Where a DNS appliance fits
Clients send DNS questions to a resolver, which finds an answer or returns an appropriate error. A DNS security appliance puts resolution and security controls in the same managed service. Raven receives client queries over UDP or TCP and applies the enabled admission, policy, resolution, and validation controls.
Plan a virtual deployment around its network placement, allocated resources, and operating requirements. Confirm hypervisor support and sizing with the Raven team, then validate the appliance against your actual workload, licensed capacity, enabled features, and infrastructure.
Select the resolution path
Raven supports four resolver modes. Forwarder-only uses configured upstream servers; root iterative resolution follows the DNS hierarchy from embedded root hints. Root-then-forwarder and forwarder-then-root combine these paths in the selected order. Valid NXDOMAIN and NODATA results are terminal answers, not triggers to keep searching.
Supported upstream transports include UDP, TCP, DNS over TLS (DoT), and DNS over HTTPS (DoH). Encrypted upstream connections require certificate-chain and hostname validation. Encrypted-to-plaintext fallback is configurable and enabled by default; deployments requiring transport confidentiality must disable that fallback and verify upstream connectivity.
Separate management from DNS processing
Configuration is validated and compiled before a complete runtime generation is published. Accepted queries use prepared snapshots rather than synchronous calls to the management API or configuration database for their main decisions. This separation keeps administrative work outside the critical query path.
Appliances operate independently. Raven does not provide an internal cluster, built-in configuration synchronization, or internal Anycast. Availability planning belongs to the deployment design and should be tested without assuming those features.
What to review before deployment
A working resolver is only part of acceptance. Confirm its access boundary, DNS behavior, policy decisions, and investigation workflow using representative clients and failure conditions.
- Restrict listener addresses, interface firewall rules, and client ACLs to the intended networks.
- Validate capacity and rate/concurrency settings with the selected inspection and resolver modes.
- Test successful lookups, policy blocks, upstream failures, and DNSSEC failure handling with the client CD flag in mind.
- Review Guard events and runtime health. Live Query holds bounded recent requests in RAM; it is not a permanent packet archive.
- Plan changes and recovery around validated runtime generations, supported firmware procedures, and the surrounding infrastructure.
Is a DNS security appliance the same as a DNS server?
A DNS server is a broad category that includes authoritative servers and recursive resolvers. Raven is a recursive resolver appliance with additional policy, validation, and operational controls. Its role is to process client lookups through the configured DNS path, not to provide an authoritative DNS hosting service.
The appliance form factor does not establish a capacity or availability guarantee. Evaluate query load, upstream behavior, enabled controls, licensed capacity, and recovery together. Confirm supported virtualization and resource requirements with the Raven team before selecting the deployment environment.