feat(dns): skip DNS lookups for AutoTLS hostnames (#11140)
* feat(dns): resolve libp2p.direct addresses locally without network I/O p2p-forge hostnames encode IP addresses directly (e.g., 1-2-3-4.peerID.libp2p.direct -> 1.2.3.4), so DNS queries are wasteful. kubo now parses these IPs in-memory. - applies to both default libp2p.direct and custom AutoTLS.DomainSuffix - TXT queries still delegate to network for ACME DNS-01 compatibility - https://github.com/ipfs/kubo/pull/11140#discussion_r2683477754 use fallback to network DNS instead of returning errors when local parsing fails, ensuring forward compatibility with future DNS records - https://github.com/ipfs/kubo/pull/11140#discussion_r2683512408 add peerID validation using peer.Decode(), matching libp2p.direct server behavior, with fallback on invalid peerID - https://github.com/ipfs/kubo/pull/11140#discussion_r2683521930 document interaction with DNS.Resolvers in config.md - https://github.com/ipfs/kubo/pull/11140#discussion_r2683526647 add AutoTLS.SkipDNSLookup config flag to disable local resolution (useful for debugging or custom DNS override scenarios) - https://github.com/ipfs/kubo/pull/11140#discussion_r2683533462 add E2E test verifying libp2p.direct resolves locally even when DNS.Resolvers points to a broken server additional improvements: - use madns.BasicResolver interface instead of custom basicResolver - add compile-time interface checks for p2pForgeResolver and madns.Resolver - refactor tests: merge IPv4/IPv6, add helpers, use config.DefaultDomainSuffix - improve changelog to explain public good benefit (reducing DNS load) Fixes #11136
Marcin Rataj committed
Jan 30, 2026 at 17:20 UTC
7de7af082076313705691bda7fc178dc7415f0c7
7 files changed
+502
-2
config/autotls.go
+8
@@ -16,6 +16,13 @@ type AutoTLS struct {
16
// Optional, controls if Kubo should add /tls/sni/.../ws listener to every /tcp port if no explicit /ws is defined in Addresses.Swarm
17
AutoWSS Flag `json:",omitempty"`
18
19
+ // Optional, controls whether to skip network DNS lookups for p2p-forge domains.
20
+ // Applies to resolution via DNS.Resolvers, including /dns* multiaddrs in go-libp2p.
21
+ // When enabled (default), A/AAAA queries for *.libp2p.direct are resolved
22
+ // locally by parsing the IP directly from the hostname, avoiding network I/O.
23
+ // Set to false to always use network DNS (useful for debugging).
24
+ SkipDNSLookup Flag `json:",omitempty"`
25
+
26
// Optional override of the parent domain that will be used
27
DomainSuffix *OptionalString `json:",omitempty"`
28
@@ -42,5 +49,6 @@ const (
49
DefaultCAEndpoint = p2pforge.DefaultCAEndpoint
50
DefaultAutoWSS = true // requires AutoTLS.Enabled
51
DefaultAutoTLSShortAddrs = true // requires AutoTLS.Enabled
52
+ DefaultAutoTLSSkipDNSLookup = true // skip network DNS for p2p-forge domains
53
DefaultAutoTLSRegistrationDelay = 1 * time.Hour
54
)
core/node/dns.go
+34
-1
@@ -10,6 +10,10 @@ import (
10
madns "github.com/multiformats/go-multiaddr-dns"
11
)
12
13
+// Compile-time interface check: *madns.Resolver (returned by gateway.NewDNSResolver
14
+// and madns.NewResolver) must implement madns.BasicResolver for p2pForgeResolver fallback.
15
+var _ madns.BasicResolver = (*madns.Resolver)(nil)
16
+
17
func DNSResolver(cfg *config.Config) (*madns.Resolver, error) {
18
var dohOpts []doh.Option
19
if !cfg.DNS.MaxCacheTTL.IsDefault() {
@@ -19,5 +23,34 @@ func DNSResolver(cfg *config.Config) (*madns.Resolver, error) {
23
// Replace "auto" DNS resolver placeholders with autoconf values
24
resolvers := cfg.DNSResolversWithAutoConf()
25
22
- return gateway.NewDNSResolver(resolvers, dohOpts...)
