What NLnet Labs does

NLnet Labs (legally Stichting NLnet Labs) is a Dutch non-profit foundation established in 1999 that develops open source software for two layers of core internet infrastructure: DNS and inter-domain routing security. It serves network operators, ISPs, regional and national internet registries (e.g., RIPE NCC, NIC.br, SIDN, AFNIC), domain registries, hyperscale cloud providers (Google, Microsoft, AWS, Oracle), CDNs and edge platforms (Cloudflare, Fastly), data-center operators (Equinix), and telecoms (Arelion). Its software is deployed in production by these organizations to run authoritative DNS, recursive resolution, DNSSEC signing/validation, RPKI certificate authority operations, and RPKI route origin validation.

The product portfolio is organized into two technical stacks. For DNS, NLnet Labs ships NSD (authoritative nameserver), Unbound (recursive resolver), Cascade (DNSSEC signing), the ldns library, and the "domain" toolkit (dnsi, dnst, mimir). For routing, it offers Krill (RPKI Certificate Authority), Routinator (RPKI Relying Party), RTRTR (RPKI data proxy for centralized validator architectures), and Rotonda (BGP application platform). Most components are implemented in Rust with a stated focus on security and performance; releases are cryptographically signed, packages are distributed for Debian, Ubuntu, RHEL/Rocky, and Docker, and the organization holds CVE Numbering Authority status.

The organization operates as an Algemeen Nut Beogende Instelling (ANBI, Public Benefit Organisation) under Dutch law and has no parent, no VC backing, and no equity instruments. Revenue derives from two streams: (1) tiered annual professional support contracts (Gold, Silver, Bronze) sold through wholly-owned taxable subsidiary Open Netlabs B.V., and (2) donations, legacies, and subsidies from a broad sponsor base including Google, Microsoft, AWS, Meta, Verisign, ICANN, RIPE NCC, SIDN, SURF, and Fastly. The organization is small (1–10 employees), publishes an annual report every year, and derives reputational and standards influence from continuous IETF participation.

Name

NLnet Labs

Legal name

Stichting NLnet Labs

Website

https://nlnetlabs.nl

Company type

Private

Founded year

1999

Operating status

Operating

Headcount range

1–10 employees

Short description

NLnet Labs is a Dutch non-profit foundation that develops open source DNS and routing infrastructure software (NSD, Unbound, Krill, Routinator, RTRTR) used by network operators, internet registries, hyperscalers, and CDNs, funded by professional support contracts and donations.

Ownership category

akta.pro rank

Product category

DNS and Routing Infrastructure Software

NAICS

Computer Systems Design and Related Services (5415)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Network Backbone & Core IP Transport (Long-Haul/Metro IP) (HDAIAFAG)

Keywords

• Authoritative DNS software
• Recursive DNS resolver
• RPKI certificate authority
• DNSSEC signing tools
• BGP routing platform

Headquarters

HQ city

Nieuw-amsterdam

HQ country

Netherlands

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Others

Revenue model

1. Professional Support Services: Tiered support contracts (Gold, Silver, Bronze) providing direct access to core development team, security vulnerability notices, and consultancy hours. Delivered through Open Netlabs B.V., their taxable subsidiary.
2. Donations and Grants: As a non-profit ANBI (Algemeen Nut Beogende Instelling) under Dutch law, NLnet Labs receives donations, legacies, and subsidies that are tax-deductible, supported by major internet organizations

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels6 records

Core offering

NLnet Labs develops and maintains open source DNS and routing infrastructure software under BSD/Mozilla licenses, including the NSD authoritative nameserver, Unbound recursive resolver, Cascade DNSSEC signer, and the routing portfolio (Krill RPKI CA, Routinator, RTRTR proxy, Rotonda BGP platform). Commercial activity is delivered through its wholly-owned subsidiary Open Netlabs B.V., which sells tiered professional support contracts (Gold, Silver, Bronze) providing direct access to the core development team, priority security notifications, and consultancy hours. The foundation is additionally funded by donations, grants, and financial sponsorships from internet infrastructure operators.

Product overview

NLnet Labs is a non-profit foundation that develops a portfolio of open source software focused on two critical areas of Internet infrastructure: DNS and routing. The DNS portfolio includes NSD (authoritative DNS nameserver), Unbound (recursive DNS resolver), and the domain project covering dnsi, dnst, and mimir implementations. The DNSSEC signing tool is called Cascade. The routing portfolio includes Krill (RPKI Certificate Authority), Routinator (RPKI Relying Party software), RTRTR (RPKI data proxy for distributing VRP data across multiple formats and locations), Rotonda (BGP application platform), and ldns (DNS library and toolkit). These products are open source under BSD/Mozilla licenses and are complemented by professional support services offered through Open Netlabs, with community support available via forums and Discord.

Differentiator

Problem solved

Functional benefit

Products and services

• NSD Fast and robust authoritative DNS nameserver used by network operators and registries to serve DNS zones at internet scale.
• Unbound Lean and versatile recursive DNS resolver with built-in DNSSEC validation for end-user DNS resolution.
• Cascade Purpose-built DNSSEC signing solution for securing DNS zone data with cryptographic signatures.
• Krill Flexible and scalable RPKI Certificate Authority software for issuing and managing Route Origin Authorizations (ROAs).
• Routinator Lightweight RPKI Relying Party software that validates route announcements against RPKI data for BGP security.
• RTRTR RPKI data proxy that collects Validated ROA Payloads (VRPs) from multiple sources in multiple formats and dispatches them to local caching RTR servers.
• Rotonda Flexible BGP application platform for building custom routing infrastructure components.
• ldns DNS library and toolkit that provides a programming interface for building DNS-aware applications and tools.
• domain (dnsi, dnst, mimir) DNS implementation project that encompasses multiple DNS tools (dnsi, dnst, mimir) for DNS operations and research.
• Professional Support Contracts (Gold, Silver, Bronze tiers) Tiered annual support subscriptions (Gold, Silver, Bronze) providing direct access to the core development team, priority security vulnerability notifications with tiered response times, dedicated chat and email channels, and bundled consultancy hours.

Quantifiable outcome

• Zero downtime SLA mindset for mission-critical infrastructure
• +1 more outcomes

Named customers12 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Partnerships

One partnership is on record.

• Open Netlabs B.V.coreStrategic or Co-development PartnerWholly owned taxable subsidiary of NLnet Labs Foundation that serves non-profit public benefit goals while providing professional support services and consultancy. Handles support contract delivery, billing, and customer relationships for enterprise support services.

Scale indicators2 records

Recent moves6 records

Expansion highlights5 records

Emerging players

• NS1: NS1 provides DNS-based intelligent traffic management, load balancing, and observability as a managed service. Competes for new authoritative and traffic-steering DNS workloads that might otherwise run on NSD or Unbound with custom scripts.
• BlueCat Networks: BlueCat provides enterprise DNS, DHCP, and IP Address Management (DDI) with a focus on large financial services and government customers. Competes for the same enterprise authoritative DNS deployments where NLnet Labs' NSD is often used.
• EfficientIP: EfficientIP provides DNS, DHCP, and IPAM (DDI) solutions with a strong focus on DNS security and threat protection. Competes in the enterprise and service-provider DNS security markets overlapping with NLnet Labs' DNSSEC and routing-security offerings.

Direct peers

• PowerDNS: PowerDNS develops open-source Authoritative Server and Recursor, plus commercial PowerDNS Auth and DNSdist products. Direct competitor across both open-source and commercial layers of the DNS market where NLnet Labs also plays.
• CZ.NIC Labs (Knot DNS): CZ.NIC develops Knot DNS (authoritative) and Knot Resolver (recursive), both open-source and used by European ccTLD registries. Direct open-source competitor to NLnet Labs' NSD and Unbound with overlapping protocol support including DNSSEC.
• Internet Systems Consortium (ISC): ISC develops BIND, the most widely deployed open-source DNS software historically, and Kea DHCP. Direct competitor to NLnet Labs' NSD, Unbound, and Cascade in the open-source DNS and DNSSEC signing tooling market.

Broad incumbents

• F5 (BIG-IP DNS): F5's BIG-IP DNS (formerly DNS Express, previously F5 BIG-IP / NGINX Plus) provides enterprise-grade DNS services and load balancing for service-provider and enterprise networks. Competes in the broader carrier-grade DNS and application delivery market where NLnet Labs software is deployed.
• Infoblox: Infoblox is a leading enterprise DDI (DNS, DHCP, IPAM) and DNS-security vendor. Competes in enterprise DNS infrastructure and security markets that overlap with NLnet Labs' authoritative and recursive DNS deployments. Also listed as a financial partner of NLnet Labs.
• Cloudflare (Authoritative DNS): Cloudflare operates a globally distributed authoritative DNS service and 1.1.1.1 resolver service at massive scale. While Cloudflare uses open-source DNS components, its managed DNS offering is a direct alternative to enterprises running NLnet Labs software, and Cloudflare is also a listed financial partner.
• Akamai (Edge DNS / Authoritative DNS): Akamai operates Edge DNS and Authoritative DNS as a managed service for enterprises and CDN customers at massive global scale. Competes with on-prem authoritative DNS deployments and resolvers running NLnet Labs software at large content and cloud providers.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/NLnetLabs

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about NLnet Labs