Book a demo

Raven security platform

One DNS Path.
Multiple Security Layers.

Raven places policy, validation, telemetry, and operational control around the DNS lifecycle while keeping management work outside critical request processing.

01

DNS Guard

Policy enforcement across the DNS request lifecycle.

  1. RequestQuery received
  2. PolicyDomain and source
  3. ResolutionCache or upstream
  4. DecisionAnswer or enforce
Domain rulesRPZ sourcesThreat feedsIP/CIDR checksREFUSEDNXDOMAINSinkholeLog-only
Full audit & telemetry
02

Secure Recursive Resolver

Controlled resolution with bounded work and transport validation.

Upstream selectionClient queriesRecursive
resolverResponsesBounded cacheQuery controls
Isolated request pathTTL controlsBailiwick checksDoT / DoH
03

Native DNSSEC

Local chain validation without upstream AD trust.

  1. Trust anchor
  2. DS
  3. DNSKEY
  4. RRSIG
  5. Validated
SecureInsecureBogusIndeterminateAuthenticated denial
04

Visibility & Response

Operational signals for investigation and action.

Live events

Stream bounded DNS activity.

Incidents

Investigate policy and anomaly evidence.

Query rates

Track aggregate request volume.

Runtime health

Separate liveness and readiness.

Security foundations

Security foundations

Edge & Abuse Defense

Control resolver exposure and bound abusive work at the protocol edge.

  • Access boundaries
  • Rate limits
  • Malformed queries

Secure Administration

Protect administrative access, mutations, permissions, and audit evidence.

  • RBAC
  • CSRF
  • Audit logs

Resilient Runtime

Run DNS from validated snapshots with encrypted recovery generations.

  • Immutable state
  • LKG
  • Health checks

Trusted Platform Lifecycle

Verify licensed capacity and signed firmware before activation.

  • Signed artifacts
  • Integrity checks
  • Controlled updates

Capability index

Complete Capability Index

Documented controls organized across eight security layers.

01DNS Guard12 documented controls

Apply policy before and after resolution with compiled, layered decisions.

  • Pre-resolution request inspection
  • Post-resolution A, AAAA, CNAME, and NS inspection
  • Priority-based policies by source, query type, and domain
  • Exact, suffix, wildcard, and bounded regex indicators
  • IP and CIDR indicators for returned targets
  • URL threat feeds and validated batch imports
  • RPZ sources and custom response records
  • REFUSED and NXDOMAIN enforcement actions
  • Validated sinkhole and log-only actions
  • TXT, NXDOMAIN, entropy, DGA-like, and unique-subdomain detection
  • Expiring domain and client exemptions
  • Conflict checks before policy activation
02Secure Recursive Resolution15 documented controls

Resolve through controlled forwarding and iterative modes with bounded work.

  • Forwarder-only resolution mode
  • Root iterative resolution mode
  • Root-then-forwarder and forwarder-then-root modes
  • Embedded root hints
  • UDP, TCP, DNS over TLS, and DNS over HTTPS upstreams
  • Mandatory certificate-chain and hostname validation for DoT and DoH
  • Private CA extension and additive SPKI pinning
  • QNAME minimization with exact audited exceptions
  • Referral progression, bailiwick, and glue checks
  • Independent resolution of out-of-bailiwick name servers
  • Strict response-to-question binding
  • Bounded exchange, endpoint, hop, depth, and concurrency budgets
  • Positive and RFC 2308 negative caching
  • Generation-safe cache with no stale-answer fallback
  • Atomic RRset fitting with TCP retry signaling
03Native DNSSEC11 documented controls

Validate authenticity locally instead of trusting an upstream AD bit.

  • Raven-native DNSSEC validation
  • Local DNSKEY, DS, and RRSIG chain validation
  • Authenticated denial validation
  • Secure, Insecure, Bogus, and Indeterminate classification
  • Upstream AD-bit clearing and distrust
  • CD-aware response behavior
  • SERVFAIL and EDE handling for Bogus answers
  • Embedded root trust anchors
  • RFC 5011 trust-anchor lifecycle
  • Signed online IANA trust-anchor updates
  • Exact, expiring, audited Negative Trust Anchors
04Visibility & Response12 documented controls

Turn bounded runtime signals into operational evidence and investigation paths.

  • RAM-only live query ring
  • Client, QNAME, RCODE, DNSSEC, and action context
  • CPU, memory, network, session, and query-rate telemetry
  • DNS Guard event investigation
  • Bounded incident aggregation and evidence samples
  • CSV export for Guard events
  • Administrative audit trail with correlation IDs
  • Before-and-after evidence for non-secret fields
  • Syslog and webhook event forwarding
  • Prometheus and Grafana metrics path
  • Separate liveness, readiness, and metrics endpoints
  • Operational retention and disk-pressure controls
05Edge & Abuse Defense14 documented controls

Constrain who can reach the resolver and bound work before expensive processing.

  • Per-interface nftables exposure policy
  • Explicit DNS listener binding
  • Compiled client ACL enforcement
  • Global admission limits
  • Transport-specific admission limits
  • Per-client rate and concurrency limits
  • License and optional settings QPS ceiling
  • DNS Cookies
  • Minimal ANY responses
  • Response Rate Limiting
  • Strict single-question parsing
  • Fail-safe malformed-query handling
  • UDP and EDNS response fitting
  • Explicit overload outcomes
06Secure Administration13 documented controls

Protect administrative identity, browser mutations, permissions, and evidence.

  • Password policy and bounded login lockout
  • HttpOnly JWT authentication cookie
  • Server-side active sessions
  • Concurrent session limits and idle timeout
  • Per-user trusted host IP and CIDR restrictions
  • Module RBAC with ReadWrite, ReadOnly, and None levels
  • Backend-enforced authorization
  • Exact same-origin validation
  • Single-use CSRF tokens with SameSite Strict
  • No credentialed cross-origin mode
  • HSTS, no-store, nosniff, and framing protections
  • Two-phase mutation audit with fail-closed behavior
  • Restricted appliance console and SSH commands
07Resilient Runtime14 documented controls

Publish complete validated generations while keeping management off the query path.

  • Management-plane and DNS data-plane separation
  • No synchronous database or management API lookup in the accepted-query hot path
  • Immutable runtime snapshots
  • Complete staged configuration generations
  • Schema, policy, trust, license, and digest validation before activation
  • Atomic generation publication
  • AES-256-GCM runtime bundle envelope
  • Per-appliance Device KEK binding
  • Generation-aware authenticated context binding
  • Encrypted Active and Previous Last-Known-Good files
  • Fail-not-ready behavior for invalid runtime state
  • Bind-and-probe before listener switchover
  • Previous-listener draining after successful publication
  • Loopback-only operational endpoints
08Trusted Platform Lifecycle13 documented controls

Verify license, capacity, build provenance, and firmware before runtime use.

  • RSA-PSS-SHA256 signed licenses
  • Hardware and trusted-time license binding
  • Signed feature and capacity limits
  • Explicit seven-day license grace period
  • Ed25519-signed firmware manifests
  • Pinned Go build toolchain
  • SPDX 2.3 SBOM and in-toto/SLSA provenance
  • Payload, manifest, SBOM, and provenance hash linkage
  • Firmware extension, size, digest, signature, and channel checks
  • Path traversal, Unicode collision, duplicate-field, and archive-bomb defenses
  • Least-privilege firmware updater
  • Independent local helper revalidation
  • Fixed service orchestration and readiness checks

DNS security guides

Explore the controls in context

Understand the threat, the control, and the deployment conditions that affect protection.

DNS firewall

Understand DNS firewall filtering with Raven DNS Guard: domain policies, RPZ threat feeds, request and response inspection, and explicit enforcement actions.

DNS appliance

Explore Raven as a virtual DNS appliance: recursive resolution, DNS firewall policies, local DNSSEC validation, deployment boundaries, and operational visibility.

DNS attacks

Compare DNS attack types: amplification, cache poisoning, tunneling, rebinding, query floods, and DGA activity, with their distinct controls and limits.

Ready to see Raven in action?

See Raven in your environment.

Walk through the architecture, policy model, and operational controls against your own security objectives.

Book a Technical Demo