Encrypted DNS Resolver
Trigger: Use when implementing DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), or DNSCrypt support.
Key Libraries
- Rust:
hickory-resolver(built-in DoH/DoT),rustls,tokio-rustls,dns-over-https - Python:
dnspython(DoH support in v2.x)
Implementation
- Multiplexed upstream connections via
hickory-resolverwith TLS client config - Round-robin across multiple DoH providers (Cloudflare, Quad9, NextDNS, custom)
- Automatic fallback: DoH → DoT → plain UDP with configurable timeout cascade
- Connection pooling with
tokio— reuse TLS sessions for multiple queries - DNSSEC validation chain verification (RRSIG/DS/DNSKEY)
Connected Skills
dns-adblock-engine, dns-cache-layer, url-content-filter, traffic-shaper
Pitfalls
- DoH over HTTP/2 requires h2 crate or hyper with h2 feature
- TLS certificate pinning essential to prevent MITM on upstream DNS
- DNSSEC validation adds ~30% latency — make configurable per-domain