[GH-ISSUE #2255] DNS over HTTPS not working as before? #940

New issue

Closed

opened 2026-03-16 01:02:01 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:02:01 +03:00

Owner

Originally created by @PhantomPlasma0064 on GitHub (Jun 21, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2255

Describe the bug
Hello. I recently discovered a small application I made a while back with trust-dns and decided to update it to use hickory-dns. When I tried to run it, the app stopped working even through all I did was update the dependency. I through it was from my side, but when downgrading to trust-dns, it worked again. I figured there would be no harm in creating an issue about it and minimized it to make it reproducable.

To Reproduce

// [dependencies]
// hickory-resolver = { version = "0.24.1", features = ["dns-over-https-rustls"] }
// tokio = { version = "1.30.0", features = ["full"] }
// trust-dns-resolver = { version = "0.22.0", features = ["dns-over-https-rustls"] }
 
async fn trust_dns() {
    use trust_dns_resolver::{config::{ResolverConfig, ResolverOpts}, TokioAsyncResolver};

    let resolver = TokioAsyncResolver::tokio(
        ResolverConfig::cloudflare_https(),
        ResolverOpts::default()
    ).unwrap();
    let res = resolver.lookup_ip("youtube.com").await;
    println!("Trust Dns:\n{res:?}");
}

async fn hickory_dns() {
    use hickory_resolver::{config::{ResolverConfig, ResolverOpts}, TokioAsyncResolver};

    let resolver = TokioAsyncResolver::tokio(
        ResolverConfig::cloudflare_https(),
        ResolverOpts::default()
    );
    let res = resolver.lookup_ip("youtube.com").await;
    println!("Hickory Dns:\n{res:?}");
}

#[tokio::main]
async fn main() {
    trust_dns().await;
    hickory_dns().await;
}

Expected behavior
Both functions return Ok with the ip(s) of the queried site. Instead shows:

Trust Dns:
Ok(LookupIp(Lookup { query: Query { name: Name("youtube.com"), query_type: A, query_class: IN }, records: [Record { name_labels: Name("youtube.com."), rr_type: A, dns_class: IN, ttl: 204, rdata: Some(A(142.251.37.78)) }], valid_until: Instant { t: 437610.0924707s } }))
Hickory Dns:
Err(ResolveError { kind: Proto(ProtoError { kind: Io(Kind(InvalidData)) }) })

or (mostly)

Ok(LookupIp(Lookup { query: Query { name: Name("youtube.com"), query_type: A, query_class: IN }, records: [Record { name_labels: Name("youtube.com."), rr_type: A, dns_class: IN, ttl: 31, rdata: Some(A(172.217.22.110)) }], valid_until: Instant { t: 438192.7379069s } }))
Hickory Dns:
Err(ResolveError { kind: Proto(ProtoError { kind: Io(Os { code: 10051, kind: NetworkUnreachable, message: "A socket operation was attempted to an unreachable network." }) }) })

System:

