Pdns: newServer should support upstream DNS over TLS

[wiesl]

• Program: dnsdist
• Issue type: Feature request

Short description

dnsdist should support upstream DNS over TLS servers like 1.1.1.1 (including persistent connections)

[ahupowerdns]

wiesl, will you be contributing this? I think you "should".

[wiesl]

sorry, can't contribute this.

[jpmens]

@wiesl if you have spent some time with the developers chatting on IRC about the possibility or desire to have this feature added, and you have talked to them politely and have carefully explained the reasons for wanting this feature, then I think the way in which you've submitted this issue (as a kind of "reminder" to them about your discussion) is acceptable.

In all other cases it is not acceptable, unless you are willing to pay for the feature to be implemented.

The word _should_ is very demanding. I cannot imagine the developers, who after all give you access to this Open Source free of charge, and who spend countless hours, nay days, doing this (trust me, I really know), want to hear that word in conjunction with a feature request you haven't otherwise explained or justified.

[johnhtodd]

I also believe that this functionality would be useful, and consistent with dnsdist's model. We would be willing to contribute funds towards development if there was any willingness and ability to take this effort forward.

[wbranderson]

I would also like to see this feature implemented. I have yet to look at the code, so I do not know if I could be of any use in contributing development time and effort, but--like @johnhtodd--would be willing to contribute funding if there's interest in moving this forward.

[ahupowerdns]

hi @wbranderson - could you contact me on bert.[email protected]? Thanks!

[wbranderson]

hi @wbranderson - could you contact me on bert.[email protected]? Thanks!

Email sent, @ahupowerdns.

Speaking to a topic that @jpmens raised back when this issue was originally posted: what I'd like to be able to do is to run a dnsdist instance as a load balancing frontend to a pool of unbound resolver instances that provide DNS-over-TLS service both to clients and upstream.

(Each unbound resolver is paired--via stunnel--with an instance of nsd that answers queries only on localhost, but that is out of scope for purposes of this discussion.)

Since the dnsdist instance and the unbound instances will necessarily run on different hosts, I'd prefer to use DNS-over-TLS between dnsdist and the unbound instances since 1) the traffic between dnsdist and clients will be secured with TLS and 2) the traffic between the unbound instances and the upstream DNS servers (CloudFlare, etc.) will also be secured with TLS.

When I set up dnsdist to provide DNS-over-TLS and forward queries to unbound resolvers in a test environment, I was only able to successfully configure dnsdist to receive a client query via DNS-over-TLS, extract the plaintext query, and send the plaintext query via TCP to the DNS-over-TLS listening port of each unbound instance. As can be expected, the unbound instances reset the TCP connection upon receipt of the non-TLS communication.

If it helps, dnsdist and each unbound instance are using the same cert/key pair. If an option exists in the current dnsdist framework that allows me to achieve my desired configuration, I am all ears. :+1: If not, I hope this explanation of my use case helps clarify why I seconded the feature request for upstream DNS-over-TLS to be implemented.

[tcely]

dnsdist between stub clients and unbound is also my current use case.