NLnet Labs Dedicates Engineering Time to Improve Rust Compiler for Safer DNS Software

NLnet Labs, the non-profit organisation behind widely used DNS infrastructure tools, announced on 14 July 2026 that it is giving back to the Rust programming language community. Rust is a modern programming language designed to prevent memory-related bugs, which makes it attractive for security-critical software. For the past six years, every new project at NLnet Labs has been written in Rust. The team has now decided to support Rust development directly by allowing engineer Arya K. to spend one day a week, starting 22 July, working on the Rust compiler itself. This move is not just about software charity; it is an investment in the security of the DNS ecosystem that many internet users rely on every day.

Rust's history illustrates both the promise and fragility of open-source development. The language was created at Mozilla and enjoyed years of support from its developers. As its popularity grew, other companies contributed to the project. But around 2020, widespread layoffs and restructuring meant that many company-sponsored contributors could no longer justify spending work time on Rust. The project then saw a surge in volunteer contributions from people working in their free time, which led to burnout among maintainers. Since last year, RustNL, the non-profit behind the RustWeek conference, and The Rust Foundation have launched initiatives to fund key maintainers, but their resources are limited and the vast majority of Rust contributors still work unpaid.

Arya K. joined NLnet Labs in 2024 to work on its Rust-based DNS projects. She is leading a redesign of the domain library API and is a core member of the Cascade team, which builds a hidden DNSSEC signer. DNSSEC, short for Domain Name System Security Extensions, adds digital signatures to DNS records so that internet users can trust that the website address they receive has not been tampered with. Arya had already been an enthusiastic Rust user before joining. Her favourite pastime is optimisation, and she moved naturally from writing fast Rust code to trying to make the Rust compiler itself compile code faster. While she is a fan of SIMD (Single Instruction, Multiple Data) and other low-level techniques, she became interested in compiler optimisation for a different reason: she wants to find large-scale, architectural ways to unlock better performance. A year ago, she started building a Rust compiler from scratch in her spare time. Called Krabby, it is a playground for experimenting with a radically different compiler architecture. She will present Krabby at EuroRust 2026 in Barcelona.

The new arrangement at NLnet Labs is a collaboration with RustNL. Arya will work under the guidance of Rust maintainers to map out her work and connect with other contributors to rustc, the official Rust compiler. Currently, she is focusing on speeding up rustc's processing of declarative macros, which are code patterns that automatically generate other code and are common in Rust projects. Her work is tracked through the Rust project's issue numbers #158577, #158974 and #158976. Over time, she plans to move through rustc component by component, optimising what she can and testing architectural changes in Krabby. More details are available on her personal blog.

NLnet Labs' commitment to Rust is closely tied to its DNS security work. For example, its Routinator software, which helps validate internet routing information, was recently audited by the security firm X41 D-Sec. The auditors concluded that "the system appears to be on a good security level and uses Rust's safety features well," a direct result of the language's memory safety guarantees. Memory safety means that common programming errors like buffer overflows, which attackers often exploit, are largely prevented at compile time. Another project, Cascade beta 1, a purpose-built hidden DNSSEC signer nicknamed "Slàinte mhath," was released for testing at the DNS OARC 46 meeting in Edinburgh. A hidden signer keeps DNSSEC signing keys offline, making them much harder to steal. NLnet Labs also marked one year of Roto, a JIT-compiled embedded scripting language for Rust applications, with the release of version 0.11.0.

By supporting Rust compiler improvements, NLnet Labs is helping to secure the software that powers the domain name system itself. This matters to every internet user, because a weak DNS can be exploited for phishing, tracking or censorship. For everyday protection, even if you are not a programmer, you can choose a DNS resolver that prioritises security and privacy. Using a private, encrypted DNS service such as AEU DNS adds an extra layer of protection for your browsing, shielding your queries from prying eyes while the underlying open-source ecosystem grows stronger.