Skip to content

Add DNS over HTTPS (DoH) support #34

Description

@stephbu

Summary

Implement DNS over HTTPS (DoH) support as specified in RFC 8484, enabling DNS resolution over HTTPS for improved privacy and firewall traversal.

Background

DoH encapsulates DNS queries and responses in HTTPS, providing:

  • Privacy: DNS traffic is encrypted and blends with normal HTTPS traffic
  • Firewall traversal: Works through networks that block traditional DNS (port 53)
  • Integrity: TLS provides authentication and tamper protection

Requirements

Core Features

  • Implement /dns-query endpoint per RFC 8484
  • Support application/dns-message content type (wire format)
  • Handle both GET (base64url-encoded) and POST (binary) methods
  • Return proper HTTP status codes (200 OK, 400 Bad Request, etc.)

Integration

  • Leverage existing HttpServer infrastructure
  • Reuse DnsMessage.TryParse() and WriteToStream() for message handling
  • Share zone resolution logic with UDP/TCP listeners
  • Support configurable endpoint path

Configuration

  • Enable/disable DoH via appsettings.json
  • Configurable HTTPS port (default 443 or 8443)
  • TLS certificate configuration
  • Optional: Support HTTP/2 for performance

Testing

  • Unit tests for DoH message encoding/decoding
  • Integration tests with standard DoH clients (curl, Firefox, Chrome)
  • Performance benchmarks vs UDP queries

References

Priority

P2 - Feature enhancement (per docs/priorities.md)

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions