---
type: entity
path: Wiki/Homelab
tags:
  - dns
  - proxmox
  - homelab
  - traefik
created: 2026-05-24
updated: 2026-05-24
---

# Knot DNS

## What it is

Knot is the authoritative DNS server for the homelab's internal `.herbylab.dev` zone, running in a Proxmox LXC. It is the primary half of a split-horizon DNS architecture — Knot answers authoritatively for internal names while Pi-hole sits in front for filtering and forwarding. Knot is what makes capability-based names like `traefik.herbylab.dev`, `pihole.herbylab.dev`, and `openwrt.herbylab.dev` resolve on the LAN to their Traefik-fronted services.

## Current state

Active as the internal authority. Operational notes from recent work:
- **Split-horizon** — Knot authoritative for internal `.herbylab.dev`; Pi-hole forwards/filters in front (rebind-protection and EDE-15 issues were debugged during stand-up)
- **A-records being added incrementally** as services land — outstanding adds flagged in session notes include `pve.herbylab.dev → 10.0.21.188` (so PVE SPICE `.vv` files stop needing sed-rewrite) and `us-test-authy.herbylab.dev → 10.0.21.207`
- Sits upstream of the homelab [[Wiki/Reference/traefik|Traefik]] TLS pipeline (DNS resolves the name, Traefik terminates with the `*.herbylab.dev` wildcard)

## Where it lives

- Knot LXC (container **103**) on Proxmox
- Zone data for `.herbylab.dev`; secondary on the NAS is a planned follow-on (not yet stood up)

## Related projects

- [[Sources/Homelab/dns-knot-pihole-end-to-end|dns-knot-pihole-end-to-end]] — Knot + Pi-hole chain live; rebind/EDE-15 fixes
- [[Sources/Homelab/homelab-dns-decision|homelab-dns-decision]] — locked split-horizon Knot architecture
- [[Sources/Homelab/2026-05-21-traefik-routes-for-pihole-openwrt-us-test-authy-static-ip-cutove|traefik routes for pihole/openwrt]] — internal name resolution for new routes
- [[Wiki/Reference/traefik|traefik]] — consumes Knot resolution
- [[Wiki/Homelab/proxmox|proxmox]] — host
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis

## History

- **2026** — Split-horizon Knot architecture locked; `.herbylab.dev` authoritative internally
- **2026** — Knot + Pi-hole chain brought live end-to-end (rebind protection + EDE-15 debugging)
- **2026-05** — Pending A-record adds (`pve`, `us-test-authy`) flagged across Traefik/PBS-backup sessions
- **Planned** — Knot zone file into git; Ansible role for the primary; secondary on NAS