26
+ // Get base resolver from boxo (handles custom DoH resolvers per eTLD)
27
+ baseResolver, err := gateway.NewDNSResolver(resolvers, dohOpts...)
28
+ if err != nil {
29
+ return nil, err
30
+ }
31
+
32
+ // Check if we should skip network DNS lookups for p2p-forge domains
33
+ skipAutoTLSDNS := cfg.AutoTLS.SkipDNSLookup.WithDefault(config.DefaultAutoTLSSkipDNSLookup)
34
+ if !skipAutoTLSDNS {
35
+ // Local resolution disabled, use network DNS for everything
36
+ return baseResolver, nil
37
+ }
38
+
39
+ // Build list of p2p-forge domains to resolve locally without network I/O.
40
+ // AutoTLS hostnames encode IP addresses directly (e.g., 1-2-3-4.peerID.libp2p.direct),
41
+ // so DNS lookups are wasteful. We resolve these in-memory when possible.
42
+ forgeDomains := []string{config.DefaultDomainSuffix}
43
+ customDomain := cfg.AutoTLS.DomainSuffix.WithDefault(config.DefaultDomainSuffix)
44
+ if customDomain != config.DefaultDomainSuffix {
45
+ forgeDomains = append(forgeDomains, customDomain)
46
+ }
47
+ forgeResolver := NewP2PForgeResolver(forgeDomains, baseResolver)
48
+
49
+ // Register p2p-forge resolver for each domain, fallback to baseResolver for others
50
+ opts := []madns.Option{madns.WithDefaultResolver(baseResolver)}
51
+ for _, domain := range forgeDomains {
52
+ opts = append(opts, madns.WithDomainResolver(domain+".", forgeResolver))
53
+ }
54
+
55
+ return madns.NewResolver(opts...)
56
}
core/node/p2pforge_resolver.go
new
+120
@@ -0,0 +1,120 @@
1
+package node
2
+
3
+import (
4
+ "context"
5
+ "net"
6
+ "net/netip"
7
+ "strings"
8
+
9
+ "github.com/libp2p/go-libp2p/core/peer"
10
+ madns "github.com/multiformats/go-multiaddr-dns"
11
+)
12
+
13
+// p2pForgeResolver implements madns.BasicResolver for deterministic resolution
14
+// of p2p-forge domains (e.g., *.libp2p.direct) without network I/O for A/AAAA queries.
15
+//
16
+// p2p-forge encodes IP addresses in DNS hostnames:
17
+// - IPv4: 1-2-3-4.peerID.libp2p.direct -> 1.2.3.4
18
+// - IPv6: 2001-db8--1.peerID.libp2p.direct -> 2001:db8::1
19
+//
20
+// When local parsing fails (invalid format, invalid peerID, etc.), the resolver
21
+// falls back to network DNS. This ensures future <peerID>.libp2p.direct records
22
+// can still resolve if the authoritative DNS adds support for them.
23
+//
24
+// TXT queries always delegate to the fallback resolver. This is important for
25
+// p2p-forge/client ACME DNS-01 challenges to work correctly, as Let's Encrypt
26
+// needs to verify TXT records at _acme-challenge.peerID.libp2p.direct.
27
+//
28
+// See: https://github.com/ipshipyard/p2p-forge
29
+type p2pForgeResolver struct {
30
+ suffixes []string
31
+ fallback madns.BasicResolver
32
+}
33
+
34
+// Compile-time check that p2pForgeResolver implements madns.BasicResolver.
35
+var _ madns.BasicResolver = (*p2pForgeResolver)(nil)
36
+
37
+// NewP2PForgeResolver creates a resolver for the given p2p-forge domain suffixes.
38
+// Each suffix should be a bare domain like "libp2p.direct" (without leading dot).
39
+// When local IP parsing fails, queries fall back to the provided resolver.
40
+// TXT queries always delegate to the fallback resolver for ACME compatibility.
