kresd(8)

💖 NAME 💖

okay so this is kresd(8), and it's the manual page for kresd — the full caching, DNSSEC-enabled Knot Resolver 6.5.0 ✨ bestie, that's the whole name vibe: caching? yes. DNSSEC? yes. iconic? obviously. 💅

🌸 SYNOPSIS 🌸

here's the synopsis, copy-paste energy only:

kresd [-a|--addr addr[@port]] [-t|--tls addr[@port]] [-S|--fd fd]
[-T|--tlsfd fd] [-c|--config config] [-n|--noninteractive] [-q|--quiet]
[-v|--verbose] [-V|--version] [-h|--help] [rundir]

🦋 DESCRIPTION 🦋

bestie, beware: you most likely don't want to use the kresd process directly. Instead, the knot-resolver command will manage the processes for you. okay? okay. 🫶

Knot Resolver is a DNSSEC-enabled full caching resolver. no cap.

Default mode of operation: when it receives a DNS query, it iteratively asks authoritative nameservers starting from the root zone (.) and ending with the nameservers authoritative for the queried name. Automatic DNSSEC means verification of the integrity of authoritative responses by following keys and signatures starting from the root. The root trust anchor is automatically bootstrapped from IANA, or you can provide a file with root trust anchors (same format as Unbound or BIND9 root keys file). the way this walks the chain? obsessed. 🔥

The daemon also caches intermediate answers into cache, which by default uses LMDB memory-mapped database. This has a significant advantage over in-memory caches: the process may be stopped and restarted without loss of cache entries. In a multi-user scenario, a shared cache is a potential privacy/security issue; with kresd, each user can have a resolver cache in their private directory and use it in a similar fashion to a keychain. cute and practical? we love. 💖

To use a locally running kresd for resolving, put

nameserver 127.0.0.1

into resolv.conf(5) and start kresd. periodt.

The daemon may be configured also as a plain forwarder using query policies. This requires using a config file. Please refer to the documentation for configuration file options. It is available at https://www.knot-resolver.cz/documentation/latest/ or in package documentation (available as knot-resolver-doc package in most distributions). go off, docs. 📚

The available CLI options are:

• -a addr[@port], --addr=<addr[@port]> — listen on the given address (and port) pair. If no port is given, 53 is used as the default. This option may be passed multiple times to listen on more addresses. ✨
• -t addr[@port], --tls=<addr[@port]> — listen using TLS on the given address (and port) pair. If no port is given, 853 is used as the default. This option may be passed multiple times to listen on more addresses. 🔐
• -S fd, --fd=<fd> — listen on the given file descriptor(s), passed by supervisor. This option may be passed multiple times to listen on more file descriptors. 🎀
• -T fd, --tlsfd=<fd> — listen using TLS on the given file descriptor(s), passed by supervisor. This option may be passed multiple times to listen on more file descriptors. 🦋
• -c config, --config=<config> — set the config file with settings for kresd to read instead of reading the file at the default location (config). 📝
• -n, --noninteractive — the daemon will refrain from entering into the read-eval-print loop for stdin+stdout. no REPL era. 🙈
• -q, --quiet — the daemon will refrain from printing the command prompt. shhh bestie. 🤫
• -v, --verbose — increase logging to debug level. give me the lore. 🔍
• -h — show short command-line option help. (the synopsis also has --help, iykyk 👑)
• -V — show the version. (and yes, the synopsis has --version too, slay 🌈)

🎀 SEE ALSO 🎀

• https://www.knot-resolver.cz/documentation/latest/ — the docs link, right there in all its glory. 💻

👑 AUTHORS 👑

the kresd developers are mentioned in the AUTHORS file in the distribution. give them their flowers. 💐

---

xoxo, CZ.NIC · Knot Resolver 6.5.0 · 2026-10-01 · kresd(8) 🫶