From c78b2b9d2706bed215a3106d78c0174bd722cc77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Sj=C3=B6beck?= <fredrik@rukkor.com>
Date: Mon, 4 May 2026 09:35:42 +0200
Subject: [PATCH] Add AliDNS and Rethink DNS to the resolver fan-out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two more browser-callable DoH operators bring real operator/region
diversity to the propagation check and the import-from-DNS feature:

- AliDNS — anycast (CN-based, Alibaba). JSON DoH at
  https://dns.alidns.com/resolve, CORS \`*\`. Useful as a fleet
  separate from the US-led majors.
- Rethink DNS — anycast (IN-based, Bangalore). JSON DoH at
  https://basic.rethinkdns.com/dns-query, CORS \`*\`. Independent
  fleet on Cloudflare Workers infra but visibly different cache
  behavior in practice.

Both verified by probing CORS preflight, JSON shape, and a live
example.com query before adding. CSP \`connect-src\` (prod and dev)
extended with the two hostnames; nothing else added to the
allowlist.

European operators still aren't reachable from the browser — every
EU resolver tested (Mullvad, dns0.eu, DNS4EU, Switch.ch, Applied
Privacy, DNSforge, FFmuc, Wikimedia, DNS.WATCH, Restena, njal.la,
CZ.NIC, fdn.fr) refuses CORS on both JSON and wireformat. Reaching
them from a browser would require a self-hosted CORS proxy, which
breaks the no-backend rule we set up front.

Total operators now: 5 (Cloudflare US, Google US, DNS.SB SG,
AliDNS CN, Rethink IN). 116 tests still green, 0 audit findings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/dns/resolvers.ts | 16 ++++++++++++++++
 vite.config.ts       |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/src/dns/resolvers.ts b/src/dns/resolvers.ts
index 19a7f3e..90a9378 100644
--- a/src/dns/resolvers.ts
+++ b/src/dns/resolvers.ts
@@ -28,10 +28,26 @@ export const DEFAULT_RESOLVERS: DohResolver[] = [
     url: (n, t) => `https://doh.dns.sb/dns-query?name=${encodeURIComponent(n)}&type=${encodeURIComponent(t)}`,
     acceptHeader: "application/dns-json",
   },
+  {
+    id: "alidns",
+    name: "AliDNS",
+    region: "Anycast (CN)",
+    url: (n, t) => `https://dns.alidns.com/resolve?name=${encodeURIComponent(n)}&type=${encodeURIComponent(t)}`,
+    acceptHeader: "application/dns-json",
+  },
+  {
+    id: "rethink",
+    name: "Rethink DNS",
+    region: "Anycast (IN)",
+    url: (n, t) => `https://basic.rethinkdns.com/dns-query?name=${encodeURIComponent(n)}&type=${encodeURIComponent(t)}`,
+    acceptHeader: "application/dns-json",
+  },
 ];
 
 export const RESOLVER_HOSTS = [
   "https://cloudflare-dns.com",
   "https://dns.google",
   "https://doh.dns.sb",
+  "https://dns.alidns.com",
+  "https://basic.rethinkdns.com",
 ] as const;
diff --git a/vite.config.ts b/vite.config.ts
index 392cf01..18922ed 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -5,6 +5,8 @@ const RESOLVER_HOSTS = [
   "https://cloudflare-dns.com",
   "https://dns.google",
   "https://doh.dns.sb",
+  "https://dns.alidns.com",
+  "https://basic.rethinkdns.com",
 ].join(" ");
 
 const API_HOSTS = ["https://api.github.com"].join(" ");