Add AliDNS and Rethink DNS to the resolver fan-out#14
Merged
Conversation
Two more browser-callable DoH operators bring real operator/region diversity to the propagation check and the import-from-DNS feature: - AliDNS — anycast (CN-based, Alibaba). JSON DoH at https://dns.alidns.com/resolve, CORS \`*\`. Useful as a fleet separate from the US-led majors. - Rethink DNS — anycast (IN-based, Bangalore). JSON DoH at https://basic.rethinkdns.com/dns-query, CORS \`*\`. Independent fleet on Cloudflare Workers infra but visibly different cache behavior in practice. Both verified by probing CORS preflight, JSON shape, and a live example.com query before adding. CSP \`connect-src\` (prod and dev) extended with the two hostnames; nothing else added to the allowlist. European operators still aren't reachable from the browser — every EU resolver tested (Mullvad, dns0.eu, DNS4EU, Switch.ch, Applied Privacy, DNSforge, FFmuc, Wikimedia, DNS.WATCH, Restena, njal.la, CZ.NIC, fdn.fr) refuses CORS on both JSON and wireformat. Reaching them from a browser would require a self-hosted CORS proxy, which breaks the no-backend rule we set up front. Total operators now: 5 (Cloudflare US, Google US, DNS.SB SG, AliDNS CN, Rethink IN). 116 tests still green, 0 audit findings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
crhaglun
approved these changes
May 7, 2026
crhaglun
pushed a commit
that referenced
this pull request
May 8, 2026
Add AliDNS and Rethink DNS to the resolver fan-out
crhaglun
pushed a commit
that referenced
this pull request
May 8, 2026
Add AliDNS and Rethink DNS to the resolver fan-out
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two new browser-callable DoH operators added to `DEFAULT_RESOLVERS`:
Both verified by hand-probing the CORS preflight, JSON shape, and a live `example.com` query before adding. CSP `connect-src` extended with the two new hostnames in both prod and dev policies.
Why these two
After probing ~50 candidate DoH endpoints (15+ EU operators, 10 Asian, half a dozen US alternatives), only AliDNS and Rethink passed both gates a browser needs:
Total operator count is now 5 (Cloudflare US, Google US, DNS.SB SG, AliDNS CN, Rethink IN).
Why not European operators
Every European resolver tested (Mullvad SE, dns0.eu, DNS4EU, Switch.ch, Applied Privacy AT, DNSforge DE, FFmuc DE, Wikimedia NL, DNS.WATCH DE, Restena LU, njal.la SE, CZ.NIC, fdn.fr) refuses CORS on both JSON and wireformat endpoints. Operator-level decision; protocol version doesn't matter. Reaching them would require a self-hosted CORS proxy, which we ruled out (no-backend rule).
Test plan
🤖 Generated with Claude Code