dns

XTLS/Xray-core

Xray-core keeps pushing censorship-resistant proxying forward — Xray-core is the engine behind Project X, bundling protocols like VLESS, VMess, Trojan and REALITY for anti-censorship networking. Active development includes post-quantum encryption for VLESS and XHTTP as a REALITY successor, making it relevant for anyone building or running proxy/VPN tooling that needs to evade deep packet inspection.

Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.

AdguardTeam/AdGuardHome

A self-hosted DNS server that blocks ads for your whole home network — AdGuard Home works like a Pi-hole alternative but needs no client-side software: it sits as your network's DNS server and blackholes tracking domains for every connected device. It supports DNS-over-HTTPS/TLS/QUIC and DNSCrypt, giving home users and self-hosters encrypted, network-wide ad and tracker blocking.

Network-wide ads & trackers blocking DNS server

owasp-amass/amass

OWASP's mature toolkit for mapping external attack surfaces — Amass is an OWASP project combining open source intelligence and active recon to discover subdomains, hosts, and network assets. It suits security teams and researchers doing attack surface mapping, with active development, Docker support, and a community Discord for help.

In-depth attack surface mapping and asset discovery

safing/portmaster

An application firewall that watches every packet, not just ports — Portmaster is an open-source application firewall for Windows and Linux that intercepts traffic at the packet level via nfqueue/eBPF or a Windows kernel driver, giving per-app control, automatic tracker blocking, and secure DNS. Everything runs locally except its optional SPN privacy network, making it useful for users who want real network visibility, not just a basic firewall.

🏔 Love Freedom - ❌ Block Mass Surveillance

BishopFox/sliver

Cross-platform C2 framework for authorized red team testing — Sliver is an open-source adversary emulation framework from Bishop Fox, supporting C2 over mTLS, WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique per-binary encryption keys and support BOF/COFF execution on macOS, Windows, and Linux, amd64/arm64. Useful for red teams doing authorized security testing.

Adversary Emulation Framework

is-a-dev/register

Open-source registry for free .is-a.dev developer subdomains — This repo is the public registry behind is-a.dev, letting developers claim a free custom subdomain for personal sites via a GitHub pull request and JSON file. It's entirely community-run and open source, with a sister project, is-a.bot, recently launched for bot subdomains.

Grab your own sweet-looking '.is-a.dev' subdomain.

go-acme/lego

Go ACME client adds draft DNS-persist and profile extensions — lego is a Go ACME client and library for Let's Encrypt and other CAs, supporting over 200 DNS providers. Recent updates track emerging IETF drafts like ACME profiles and persistent DNS TXT validation, plus RFC 9773 renewal info, making it useful for both CLI automation and custom Go integrations.

Let's Encrypt/ACME client and library written in Go

masterking32/MasterDnsVPN

DNS tunneling VPN built to outperform DNSTT and SlipStream — A Go-based DNS tunneling VPN aimed at bypassing censorship, claiming gains over DNSTT and SlipStream through low-overhead ARQ, resolver load balancing, and better stability under high packet loss. Useful for users needing resilient, fast DNS-based tunnels where conventional VPNs are blocked.

Advanced DNS tunneling VPN for censorship bypass, optimized beyond DNSTT and SlipStream with low-overhead ARQ, resolver load balancing, high packet-loss stability and speed.

celzero/rethink-app

DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.

M-Abozaid/esp32-c3-adblock

537k-domain ad blocker runs on a $2 ESP32-C3 with no PSRAM — Instead of loading blocklist strings into RAM, this project stores 537k domains as sorted 40-bit FNV-1a hashes in flash, binary-searched in ~10ms using only ~50KB RAM. That lets it run on a bare $2 ESP32-C3 instead of the ~$8 PSRAM boards most DNS sinkholes need. Good fit for hobbyists wanting a cheap Pi-hole-style ad blocker with a UDP DNS sinkhole and web dashboard.

Pi-hole-class DNS ad-blocker on a $2 ESP32-C3 (no PSRAM): 537k domains as 40-bit FNV-1a hashes in flash, binary-searched. UDP DNS sinkhole + web dashboard. https://youtube.com/shorts/RaxszOUMi8E?feature=share