I wrote a DNS firewall in Rust that detects malware domains using Shannon entropy.

I wanted to build a DNS server that catches threats it's never seen before, using math instead of blocklists. Here's what the interesting bits look like.

Shannon entropy for DGA detection

Every query gets scored before resolution. Normal domains (google.com) score ~3.0 bits. Machine-generated malware domains (xk7m2qzp9a.xyz) score above 4.2. Domains that cross the threshold in high-risk TLDs get blocked inline, before Unbound ever sees them.

Levenshtein for typosquatting

Phishing suffixes (-secure, -login, -verify) are stripped first. Then a full DP Levenshtein matrix runs against 50+ brand domains. String lengths are small enough this adds negligible latency per query.

Fast-flux detection with BTreeSet LRU

Botnets rotate IPs constantly. I track IP history per domain in a 10-minute sliding window using BTreeSet<(Instant, IpAddr)>. Eviction is O(log n) — oldest entries are always at the front. A HashSet of CDN prefixes prevents Cloudflare from triggering it.

Async analytics that never block DNS

Queries go through a Tokio mpsc channel (10k buffer). A background worker batches them and writes to SQLite with WAL mode every 100-500ms. The hot path never touches the database.

Other stuff:

• Supervised Unbound process for DNSSEC and QNAME minimisation
• DHCP server on a separate OS thread (not Tokio) that registers hostnames into the device registry via a runtime handle
• Hardened Docker container: read-only FS, all caps dropped except NET_BIND_SERVICE, UID 10001
• Action engine with SHA-256 hashed tokens, constant-time comparison via subtle

Single Cargo workspace, 8 crates. MIT licensed.

GitHub: https://github.com/Harshil-Anuwadia/aegisdns

I used AI tools while writing this and I'm not hiding that. All the architectural decisions are mine. Happy to go deep on any implementation detail.