starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 11:15:54 +03:00

[GH-ISSUE #1707] Option to use different hostnames for different nameservers. #741

New issue

Closed

opened 2026-03-16 00:05:30 +03:00 by kerem · 7 comments

kerem commented

2026-03-16 00:05:30 +03:00

Owner

Originally created by @kevincox on GitHub (May 12, 2022).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1707

Is your feature request related to a problem? Please describe.
Right now you can only provide one TlsClientConfig for all of your nameservers. But for example if you want to allow failover between to different hosts (for example Cloudflare and Google) there is no single correct value to use.

Describe the solution you'd like
It should be possible to have a different TlsClientConfig per host used for DNS.

Originally created by @kevincox on GitHub (May 12, 2022). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1707 **Is your feature request related to a problem? Please describe.** Right now you can only provide one `TlsClientConfig` for all of your nameservers. But for example if you want to allow failover between to different hosts (for example Cloudflare and Google) there is no single correct value to use. **Describe the solution you'd like** It should be possible to have a different `TlsClientConfig` per host used for DNS.

kerem

2026-03-16 00:05:30 +03:00

closed this issue
added the
enhance

feature:dns-over-tls
labels

kerem commented

2026-03-16 00:05:46 +03:00

Author

Owner

@bluejekyll commented on GitHub (May 12, 2022):

When you say "there is no single correct value to use", what do you mean exactly? The default TlsClientConfig should work for both of them?

@bluejekyll commented on GitHub (May 12, 2022): When you say "there is no single correct value to use", what do you mean exactly? The default TlsClientConfig should work for both of them?

kerem commented

2026-03-16 00:05:52 +03:00

Author

Owner

@djc commented on GitHub (May 12, 2022):

(In other words: can you talk more about the problem you're running into/the use case you have for this, rather than talking about a proposed solution?)

@djc commented on GitHub (May 12, 2022): (In other words: can you talk more about the problem you're running into/the use case you have for this, rather than talking about a proposed solution?)

kerem commented

2026-03-16 00:05:57 +03:00

Author

Owner

@bluejekyll commented on GitHub (May 12, 2022):

Thanks, @djc, my questions came off a little short.

Overall, I don’t mind a feature like this, I’m just trying to figure out what the use cases are that we’d be trying to account for.

@bluejekyll commented on GitHub (May 12, 2022): Thanks, @djc, my questions came off a little short. Overall, I don’t mind a feature like this, I’m just trying to figure out what the use cases are that we’d be trying to account for.

kerem commented

2026-03-16 00:06:02 +03:00

Author

Owner

@djc commented on GitHub (May 12, 2022):

Didn't mean to suggest your quetsions came off short -- I think they're good suggestions. I just think it's generally useful to bring back reports like these back to the actual issue to avoid XY problems.

@djc commented on GitHub (May 12, 2022): Didn't mean to suggest your quetsions came off short -- I think they're good suggestions. I just think it's generally useful to bring back reports like these back to the actual issue to avoid [XY problems](https://en.wikipedia.org/wiki/XY_problem).

kerem commented

2026-03-16 00:06:07 +03:00

Author

Owner

@kevincox commented on GitHub (May 13, 2022):

I'll try to rephrase. For redundancy I would like to use two resolvers in my app. For example Google and Cloudflare using DoH. However these have different DNS domains to validate against. For Google I need to use dns.google and for Cloudflare I need to use cloudflare-dns.com. However the constructor only allows me to provide a single hostname for all resolver IPs as far as I can tell.

What I would like to say is: Use 8.8.8.8 and 8.8.4.4 with the dns.google hostname in addition to 1.1.1.1 and 1.0.0.1 with the cloudflare-dns.com hostname.

A slightly weaker solution would be to provide multiple valid hostnames which would be effectively the same since you trust those two certs anyways.