OS: Windows 11
Architecture: x86_64
Version 23H2
rustc version: 1.78.0

Version:
Crate: resolver
Version: 0.24.1

Originally created by @PhantomPlasma0064 on GitHub (Jun 21, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2255 **Describe the bug** Hello. I recently discovered a small application I made a while back with trust-dns and decided to update it to use hickory-dns. When I tried to run it, the app stopped working even through all I did was update the dependency. I through it was from my side, but when downgrading to trust-dns, it worked again. I figured there would be no harm in creating an issue about it and minimized it to make it reproducable. **To Reproduce** ```rust // [dependencies] // hickory-resolver = { version = "0.24.1", features = ["dns-over-https-rustls"] } // tokio = { version = "1.30.0", features = ["full"] } // trust-dns-resolver = { version = "0.22.0", features = ["dns-over-https-rustls"] } async fn trust_dns() { use trust_dns_resolver::{config::{ResolverConfig, ResolverOpts}, TokioAsyncResolver}; let resolver = TokioAsyncResolver::tokio( ResolverConfig::cloudflare_https(), ResolverOpts::default() ).unwrap(); let res = resolver.lookup_ip("youtube.com").await; println!("Trust Dns:\n{res:?}"); } async fn hickory_dns() { use hickory_resolver::{config::{ResolverConfig, ResolverOpts}, TokioAsyncResolver}; let resolver = TokioAsyncResolver::tokio( ResolverConfig::cloudflare_https(), ResolverOpts::default() ); let res = resolver.lookup_ip("youtube.com").await; println!("Hickory Dns:\n{res:?}"); } #[tokio::main] async fn main() { trust_dns().await; hickory_dns().await; } ``` **Expected behavior** Both functions return Ok with the ip(s) of the queried site. Instead shows: ``` Trust Dns: Ok(LookupIp(Lookup { query: Query { name: Name("youtube.com"), query_type: A, query_class: IN }, records: [Record { name_labels: Name("youtube.com."), rr_type: A, dns_class: IN, ttl: 204, rdata: Some(A(142.251.37.78)) }], valid_until: Instant { t: 437610.0924707s } })) Hickory Dns: Err(ResolveError { kind: Proto(ProtoError { kind: Io(Kind(InvalidData)) }) }) ``` or (mostly) ``` Ok(LookupIp(Lookup { query: Query { name: Name("youtube.com"), query_type: A, query_class: IN }, records: [Record { name_labels: Name("youtube.com."), rr_type: A, dns_class: IN, ttl: 31, rdata: Some(A(172.217.22.110)) }], valid_until: Instant { t: 438192.7379069s } })) Hickory Dns: Err(ResolveError { kind: Proto(ProtoError { kind: Io(Os { code: 10051, kind: NetworkUnreachable, message: "A socket operation was attempted to an unreachable network." }) }) }) ``` **System:** - OS: Windows 11 - Architecture: x86_64 - Version 23H2 - rustc version: 1.78.0 **Version:** Crate: resolver Version: 0.24.1

kerem closed this issue

2026-03-16 01:02:06 +03:00

kerem commented

2026-03-16 01:02:12 +03:00

Author

Owner

@cpu commented on GitHub (Jun 21, 2024):

Hi @PhantomPlasma0064,

// hickory-resolver = { version = "0.24.1", features = ["dns-over-https-rustls"] }

With hickory-resolver 0.24.x you also need to activate a feature to specify the source of trusted root certificates, like webpki-roots or native-roots.

In 0.25.0-alpha.1 this was made more obvious (see https://github.com/hickory-dns/hickory-dns/pull/2179, https://github.com/hickory-dns/hickory-dns/pull/2181).

Unfortunately with 0.24 it's a subtle issue and folks keep tripping over it (see https://github.com/hickory-dns/hickory-dns/issues/2249, https://github.com/hickory-dns/hickory-dns/issues/2066).

Hope this helps,

@cpu commented on GitHub (Jun 21, 2024): Hi @PhantomPlasma0064, > // hickory-resolver = { version = "0.24.1", features = ["dns-over-https-rustls"] } With hickory-resolver 0.24.x you also need to activate a feature to specify the source of trusted root certificates, like `webpki-roots` or `native-roots`. In `0.25.0-alpha.1` this was made more obvious (see https://github.com/hickory-dns/hickory-dns/pull/2179, https://github.com/hickory-dns/hickory-dns/pull/2181). Unfortunately with 0.24 it's a subtle issue and folks keep tripping over it (see https://github.com/hickory-dns/hickory-dns/issues/2249, https://github.com/hickory-dns/hickory-dns/issues/2066). Hope this helps,

kerem commented

2026-03-16 01:02:17 +03:00

Author

Owner

@PhantomPlasma0064 commented on GitHub (Jun 21, 2024):

With hickory-resolver 0.24.x you also need to activate a feature to specify the source of trusted root certificates, like webpki-roots or native-roots.

It worked! Thank you very much!

@PhantomPlasma0064 commented on GitHub (Jun 21, 2024): > With hickory-resolver 0.24.x you also need to activate a feature to specify the source of trusted root certificates, like webpki-roots or native-roots. It worked! Thank you very much!

kerem referenced this issue

2026-03-16 02:26:26 +03:00

[PR #940] [CLOSED] Bump tokio from 0.2.0-alpha.6 to 0.2.2 #1805