heap allocations in the io path 4kb stack buffers inline serialization 174 ns ecdsa p 256 signature verification dnssec rsa sha 256 10 9s ds digest 257ns 90 ms cold cache dnssec validation only 1 network fetch needed tld chain pre warmed on startup cold queries match system resolver speed the bottleneck is upstream rtt not numa we don t claim to be faster when the network is the limit benchmarks are reproducible cargo bench for micro benchmarks python3 bench dns bench sh for end to end methodology under the hood technical details runtime rust tokio async rt multi thread dns libraries zero wire protocol parsed from scratch resolution modes recursive iterative from root hints cname chasing glue extraction or forward doh plain udp listeners udp 53 tcp 53 plain dns dot 853 rfc 7858 alpn http proxy 80 https proxy 443 dashboard 5380 dnssec chain of truth via ring rsa sha 256 rsa sha 512 ecdsa p 256 ecdsa p 384 ed25519 nsec nsec3 denial proofs edns0 do bit 1232 byte payload dns flag day 2020 dependencies a focused set tokio axum hyper ring dnssec reqwest doh rcgen rustls tokio rustls tls dot socket2 multicast serde no transitive dns library packet format rfc 1035 compliant edns0 opt pseudo record parses a aaaa ns cname mx soa srv https dnskey ds rrsig nsec nsec3 concurrency arc serverctx rwlock for reads mutex for writes never across await install pick one brew install razvandimescu tap numa cargo install numa curl fssl https raw githubusercontent com razvandimescu numa main install sh sh run sudo numa bind 53 80 443 853 5380 dig 127 0 0 1 google com test resolution open http localhost 5380 dashboard curl x post localhost 5380 services d name frontend target port 5173 https frontend numa roadmap where we re going phase 0 dns proxy core zones caching forwarding async tokio runtime phase 1 override layer rest api for programmatic dns control phase 2 ad tracker blocking hagezi pro live dashboard one click allowlist phase 3 system integration auto discovery of os dns routing one command install phase 4 local service proxy numa domains http https reverse proxy auto tls websocket phase 5 dns over https encrypted upstream http 2 connection pooling phase 6 recursive resolution resolve from root nameservers no upstream dependency phase 7 dnssec validation chain of truth nsec nsec3 denial proofs rsa ecdsa ed25519 phase 8 hostile network resilience tcp fallback with udp auto disable when isps block 53 rfc 7816 query minimization phase 9 windows support cross platform install uninstall netsh dns config service integration phase 10 dns over tls listener rfc 7858 alpn enforcement persistent connections self signed or byo cert phase 11 oblivious doh rfc 9230 anonymized client mode public relay numa relay no party sees who asked and what asked phase 12 pkarr integration self sovereign dns via mainline dht no registrar needed phase 13 global numa names self publish dht backed first come first served phase 14 onion bridge human readable tor naming via ed25519 same key binding named after numa pompilius the second king of rome who established the institutions laws and religious practices that outlasted the monarchy itself github blog mit license built from scratch in rust no dependencies on trust

Information is collected from numa.rs and public sources. Spotted something wrong? Tell us