Dgaard

A suite of Rust tools for high-performance, privacy-first DNS filtering and network security. Designed for resource-constrained environments (OpenWrt, embedded routers) and SME networks alike.

---

Packages

dgaard — Embeddable DGA / Domain Classification Engine (core library)

The embeddable core: a pure Rust library for detecting algorithmically generated domain names (DGA) and classifying domains against blocklists, lexical heuristics, and structural rules. Exposes no globals and no networking — every classification call takes its configuration and engine explicitly, so you can embed it into any Rust program to find DGA domains.

use std::sync::Arc;
use dgaard::{Classifier, Config, FilterEngine};

let config = Arc::new(Config::default());
let engine = Arc::new(FilterEngine::empty());
let classifier = Classifier::with_engine(config, engine, 42);

if classifier.is_dga("a1b2c3d4e5f6g7h8i9j0.com") {
    println!("DGA domain detected!");
}

See the dgaard README for the full API tour.

---

dgaardd — DNS Security Proxy (server binary)

The networking front-end built on the dgaard engine: a high-performance, stratified DNS filtering proxy with DGA detection, blocklists, telemetry, and OpenWrt-optimised deployment.

Key capabilities:

• Stratified filtering pipeline — queries flow through a short-circuit funnel: whitelist → hot LRU cache → exact-match → suffix/wildcard → heuristic engine. Each stage is orders of magnitude cheaper than the next.
• DGA detection — Shannon Entropy and N-Gram models identify algorithmically generated domains (malware C2) before they appear on any blocklist (powered by the dgaard engine).
• Smart-IDN / Homograph protection — decodes Punycode and blocks look-alike phishing domains.
• DNS exfiltration & rebinding protection — monitors TXT record entropy, CNAME chains, and subdomain volume; drops public queries that resolve to private IPs.
• Live telemetry — streams length-prefixed binary events over a Unix Domain Socket for real-time dashboards.
• OpenWrt-optimised — SO_REUSEPORT multi-threading, async Tokio runtime, hot-reload via SIGHUP.

cargo install dgaardd
dgaardd --config /etc/dgaard/config.toml

See the dgaardd README and example configuration for the full setup guide.

---

dgaard-monitor — Real-Time TUI Dashboard

A terminal UI that connects to dgaard's Unix Domain Socket and visualises DNS activity without adding any overhead to the proxy process. It resolves domain hashes back to human-readable names via a static mapping file, then renders live feeds, per-client traffic (Talkers), timeline charts, and top-N block statistics.

Key capabilities:

• Parses the length-prefixed binary protocol emitted by dgaard ([u16: length][u8: type][payload]).
• Watches the host-index file with inotify and hot-reloads domain mappings without restarting.
• Aggregates events into bucketed timelines with zoom cycling and gap-filling.
• Resolves client IPs to hostnames via reverse-DNS (PTR lookups) in the background.
• Linux only (relies on inotify).

cargo install dgaard-monitor

# attach to a running dgaard instance
dgaard-monitor --socket /tmp/dgaard_stats.sock --index /var/lib/dgaard/hosts.bin

See the dgaard-monitor README for the full protocol and configuration reference.

---

adblockptimize — Adblock List Optimizer

A CLI tool that ingests standard adblock lists (files or URLs) and splits them into two deduplicated, sorted outputs: one for network-level blocking (DNS, dnsmasq, Unbound, Pi-hole, AdGuard Home) and one for browser-level blocking (CSS/JS/HTML cosmetic rules). Feeding the network output directly into dgaard gives you cleaner, smaller blocklists with no browser-specific noise.

cargo install adblockptimize

# split a list into network and browser files
adblockptimize https://example.com/list.txt local-list.txt

# dnsmasq format, network rules only
adblockptimize --no-browser --format=dnsmasq https://example.com/list.txt

# custom output file names
adblockptimize --network-file=dns.txt --browser-file=ublock.txt https://example.com/list.txt

See the adblockptimize README for the full format and target compatibility table.

---

Architecture

adblockptimize          dgaard-monitor
      |                       |
      | (optimised lists)     | (Unix socket telemetry)
      v                       |
   dgaardd <-----------------/    <-- built on the dgaard engine library
(DNS proxy, port 5353)
      |
   dnsmasq / router DNS
      |
   LAN clients

adblockptimize pre-processes upstream adblock lists into compact, DNS-ready formats that dgaardd can ingest. dgaard-monitor connects to dgaardd's telemetry socket and provides a live view of what is happening on the network. dgaard is the embeddable classification engine shared by dgaardd (and any other Rust program that needs DGA detection) — all four tools are designed to work together but can be used independently.

---

Installation

All packages are published to crates.io and can be installed with Cargo:

cargo install dgaardd
cargo install dgaard-monitor   # Linux only
cargo install adblockptimize

Pre-built binaries for Linux (musl), macOS, and Windows are available on the Releases page. Each package is released independently and tagged <package>-v<version>.

---

Building from source

git clone https://codeberg.org/slundi/dgaard
cd dgaard

# build all packages
cargo build --release

# build a specific package
cargo build --release -p dgaard       # core library
cargo build --release -p dgaardd      # DNS proxy server
cargo build --release -p dgaard-monitor
cargo build --release -p adblockptimize

Cross-compilation via cross:

cargo install cross --git https://github.com/cross-rs/cross

cross build --release --target aarch64-unknown-linux-musl -p dgaardd
cross build --release --target armv7-unknown-linux-musleabihf -p dgaardd

---

License

Apache-2.0 — see each package's Cargo.toml for details.

Repository: https://codeberg.org/slundi/dgaard