Carrier-grade DNS resolution for ISPs and large enterprises
HyperRecursor
HyperRecursor is a high-performance caching DNS resolver built for subscriber-facing networks: hundreds of thousands of queries per second per node, full DNSSEC validation, encrypted transport, and a policy engine that lets you filter, redirect and log at the resolver instead of bolting on a middlebox.
ISPs, mobile operators, hosting providers and large enterprises running their own subscriber-facing or campus DNS resolution.
- 1M+
- queries per second per cluster
- <1ms
- median cached response
- 100%
- of sessions start with a lookup
DNS is the cheapest thing to get wrong and the most visible.
Every web page, app session and API call starts with a resolution. When the resolver is slow, everything feels slow, and the subscriber blames the broadband. When it is unfiltered, you have no answer for a regulator. When it is opaque, you cannot tell an attack from a busy evening.
The first service every subscriber touches, and the one they notice fastest when it is slow.
What it costs you today
- Resolver latency shows up as "the internet is slow"
- Regulatory blocking bolted on as a middlebox adds a hop and a failure mode
- Open resolvers get conscripted into amplification attacks
- No query visibility means no early warning of malware beaconing
How HyperRecursor works
The decisions that shape the platform, and why they were made that way.
Fast because the cache is designed, not incidental
Two cache layers do different jobs. A packet cache answers identical repeat queries without ever parsing them, and a record cache assembles answers for everything else. On a subscriber network where a small set of domains dominates, most queries never leave the first layer.
Validating, and pragmatic about it
DNSSEC validation is on by default, so a forged answer is rejected rather than served. When a third-party zone is misconfigured — which happens — a negative trust anchor lets you keep resolving that one domain while its owner fixes it, instead of taking support calls for someone else's mistake.
Policy at the resolver, not in a middlebox
Regulatory blocklists, malware feeds and parental controls are applied where the answer is generated. Policy zones update live without a restart, and the scripting hooks let you vary answers by subscriber, prefix or time of day.
Encrypted transport you operate yourself
Offer DNS over TLS and DNS over HTTPS from your own infrastructure. Subscribers get the privacy they would otherwise seek from a public resolver, and you keep the operational visibility and the regulatory position that comes with it.
What you get
- High-throughput multi-threaded resolution with separate packet and record caches
- Full DNSSEC validation with negative-trust anchors for broken zones
- DNS over TLS and DNS over HTTPS for subscriber privacy
- Response Policy Zones for regulatory, security and parental filtering
- Scriptable policy engine for per-subscriber and per-network answers
- EDNS Client Subnet for CDN-accurate answers
- Aggressive negative caching to cut upstream query volume
- Query-rate limiting and amplification-attack mitigation
- Structured query telemetry streaming for analytics and lawful logging
- Anycast-ready deployment with health-checked load distribution
Capabilities in full
Everything the platform does, grouped by the team that uses it.
Resolution and performance
- Multi-threaded resolution scaling with core count
- Separate packet cache and record cache tiers
- Aggressive NSEC and NSEC3 negative caching
- Prefetching of popular records before expiry
- Zone-to-cache preloading for root and hot zones
- Configurable per-thread and per-client concurrency
- IPv4 and IPv6 transport, dual stack throughout
- Graceful degradation under upstream failure
Security
- DNSSEC validation with managed trust anchors
- Negative trust anchors for broken third-party zones
- DNS Cookies to resist off-path spoofing
- Query-rate limiting per client and per prefix
- Amplification and reflection attack mitigation
- DNS over TLS on port 853
- DNS over HTTPS endpoints
- Access control by prefix, VLAN and subscriber class
Policy and filtering
- Response Policy Zones from local or subscribed feeds
- Regulatory blocking with a compliant notice page
- Malware, phishing and botnet C2 feed enforcement
- Opt-in parental filtering per subscriber line
- Scriptable hooks for custom answer logic
- Split-horizon answers for internal namespaces
- NXDOMAIN handling and controlled redirection
- Allow-lists that survive feed updates
Operations and visibility
- Structured query and answer streaming to analytics
- Newly observed domain detection for early threat warning
- Per-zone, per-client and per-response-code metrics
- Prometheus-compatible metrics endpoint
- Live configuration reload without dropping queries
- Anycast deployment with health-based withdrawal
- Cache inspection and targeted cache flushing
- Retention controls aligned to your logging policy
Where it gets deployed
Subscriber resolution
The default resolver handed out by DHCP and PPPoE, sized for peak evening load and instrumented so you see trouble before the call centre does.
Regulatory compliance
Apply mandated blocklists at the resolver with an auditable trail, and serve a clear notice page rather than a timeout.
Security filtering
Turn threat intelligence into a network-wide control that protects every device on the line, including the ones that cannot run an agent.
Enterprise and campus DNS
Split-horizon resolution for internal namespaces, with the same validation, encryption and logging as the carrier deployment.
The rest of the platform
Standards-based management across eight platforms. Useful alone, better together.
JustiFi ACS
Carrier-grade TR-069 and TR-369 device management
ExploreJustiFi Home
Subscriber-side Wi-Fi diagnostics, on the device that has the problem
ExploreHyperNMS
Multi-vendor network monitoring and fault management
ExploreHyperWAN
SD-WAN for always-on connectivity at the edge
ExploreOMNIFI
Cloud-managed Wi-Fi for enterprises and growing businesses
ExploreOMNISPOT
Guest Wi-Fi, captive portal and PM-WANI compliance
ExploreCommon questions
How is this different from just running a public resolver?
A public resolver is somebody else's infrastructure. Running your own keeps resolution inside your network — lower latency, no dependency on a third party during an incident, no subscriber query data leaving your estate, and the ability to apply the filtering your licence requires.
Does DNSSEC validation break sites?
Occasionally a third party misconfigures their own zone and a validating resolver correctly refuses to serve it. Negative trust anchors let you exempt that single domain temporarily so your subscribers are not affected while its owner fixes the problem.
Can subscribers still use encrypted DNS?
Yes, and preferably yours. The platform serves DNS over TLS and DNS over HTTPS from your own infrastructure, so subscribers get encrypted transport without moving their queries to an external provider.
What does it take to deploy at carrier scale?
Typically a small anycast cluster per region behind health-checked load distribution. Nodes are stateless apart from cache, so capacity is added by adding nodes, and a node can be withdrawn from anycast for maintenance without a visible interruption.
Put HyperRecursor in front of your own network
Bring your CPE models, your protocol mix and your integration constraints. A solutions engineer will show you what the platform does with them — no slides.