# Install knot with Homebrew, apk, apt, dnf, MacPorts, pacman, zypper High-performance authoritative-only DNS server. Version 3.5.6 via Homebrew; verified 2026-07-20. Also installable with debian: sudo apt install knot. ## Install ```sh sudo av install brew:knot ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install knot ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install knot ``` Evidence: MacPorts ports tree: net/knot/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add knot ``` Evidence: Alpine Linux edge package indexes: knot from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install knot ``` Evidence: Debian stable package indexes: knot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install knot ``` Evidence: Fedora Rawhide package metadata: knot from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - pacman (92%): ```sh sudo pacman -S knot ``` Evidence: Arch Linux sync databases: knot from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install knot ``` Evidence: openSUSE Tumbleweed package metadata: knot from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ## Package facts - **Package key:** brew:knot - **Package manager:** Homebrew - **Version:** 3.5.6 - **Source summary:** High-performance authoritative-only DNS server - **Homepage:** - **Last updated:** 2026-07-20T12:58:34Z - **Generated:** 2026-08-03T19:37:03+00:00 ## Executables - kcatalogprint (alias) - kdig (alias) - keymgr (alias) - khost (alias) - kjournalprint (alias) - knotc (alias) - knotd (alias) - knsec3hash (alias) - knsupdate (alias) - kzonecheck (alias) - kzonesign (alias) ## Install behavior - Bottle: not available ## Freshness - Page generated: 2026-08-03 - Package-manager version: 3.5.6 ## Project history and usage Knot DNS is CZ.NIC's high-performance authoritative-only DNS server. In package-manager culture it is the serious authoritative sibling to recursive resolver packages: installing `knot` brings the daemon, control tool, zone utilities, DNSSEC key tooling, and DNS query tools used by operators. ### Project history CZ.NIC developed Knot DNS for authoritative DNS service, especially the demanding needs of registry and large-zone operators. The project site describes it as open source, GPL 3+ licensed, and targeted at Linux, BSD, macOS, and other POSIX systems. The 2.0.0 release on 2015-06-26 marked a major packaging and operations milestone: DNSSEC was split into a separate library, basic KASP support was introduced, configuration moved to a new YAML text format backed by LMDB storage, and documentation included HTML and PDF manual pages. The 3.0.0 release on 2020-09-09 added XDP-based high-performance networking, catalog zones, a kzonesign utility, DoH support in kdig, and other DNSSEC and operations improvements. ### Adoption history Knot DNS is associated with CZ.NIC, the .CZ registry, and was promoted early as a high-performance authoritative DNS server for TLD and DNS-hosting scenarios. Internet Society deployment material from 2013 described it as used by CZ.NIC for the .CZ TLD and aimed at network and DNS operators. Its spread through Homebrew, Debian, Fedora, Arch, Alpine, MacPorts, Ubuntu, and openSUSE matters because authoritative DNS operators often need the same tooling on workstations and servers. Package availability lowers the friction for testing zone signing, transfers, dynamic updates, and `kdig` diagnostics outside production. ### How it is used Knot DNS is used to serve authoritative zones, including DNSSEC-signed zones, with zone transfers, dynamic updates, response rate limiting, automatic signing, and rapid reconfiguration. The Homebrew package exposes both server components such as knotd and operational utilities such as knotc, keymgr, kzonecheck, kzonesign, kdig, khost, and knsupdate. A common package-level pattern is using Knot DNS tools even when the daemon is not the only DNS server in an environment. Utilities such as kdig and keymgr make the formula useful to DNS practitioners who need modern protocol testing or DNSSEC maintenance commands on macOS and Unix workstations. ### Why package nerds care Knot DNS is packaging-heavy software in the good sense: it has a daemon, config files, zone storage, LMDB-backed state, DNSSEC key material, optional modules, and command-line tooling. Correct packages have to get paths, service integration, crypto libraries, and permissions right. For package nerds, it is also one of the names that marks the DNS ecosystem beyond BIND. Seeing Knot DNS in a package index signals that a repository can support production-grade authoritative DNS alternatives, not only client lookup utilities. ### Timeline - 2013: Internet Society deployment material described Knot DNS as used by CZ.NIC for the .CZ TLD. - 2015-06-26: Knot DNS 2.0.0 introduced YAML configuration, LMDB-backed configuration storage, and basic KASP support. - 2017-06-05: Knot DNS 2.5.0 moved KASP data from JSON files to LMDB and expanded dynamic module support. - 2020-09-09: Knot DNS 3.0.0 added XDP networking, catalog zones, kzonesign, and DoH support in kdig. - 2026-06-12: CZ.NIC announced Knot DNS 3.5.5 on the project website. ### Related projects - Knot Resolver is the recursive/caching project in the Knot family. Operationally related alternatives include BIND, NSD, PowerDNS Authoritative Server, YADIFA, and DNS utility packages that provide dig-like clients. ### Sources - - - - - ## Security Notes broad file, network, media, or database tool signal. formula declares a Homebrew service. - **Geiger risk:** orange / medium - broad file, network, media, or database tool signal - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: @config_dir@/knot.conf ## Other Package-Manager Records - Debian apt - knot - 3.4.6-2: normalized package name match | Debian stable package indexes: knot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Authoritative domain name server | https://www.knot-dns.cz/ - Debian apt - knot-dnssecutils - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-dnssecutils from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNSSEC tools provided with Knot DNS (kzonecheck, kzonesign, knsec3hash) | https://www.knot-dns.cz/ - Debian apt - knot-dnsutils - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-dnsutils from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Clients provided with Knot DNS (kdig, knsupdate, kxdpgun) | https://www.knot-dns.cz/ - Debian apt - knot-doc - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Documentation for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-exporter - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-exporter from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Prometheus exporter for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-host - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-host from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Version of 'host' bundled with Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-module-dnstap - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-module-dnstap from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | dnstap module for Knot DNS | https://www.knot-dns.cz/ - Debian apt - knot-module-geoip - 3.4.6-2: normalized package name match | Debian stable package indexes: knot-module-geoip from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | geoip module for Knot DNS | https://www.knot-dns.cz/ - Debian apt - libdnssec9t64 - 3.4.6-2: normalized package name match | Debian stable package indexes: libdnssec9t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNSSEC shared library from Knot DNS | https://www.knot-dns.cz/ - Debian apt - libknot-dev - 3.4.6-2: normalized package name match | Debian stable package indexes: libknot-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Knot DNS shared library development files | https://www.knot-dns.cz/ - Debian apt - libknot15 - 3.4.6-2: normalized package name match | Debian stable package indexes: libknot15 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Authoritative domain name server (shared library) | https://www.knot-dns.cz/ - Debian apt - libzscanner4t64 - 3.4.6-2: normalized package name match | Debian stable package indexes: libzscanner4t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | DNS zone-parsing shared library from Knot DNS | https://www.knot-dns.cz/ - Debian apt - python3-libknot - 3.4.6-2: normalized package name match | Debian stable package indexes: python3-libknot from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Python bindings for libknot | https://www.knot-dns.cz/ - Ubuntu apt - knot - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Authoritative domain name server | https://www.knot-dns.cz/ - Ubuntu apt - knot-dnssecutils - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-dnssecutils from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | DNSSEC tools provided with Knot DNS (kzonecheck, kzonesign, knsec3hash) | https://www.knot-dns.cz/ - Ubuntu apt - knot-dnsutils - 3.3.4-1.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: knot-dnsutils from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Clients provided with Knot DNS (kdig, knsupdate, kxdpgun) | https://www.knot-dns.cz/ ## Combined YAML source View the package source record on GitHub. [combined/knot.yml](https://github.com/mxcl/pkgdb/blob/main/combined/knot.yml) ## Sources - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph