hub / github.com/NLnetLabs/cascade

github.com/NLnetLabs/cascade @main

Chat with this repo

repository ↗ · DeepWiki ↗ · + Follow

1,279 symbols 3,154 edges 85 files 368 documented · 29%

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

Cascade

Cascade is a friendly DNSSEC signing pipeline.

A beta release is available now, we encourage you to test it. Read our comprehensive documentation to get started. If you find a bug, please create an issue on GitHub.

Cascade is a long-term project, with the same maintenance guarantees and support policy as our other products, such as Unbound and Routinator. We offer professional support services with an SLA for Cascade, which include support, consultancy, migration assistance and early security notifications under NDA.

If you have questions, suggestions or feature requests, don't hesitate to start a topic on our Discourse, send us an email or mention us on Mastodon. You can also find us in the NLnet Labs DNS channel on the DNS OARC Mattermost server.

Based on your feedback, we will continue work to offer a production grade release of Cascade in the first half of 2026. Please do not use the current codebase in production.

Feature Set

The Cascade pipeline runs as a single binary, without the need for additional database software. Zones are loaded, signed and published in several stages, letting you review and approve with automation at each step:

cascade-pipeline

Flexible Signing

Get started easily with sensible default settings based on industry best practices. Cascade can generate and use on-disk key files and does not require a Hardware Security Module (HSM) to operate. For operators wishing to use an HSM, Cascade can connect to PKCS#11 and KMIP compatible HSMs.

Bespoke Zone Verification

Using Review Hooks, Cascade supports optional verification of your zone data at two critical stages: verification of the unsigned zone, and verification of the signed zone. These review hooks can be used to perform any validation you require to ensure your zone is correct at all stages, using any (third-party) tools desired.

Controllability

Cascade gives you tight control over key management, automation of key rolls and the DNSSEC signing process.

Installation

Install Cascade from a binary package for either Debian and Ubuntu or for Red Hat Enterprise Linux (RHEL) and compatible systems, such as Rocky Linux. Alternatively, you can build from the source code using Cargo, Rust’s build system and package manager.

Extension points exported contracts — how you extend this code

Viewer (Interface)

A viewer through which zone data can be served. [3 implementers]

src/server/service.rs

TcpListenerFactory (Interface)

(no doc) [2 implementers]

src/common/net.rs

TcpListener (Interface)

(no doc) [2 implementers]

src/common/net.rs

TcpStreamWrapper (Interface)

(no doc) [2 implementers]

src/common/net.rs

Core symbols most depended-on inside this repo

clone

called by 423

src/server/service.rs

clone

called by 213

src/signer/incremental.rs

iter

called by 115

src/signer/incremental.rs

insert

called by 95

src/units/key_manager.rs

get

called by 79

crates/cli/src/client.rs

src/common/scheduler.rs

arg

called by 52

src/units/key_manager.rs

Shape

Method 630

Class 309

Function 180

Enum 156

Interface 4

Languages

Rust100%

Python1%

Modules by API surface

crates/api/src/lib.rs99 symbols

src/signer/incremental.rs80 symbols

src/zone/machine.rs44 symbols

src/units/key_manager.rs43 symbols

src/units/http_server.rs43 symbols

src/zone/mod.rs40 symbols

src/zone/storage.rs36 symbols

src/policy/file/v1.rs34 symbols

src/units/zone_signer.rs33 symbols

crates/cfg/src/file/v1.rs33 symbols

crates/cfg/src/lib.rs31 symbols

src/log.rs26 symbols

For agents

$ claude mcp add cascade \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact