v0.2.0

Privacy-first DNS. One binary, encrypted egress only

This release brings mobile auto-discovery to rcvd.

• QA testing: Android OS clients can now find and upgrade to rcvd's encrypted endpoints on their own, over DoH3, without the operator hand-typing anything the platform refuses to accept.

• QA testing: iOS clients tested successfully with the DNSecure app pointed at rcvd over DoH2.

• Other highlights: resilient connection recovery on roaming links, and adjustments to log levels.

---

DDR / SVCB self-discovery (RFC 9462 / 9461)

rcvd now answers Discovery of Designated Resolvers about itself. It self-serves the
_dns.resolver.arpa special-use zone, synthesizing SVCB records that advertise every encrypted
listener it actually runs — one record per protocol, preference-ordered.

This is the load-bearing piece for native mobile clients. Without published DDR/SVCB records,
Android Private DNS falls back to DoT and the iOS discovery path fails outright. With them, a client
discovers rcvd's DoH endpoint and upgrades on its own — no operator-typed hostname that the
platform would otherwise reject.

• rcvd serves resolver.arpa locally in full (RFC 6303 / 8375): the SVCB probe gets rcvd's
  designations; every other name and type returns NODATA, never a trip upstream.

• A new advertise_ips setting publishes the real public addresses as the SVCB ipv4hint /
  ipv6hint — needed for a wildcard bind (0.0.0.0 / ::) or behind NAT or an Elastic IP, where
  the bind address is not what the client dials. A concrete IP-literal bind is used automatically
  and needs no override.

DoH3, now discoverable and validated

Early versions of rcvd served DoH3 (HTTP/3 over QUIC). What is new in v0.2.0 is that mobile
clients can now find it. Android's DDR probe reaches for HTTP/3 first, and the DDR/SVCB records
rcvd publishes point it straight at the DoH3 endpoint — no operator-typed hostname required. This
release is also the first to validate that path against native mobile client with dedicated QA Testing.

DoQ idle-gap recovery

On bursty and roaming links, clients constantly recycle pooled QUIC connections the peer has
already closed at its idle timeout. rcvd now classifies these strictly: a clean NO_ERROR or
idle-timeout close is benign and recovered by re-dialing on a fresh connection, while a genuine
protocol error is still surfaced.

A new DoQIdleRetries statistic counts the recoveries, so an operator can see the mechanism
working rather than guessing at phantom failures.

Leveled logging — quieter by default, still no query names

rcvd logs still never record the names you look up, the questions you ask, or the clients that
ask them — that has not changed and will not. What is new is a severity threshold
(debug / info / warn / error) applied to rcvd's own operational messages.
Benign, high-volume server-side events — a client that closed mid-response, an idle connection timing out —
now log at DEBUG instead of always-on, so the default output is quieter and genuine errors stand out.
It is a change to how loud rcvd is about its own plumbing, not to what it observes about you.

---

Also in this release

• EDNS normalization (RFC 6840 §5.9): replies normalize their OPT and DO bit against the
  client's actual query, so a validating client never downgrades and a non-DO client is never
  handed DNSSEC records or an OPT it did not ask for.

• -verify-self now reports the configured DoH hostname, so an operator managing both ends of a
  pinned deployment reads the right identity for the DoH leg.

• Blocklist: a bare entry now blocks its subdomains, underscore labels are accepted, and both
  startup and live reload report how many lines were skipped.

---

Install

The simplest path is to download a pre-built binary for your platform from the release page:

• GitHub: https://github.com/rcvd-dns/rcvd/releases/tag/v0.2.0

• GitLab: https://gitlab.com/rcvd-dns/rcvd/-/releases/v0.2.0

rcvd is a single static binary (CGO_ENABLED=0) with no runtime dependencies — download it, make
it executable, and run it.

Prefer to build from source:

git clone https://github.com/rcvd-dns/rcvd.git

or

git clone https://gitlab.com/rcvd-dns/rcvd.git

cd rcvd
make build

Default port 5300 (coexists with systemd-resolved); protocol priority DoQ → DoT → DoH.

See man rcvd and the whitepaper at https://rcvd.net/whitepaper/ for the full design.

Compatibility

All changes are additive — no configuration fields were removed or renamed. Existing v0.1.x
configurations continue to work unchanged. The new advertise_ips field is opt-in.

v0.1.1

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• updates: pin GH workflow actions to commit SHAs by @cmosetick in #1
• test updates by @cmosetick in #2

New Contributors

• @cmosetick made their first contribution in #1

Full Changelog: https://github.com/rcvd-dns/rcvd/commits/v0.1.0