NLnet Labs is a non‑profit research institute and software development organization based in the Netherlands that focuses on the development and deployment of open‑source Internet infrastructure technologies. Established in 2001 as an operational arm of the NLnet Foundation, the institute works on projects aimed at improving the security, stability, and scalability of core Internet services, particularly the Domain Name System (DNS).
Mission and Activities
NLnet Labs’ stated mission is to "advance the development and deployment of the Internet's critical infrastructure" through research, engineering, and community collaboration. The organization primarily engages in:
- Software development – Creating and maintaining open‑source software such as Unbound (a validating, recursive DNS resolver), OpenDNSSEC (a toolchain for automating DNSSEC signing), and other DNS‑related utilities.
- Research and standards – Conducting applied research on DNS security, DNS privacy, and other networking topics, and contributing to Internet Engineering Task Force (IETF) working groups and standards.
- Deployment support – Assisting operators, service providers, and public institutions in implementing secure DNS services, including DNSSEC deployment and DNS over TLS (DoT).
- Education and outreach – Providing documentation, workshops, and public presentations to promote best practices in Internet infrastructure security.
Organizational Structure
NLnet Labs operates as an independent legal entity under Dutch law, governed by a board of directors and a scientific advisory board composed of experts from academia and industry. Funding is derived from a combination of grants, donations, and project‑specific contracts, notably from the European Union, national research agencies, and private foundations.
Key Projects
| Project | Description | Primary Use |
|---|---|---|
| Unbound | A validating, recursive DNS resolver that supports DNSSEC validation, DNS over TLS, and DNS over HTTPS. | Used by ISPs, enterprises, and end‑users for secure DNS resolution. |
| OpenDNSSEC | An automation framework that simplifies the process of signing DNS zones with DNSSEC. | Facilitates large‑scale DNSSEC deployment for domain registries and operators. |
| Knot DNS | A high‑performance authoritative DNS server (developed in collaboration with CZ.NIC). | Deployed by DNS operators requiring fast and secure authoritative services. |
| NLnet Labs Testbed | A platform for experimenting with DNS protocols, privacy extensions, and emerging standards. | Supports research and testing of novel DNS mechanisms. |
Impact and Recognition
NLnet Labs’ software has been widely adopted in the global DNS ecosystem. Unbound, for example, is incorporated into major operating systems such as Android and various Linux distributions, and is used by public DNS resolvers worldwide. The institute’s contributions to DNSSEC have been instrumental in the broader adoption of DNS security across top‑level domains and national registries.
Affiliations
NLnet Labs collaborates with a range of organizations, including the Internet Engineering Task Force (IETF), the Internet Research Task Force (IRTF), the DNS Operations Working Group, and various national research networks. It is a member of the NLnet Foundation, which provides strategic oversight and seed funding.
References
- NLnet Labs official website (nlnetlabs.nl) – organization overview, project pages, and annual reports.
- IETF RFCs and working group documents – contributions by NLnet Labs staff to DNS standards.
- European Commission grant documentation – funding records for DNSSEC and DNS privacy projects.
Note: The information presented is based on publicly available sources up to the knowledge cutoff date of September 2021 and subsequent updates from the organization’s official communications.
