Glossary / Nodes & software
DNS seed
- Definition
- A DNS seed is a domain name that answers with the IP addresses of reachable Bitcoin nodes, giving a freshly installed node somewhere to make its first connection.
Bitcoin has no directory server, so new software has to find the network by asking. Bitcoin Core ships a short hardcoded list of seed hostnames, resolves them once, opens eight outbound connections on port 8333, and then has no further use for them. Everything after that first handshake is learned from the peers themselves.
How it works
Behind each seed hostname sits a crawler rather than a static file.
The operator runs software that walks the peer-to-peer network, tries to connect to every address it hears about, and records which ones answered recently. The hostname then resolves to A and AAAA records drawn from that pool, a couple of dozen addresses per query, with a short time to live so the answers keep rotating. Some seeds also support filtering by service bits, so a node that needs peers offering compact block filters can ask for a subdomain that only returns those.
The hostnames live in Bitcoin Core's source, in kernel/chainparams.cpp, with a separate list for each network. The mainnet list is maintained by named individuals: seed.bitcoin.sipa.be is run by Pieter Wuille, dnsseed.bluematt.me by Matt Corallo, seed.btc.petertodd.net by Peter Todd. Keeping the list short and attributable is deliberate, because a seed operator chooses who you meet.
On first launch the node resolves those names, fills its address manager, and opens eight full-relay outbound connections plus two block-relay-only connections that carry no transaction gossip and are harder for a watcher to spot. From then on it collects addresses through getaddr and addr messages and caches them in peers.dat, so later restarts skip the lookup entirely. If every seed is unreachable, Core falls back to a list of fixed node addresses compiled into the binary, and you can bypass the whole mechanism with dnsseed=0 plus a seednode or addnode entry pointing at a peer you already trust.
Where you see it
The only time most people notice a DNS seed is in the first few lines of a node's debug log.
Start bitcoind on a machine with no peers.dat and the log records that it is loading addresses from DNS seeds, then the connection count climbs from zero. You can do the same lookup yourself from a terminal with dig, which returns the same rotating set of IP addresses your node would get.
There is a privacy cost worth knowing about. The lookup is an ordinary unencrypted DNS query, so your resolver and your internet provider can see that a bitcoin node is starting on your connection, even though the query reveals nothing about your wallet or your balance. If that bothers you, run the node over Tor or set dnsseed=0 and supply your own first peer.
The trust question is narrower than it looks. A hostile seed cannot forge a block or a transaction, because your node validates everything it receives against its own copy of the rules. What it could do is return only addresses it controls, isolating you from the honest network, which is why Core queries several seeds, spreads its connections across different network ranges, and keeps those block-relay-only links as a quiet second opinion.
DNS seed vs seed phrase
A DNS seed is a public hostname for finding peers; a seed phrase is the 12 or 24 secret words that control your coins. They share a word and nothing else. Nothing about a DNS seed is confidential, nothing about it touches your wallet, and no legitimate setup step will ever ask you to type your recovery words into a network configuration screen.