0028: ibexwall-dns is a forwarding stub on hickory 0.26
Este conteúdo não está disponível em sua língua ainda.
ADR-0028: ibexwall-dns is a forwarding stub on hickory 0.26
Section titled “ADR-0028: ibexwall-dns is a forwarding stub on hickory 0.26”Status: accepted (spike S3-a, 2026-11-02). Phase: F3.
Context
Section titled “Context”The spec asks for a local resolver on 127.0.0.153:53 that blocks by list,
intercepts the browser DoH canary, counts without logging, and forwards
everything else over an encrypted upstream (spec section 4.8; hickory
support for DoH, DoT, DoQ, DoH3 and DNSSEC to be verified).
Options
Section titled “Options”- Recursive resolver (hickory recursor): no third party sees the query, but the product promise is encrypted DNS to a chosen provider, latency and load are worse, and it needs root hints and DNSSEC to be safe.
- Forwarding stub on
hickory-serverwith a customRequestHandlerandhickory-resolveras the upstream client (chosen). - Embed dnsmasq or unbound: smaller code, but a second process to supervise, no encrypted upstream in dnsmasq, and C code in the path.
Decision
Section titled “Decision”Option 2. Findings from the spike (hickory 0.26.3, crates.io, 2026-09-10,
ring backend, MIT OR Apache-2.0):
- A custom
RequestHandlergets the query, answers locally (NXDOMAIN, or0.0.0.0and::) or forwards, and relays upstream NXDOMAIN and NODATA faithfully. Covered bycrates/ibexwall-dns/tests/forward.rs. - Upstreams are addressed by IP plus the certificate name, so no DNS is needed to reach the upstream (fixed bootstrap).
- Real providers, from the development host: Cloudflare answered over DoT, DoH and DoH3 (warm 7 to 10 ms) and timed out over DoQ; Quad9 answered over all four (warm about 50 ms from this network). The DoQ failure is expected for a provider that does not offer DoQ; presets must list only transports the provider documents.
- A failed upstream takes about 15 s to give up on QUIC despite the 3 s option; the stub must cap its own wait and answer SERVFAIL (follow-up in M1 hardening).
- DNSSEC validation is a separate feature (
dnssec-ring); it stays off in the MVP and is not compiled in until an ADR enables it. - Trust anchors come from
webpki-roots(CDLA-Permissive-2.0, added todeny.toml), so reaching the upstream does not depend on the host trust store.
Consequences
Section titled “Consequences”- No query names are logged; only per-category counters exist.
- The handler is
Clone(shared state inArc) so the daemon can swap the policy and read counters while the server runs. - Provider facts (logging, jurisdiction, transports) must be verified from the provider’s own documentation before a preset ships.