DNS Seed

What Is a DNS Seed?

A DNS seed is a special-purpose domain name that acts as a directory of active Bitcoin nodes. When a new node starts for the first time, it needs to find other nodes on the network to connect to and begin downloading the blockchain. Rather than shipping a static list of IP addresses that would quickly become outdated, Bitcoin Core includes a list of DNS seed domains that dynamically resolve to the IP addresses of currently active nodes.

The mechanism piggybacks on the existing Domain Name System infrastructure that powers the internet. A standard DNS query to a seed domain like seed.bitcoin.sprovoost.nl returns multiple A records (for IPv4) or AAAA records (for IPv6), each pointing to a different verified Bitcoin node. The querying node then connects directly to those peers using the Bitcoin peer-to-peer protocol on port 8333.

DNS seeds do not transfer any Bitcoin data themselves. They serve only as an address book: once the new node has established connections, it no longer needs the seeds.

How It Works

The DNS seed process follows a predictable sequence each time a Bitcoin node starts without any known peers:

1. The node reads the hardcoded list of DNS seed domains from its source code (defined in src/kernel/chainparams.cpp in Bitcoin Core)
2. It performs standard DNS queries against each domain, requesting A and AAAA records
3. Each DNS seed server responds with IP addresses of nodes it has recently verified as active and running compatible software
4. The node adds these addresses to its address manager (AddrMan), capping each seed at 256 addresses to prevent any single seed from dominating
5. The node attempts TCP connections to a subset of these addresses on port 8333
6. Connected peers perform the Bitcoin protocol handshake (version/verack messages) and the node begins initial block download

DNS Seed Software

DNS seed operators run specialized software that continuously crawls the Bitcoin network to maintain an up-to-date list of active nodes. The most widely used implementation is bitcoin-seeder, originally written by Pieter Wuille. It works by:

• Continuously connecting to Bitcoin nodes and performing version/verack handshakes to verify they are alive and running compatible software
• Tracking node reliability over multiple time windows (2 hours, 8 hours, 1 day, 1 week)
• Running a built-in authoritative DNS server that responds to queries with IP addresses of high-reliability nodes
• Automatically banning nodes after repeated connection failures or protocol violations

Setting up a DNS seed requires configuring NS records to delegate the seed subdomain to the operator's server:

# DNS zone configuration
dnsseed.example.com.  IN  NS  vps.example.com.

# Run the seeder
./dnsseed -h dnsseed.example.com -n vps.example.com

Service Bit Filtering

Bitcoin Core supports filtering DNS seed results by node capabilities using a subdomain prefix convention. A hexadecimal prefix encodes the desired service bits:

For example, querying x9.seed.bitcoin.wiz.biz returns only nodes that advertise both full block history and SegWit support. Leading zeros are rejected (e.g., x0009 is invalid) to maximize DNS caching efficiency.

Current DNS Seed Operators

As of 2026, Bitcoin Core's mainnet DNS seeds are operated by the following trusted community members:

Operators must follow the policy documented in doc/dnsseed-policy.md within the Bitcoin Core repository. Violations result in removal: in December 2025, one operator's seed was removed after it was found to be filtering out nodes running newer Bitcoin Core versions.

Alternative Peer Discovery Methods

DNS seeds are one of several peer discovery mechanisms in Bitcoin. The network uses a layered approach so that no single method is a point of failure:

• Hardcoded seed nodes: a static list of IP addresses compiled into the Bitcoin Core binary, used as a last resort if DNS seeds fail to respond within 60 seconds
• Addr message gossip: once connected, peers exchange addr and addrv2 messages containing IP addresses of other known nodes, providing fully decentralized, ongoing peer discovery
• Persistent peer database (peers.dat): nodes store discovered peers on disk so subsequent startups connect to remembered peers without needing DNS seeds at all
• Manual peer addition: operators can use -addnode, -seednode, or -connect flags to specify peers directly, bypassing all automatic discovery

# Connect to specific peers manually
bitcoind -addnode=192.168.1.100:8333

# Use a node only for initial address gathering
bitcoind -seednode=192.168.1.100:8333

# Disable DNS seeding entirely
bitcoind -dnsseed=0 -addnode=192.168.1.100:8333

For a deeper comparison of how different node implementations handle bootstrapping and peer management, see the Bitcoin node implementation comparison.

Use Cases

First-Time Node Bootstrapping

The primary use case for DNS seeds is bootstrapping a brand-new Bitcoin node. Without DNS seeds, a new node would have no way to find peers unless the operator manually configured them. DNS seeds make running a node accessible to anyone: install the software, start it, and the node automatically discovers the network.

Recovery After Network Isolation

If a node's peers.dat file becomes corrupted or all previously known peers go offline, DNS seeds provide a recovery path. The node falls back to DNS seeding and re-establishes connections to the network without manual intervention.

Light Client Bootstrapping

Light clients and SPV wallets also use DNS seeds to find peers. Service bit filtering is particularly useful here: a light client can query for nodes advertising NODE_BLOOM or compact block filter support, connecting only to peers that can serve its specific needs.

Why It Matters

DNS seeds solve a fundamental chicken-and-egg problem in decentralized networks: how do you join a peer-to-peer network when you don't know anyone on it? Without a reliable bootstrapping mechanism, the barrier to running a node would be significantly higher, reducing network participation and potentially weakening Bitcoin's censorship resistance.

The same bootstrapping challenge applies to any peer-to-peer protocol built on Bitcoin. Layer 2 networks like the Lightning Network and protocols like Spark rely on their own peer discovery mechanisms to connect participants. Understanding how DNS seeds work at the base layer provides context for how upper-layer protocols approach the same problem.

Risks and Considerations

DNS Spoofing and Eclipse Attacks

DNS seed queries are standard, unencrypted UDP requests with no authentication. A network-level attacker (or a compromised DNS resolver) could intercept queries and return only attacker-controlled IP addresses. This could enable an eclipse attack where the victim node connects exclusively to malicious peers and receives fabricated blockchain data.

Bitcoin Core mitigates this by querying multiple independent DNS seeds simultaneously, capping each seed at 256 addresses, and using a cryptographically keyed bucketing system in its address manager to prevent deterministic targeting. Anchor connections that persist across restarts further reduce the attack surface.

Centralization Risk

While Bitcoin's peer-to-peer network is decentralized, DNS seeds introduce a mild centralization point. A coordinated attack on a majority of seed operators could theoretically influence which nodes new participants connect to. However, the fallback mechanisms (hardcoded seed nodes, persistent peer database, manual configuration) limit this risk in practice.

The seed operator list itself has changed over time. Operators who violate the published policy or stop maintaining their infrastructure are removed, and new operators can be added through the standard BIP and pull request process.

Privacy Considerations

DNS queries inherently reveal information to the seed operator and any network observer. Querying a Bitcoin DNS seed from a particular IP address signals that a Bitcoin node is starting at that location. Users concerned about privacy can disable DNS seeding with -dnsseed=0 and configure peers manually, or route DNS queries through Tor.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.