@kevincox commented on GitHub (May 13, 2022): I'll try to rephrase. For redundancy I would like to use two resolvers in my app. For example Google and Cloudflare using DoH. However these have different DNS domains to validate against. For Google I need to use `dns.google` and for Cloudflare I need to use `cloudflare-dns.com`. However the constructor only allows me to provide a single hostname for all resolver IPs as far as I can tell. What I would like to say is: Use `8.8.8.8` and `8.8.4.4` with the `dns.google` hostname in addition to `1.1.1.1` and `1.0.0.1` with the `cloudflare-dns.com` hostname. A slightly weaker solution would be to provide multiple valid hostnames which would be effectively the same since you trust those two certs anyways.

kerem commented

2026-03-16 00:06:12 +03:00

Author

Owner

@bluejekyll commented on GitHub (May 13, 2022):

Can you point to which constructor you mean? We should clean up the docs in this area, but each should get it's own NameServerConfig and those should have the associated tls_dns_name, and can optionally carry a tls_config. You can see examples for the default configuration for cloudflare here: github.com/bluejekyll/trust-dns@df82c60b34/crates/resolver/src/config.rs (L598-L609)

Once you have the google and cloudflare ones created they can be combined with a NameServerPool to perform queries against both.

@bluejekyll commented on GitHub (May 13, 2022): Can you point to which constructor you mean? We should clean up the docs in this area, but each should get it's own `NameServerConfig` and those should have the associated `tls_dns_name`, and can optionally carry a `tls_config`. You can see examples for the default configuration for cloudflare here: https://github.com/bluejekyll/trust-dns/blob/df82c60b341115e5b9117959cd022d5172461377/crates/resolver/src/config.rs#L598-L609 Once you have the google and cloudflare ones created they can be combined with a `NameServerPool` to perform queries against both.

kerem commented

2026-03-16 00:06:17 +03:00

Author

Owner

@kevincox commented on GitHub (May 13, 2022):

Oh, this is just user error. I was getting confused with trust_dns_resolver::config::NameServerConfigGroup and the fact that trust_dns_resolver::config::ResolverConfig::from_parts() takes an Into<NameServerConfigGroup>. I also thought that the TlsClientConfig isn't actually what held the domain name to validate against. I missed that you can use trust_dns_resolver::config::ResolverConfig::add_name_server() to then add extra trust_dns_resolver::config::NameServerConfigs. It is a bit awkward if you want to use the built-in helpers but for using Google and Cloudflare like the example the following code appears to work. You can also add arbitrary resolvers by creating your own NameServerConfig.

let mut dns_cfg = trust_dns_resolver::config::ResolverConfig::cloudflare_https();
for ns in trust_dns_resolver::config::NameServerConfigGroup::google_https().to_vec() {
	dns_cfg.add_name_server(ns);
}

Hope this helps someone equally confused in the future.

@kevincox commented on GitHub (May 13, 2022): Oh, this is just user error. I was getting confused with [`trust_dns_resolver::config::NameServerConfigGroup`](https://docs.rs/trust-dns-resolver/0.21.2/trust_dns_resolver/config/struct.NameServerConfigGroup.html#method.google_https) and the fact that [`trust_dns_resolver::config::ResolverConfig::from_parts()`](https://docs.rs/trust-dns-resolver/0.21.2/trust_dns_resolver/config/struct.ResolverConfig.html#method.from_parts) takes an `Into<NameServerConfigGroup>`. I also thought that the `TlsClientConfig` isn't actually what held the domain name to validate against. I missed that you can use [`trust_dns_resolver::config::ResolverConfig::add_name_server()`](https://docs.rs/trust-dns-resolver/0.21.2/trust_dns_resolver/config/struct.ResolverConfig.html#method.add_name_server) to then add extra [`trust_dns_resolver::config::NameServerConfig`s](https://docs.rs/trust-dns-resolver/0.21.2/trust_dns_resolver/config/struct.NameServerConfig.html). It is a bit awkward if you want to use the built-in helpers but for using Google and Cloudflare like the example the following code appears to work. You can also add arbitrary resolvers by creating your own `NameServerConfig`. ```rust let mut dns_cfg = trust_dns_resolver::config::ResolverConfig::cloudflare_https(); for ns in trust_dns_resolver::config::NameServerConfigGroup::google_https().to_vec() { dns_cfg.add_name_server(ns); } ``` Hope this helps someone equally confused in the future.

kerem referenced this issue

2026-03-16 02:17:36 +03:00

[PR #741] [MERGED] Bump backtrace from 0.3.14 to 0.3.15 #1645