jcoffey-dev
eb712823f7
NameServer::new created its h3 connection state under the __tls feature instead of __h3, so every build with TLS and without HTTP/3 (ours) warned about an unused variable. hickory's main has the corrected cfg; release/0.26, which this copy comes from, doesn't yet. VENDORED.md records the change so a re-vendor past it drops it. Checked with and without HTTP/3: no warnings either way.
Overview
hickory-resolver is a safe and secure DNS stub resolver library intended to be a high-level library
for DNS record resolution.
It can be configured to use the system resolver configuration and will properly follow CNAME chains as well as SRV record lookups.
Features
- Various IPv4 and IPv6 lookup strategies
/etc/resolv.confbased configuration on Unix/Posix systems- NameServer pools with performance based priority usage
- Caching of query results
- NxDomain/NoData caching (negative caching)
- DNSSEC validation
- Generic Record Type Lookup
- CNAME chain resolution
Cryptography provider
Features requiring cryptography require selecting a specific cryptography provider. See the project README for more information.
Protocol support
The following DNS protocols are optionally supported:
- DNS over TLS (DoT)
- DNS over HTTP/2 (DoH)
- DNS over QUIC (DoQ)
- DNS over HTTP/3 (DoH3)
In order to use these optional protocols you must enable a cargo feature corresponding to your desired cryptography provider:
- DoT:
tls-aws-lc-rsortls-ring. - DoH:
https-aws-lc-rsorhttps-ring - DoQ:
quic-aws-lc-rsorquic-ring - DoH3:
h3-aws-lc-rsorh3-ring
DNSSEC
In order to use DNSSEC you must enable a cargo feature corresponding to your desired cryptography provider:
dnssec-aws-lc-rsdnssec-ring
The current root key is bundled into the system, and used by default. This gives validation of DNSKEY and DS records back to the root. NSEC and NSEC3 are implemented.
Other crate features
system-config(enabled by default) - support using the system recursive resolver configuration.tokio(enabled by default) - support for the Tokio async runtime.serde- enable serde serialization support.toml- enable support for TOML serialization.rustls-platform-verifier(enabled by default) - use the system verifier for TLS with rustls-platform-verifier.webpki-roots- use the webpki-roots crate for TLS certificate verification.metrics- support exposing metrics using themetricscrate.
resolve command line tool
A simple resolve command-line utility that uses hickory-resolver can be installed
to test the crate functionality:
cargo install --bin resolve hickory-util
example
$ resolve www.example.com.
Querying for www.example.com. A from udp:8.8.8.8:53, tcp:8.8.8.8:53, udp:8.8.4.4:53, tcp:8.8.4.4:53, udp:[2001:4860:4860::8888]:53, tcp:[2001:4860:4860::8888]:53, udp:[2001:4860:4860::8844]:53, tcp:[2001:4860:4860::8844]:53
Success for query name: www.example.com. type: A class: IN
www.example.com. 21063 IN A 93.184.215.14