41
+func NewP2PForgeResolver(suffixes []string, fallback madns.BasicResolver) *p2pForgeResolver {
42
+ normalized := make([]string, len(suffixes))
43
+ for i, s := range suffixes {
44
+ normalized[i] = strings.ToLower(strings.TrimSuffix(s, "."))
45
+ }
46
+ return &p2pForgeResolver{suffixes: normalized, fallback: fallback}
47
+}
48
+
49
+// LookupIPAddr parses IP addresses encoded in the hostname.
50
+//
51
+// Format: <encoded-ip>.<peerID>.<suffix>
52
+// - IPv4: 192-168-1-1.peerID.libp2p.direct -> [192.168.1.1]
53
+// - IPv6: 2001-db8--1.peerID.libp2p.direct -> [2001:db8::1]
54
+//
55
+// If the hostname doesn't match the expected format (wrong suffix, invalid peerID,
56
+// invalid IP encoding, or peerID-only), the lookup falls back to network DNS.
57
+// This allows future DNS records like <peerID>.libp2p.direct to resolve normally.
58
+func (r *p2pForgeResolver) LookupIPAddr(ctx context.Context, hostname string) ([]net.IPAddr, error) {
59
+ // DNS is case-insensitive, normalize to lowercase
60
+ hostname = strings.ToLower(strings.TrimSuffix(hostname, "."))
61
+
62
+ // find matching suffix and extract subdomain
63
+ var subdomain string
64
+ for _, suffix := range r.suffixes {
65
+ if sub, found := strings.CutSuffix(hostname, "."+suffix); found {
66
+ subdomain = sub
67
+ break
68
+ }
69
+ }
70
+ if subdomain == "" {
71
+ // not a p2p-forge domain, fallback to network
72
+ return r.fallback.LookupIPAddr(ctx, hostname)
73
+ }
74
+
75
+ // split subdomain into parts: should be [ip-prefix, peerID]
76
+ parts := strings.Split(subdomain, ".")
77
+ if len(parts) != 2 {
78
+ // not the expected <ip>.<peerID> format, fallback to network
79
+ return r.fallback.LookupIPAddr(ctx, hostname)
80
+ }
81
+
82
+ encodedIP := parts[0]
83
+ peerIDStr := parts[1]
84
+
85
+ // validate peerID (same validation as libp2p.direct DNS server)
86
+ if _, err := peer.Decode(peerIDStr); err != nil {
87
+ // invalid peerID, fallback to network
88
+ return r.fallback.LookupIPAddr(ctx, hostname)
89
+ }
90
+
91
+ // RFC 1123: hostname labels cannot start or end with hyphen
92
+ if len(encodedIP) == 0 || encodedIP[0] == '-' || encodedIP[len(encodedIP)-1] == '-' {
93
+ // invalid hostname label, fallback to network
94
+ return r.fallback.LookupIPAddr(ctx, hostname)
95
+ }
96
+
97
+ // try parsing as IPv4 first: segments joined by "-" become "."
98
+ segments := strings.Split(encodedIP, "-")
99
+ if len(segments) == 4 {
100
+ ipv4Str := strings.Join(segments, ".")
101
+ if ip, err := netip.ParseAddr(ipv4Str); err == nil && ip.Is4() {
102
+ return []net.IPAddr{{IP: ip.AsSlice()}}, nil
103
+ }
104
+ }
105
+
106
+ // try parsing as IPv6: segments joined by "-" become ":"
107
+ ipv6Str := strings.Join(segments, ":")
108
+ if ip, err := netip.ParseAddr(ipv6Str); err == nil && ip.Is6() {
109
+ return []net.IPAddr{{IP: ip.AsSlice()}}, nil
110
+ }
111
+
112
+ // IP parsing failed, fallback to network
113
+ return r.fallback.LookupIPAddr(ctx, hostname)
114
+}
115
+
116
+// LookupTXT delegates to the fallback resolver to support ACME DNS-01 challenges
117
+// and any other TXT record lookups on p2p-forge domains.
118
+func (r *p2pForgeResolver) LookupTXT(ctx context.Context, hostname string) ([]string, error) {
119
+ return r.fallback.LookupTXT(ctx, hostname)
120
+}
core/node/p2pforge_resolver_test.go
new
+172
@@ -0,0 +1,172 @@
1
+package node
2
+
3
+import (
4
+ "context"
5
+ "errors"
6
+ "net"
7
+ "testing"
8
+
9
+ "github.com/ipfs/kubo/config"
10
+ "github.com/stretchr/testify/assert"
11
+ "github.com/stretchr/testify/require"
12
+)
13
+
14
+// Test constants matching p2p-forge production format
15
+const (
16
+ // testPeerID is a valid peerID in CIDv1 base36 format as used by p2p-forge.
17
+ // Base36 is lowercase-only, making it safe for case-insensitive DNS.
18
+ // Corresponds to 12D3KooWDpJ7As7BWAwRMfu1VU2WCqNjvq387JEYKDBj4kx6nXTN in base58btc.
19
+ testPeerID = "k51qzi5uqu5dhnwe629wdlncpql6frppdpwnz4wtlcw816aysd5wwlk63g4wmh"
20
+
21
+ // domainSuffix is the default p2p-forge domain used in tests.
22
+ domainSuffix = config.DefaultDomainSuffix
23
+)
24
+
25
+// mockResolver implements madns.BasicResolver for testing
26
+type mockResolver struct {
27
+ txtRecords map[string][]string
28
+ ipRecords map[string][]net.IPAddr
29
+ ipErr error
30
+}
31
+
32
+func (m *mockResolver) LookupIPAddr(_ context.Context, hostname string) ([]net.IPAddr, error) {
33
+ if m.ipErr != nil {
34
+ return nil, m.ipErr
35
+ }
36
+ if m.ipRecords != nil {
37
+ return m.ipRecords[hostname], nil
38
+ }
39
+ return nil, nil
40
+}
41
+
42
+func (m *mockResolver) LookupTXT(_ context.Context, name string) ([]string, error) {
43
+ if m.txtRecords != nil {
44
+ return m.txtRecords[name], nil
45
+ }
46
+ return nil, nil
47
+}
48
+
49
+// newTestResolver creates a p2pForgeResolver with default suffix.
50
+func newTestResolver(t *testing.T) *p2pForgeResolver {
51
+ t.Helper()
52
+ return NewP2PForgeResolver([]string{domainSuffix}, &mockResolver{})
53
+}
54
+
55
+// assertLookupIP verifies that hostname resolves to wantIP.
56
+func assertLookupIP(t *testing.T, r *p2pForgeResolver, hostname, wantIP string) {
57
+ t.Helper()
58
+ addrs, err := r.LookupIPAddr(t.Context(), hostname)
59
+ require.NoError(t, err)
60
+ require.Len(t, addrs, 1)
61
+ assert.Equal(t, wantIP, addrs[0].IP.String())
62
+}
63
+
64
+func TestP2PForgeResolver_LookupIPAddr(t *testing.T) {
65
+ r := newTestResolver(t)
66
+
67
+ tests := []struct {
68
+ name string
69
+ hostname string
70
+ wantIP string
71
+ }{
72
+ // IPv4
73
+ {"ipv4/basic", "192-168-1-1." + testPeerID + "." + domainSuffix, "192.168.1.1"},
74
+ {"ipv4/zeros", "0-0-0-0." + testPeerID + "." + domainSuffix, "0.0.0.0"},
75
+ {"ipv4/max", "255-255-255-255." + testPeerID + "." + domainSuffix, "255.255.255.255"},
76
+ {"ipv4/trailing dot", "10-0-0-1." + testPeerID + "." + domainSuffix + ".", "10.0.0.1"},
77
+ {"ipv4/uppercase suffix", "192-168-1-1." + testPeerID + ".LIBP2P.DIRECT", "192.168.1.1"},
78
+ // IPv6
79
+ {"ipv6/full", "2001-db8-0-0-0-0-0-1." + testPeerID + "." + domainSuffix, "2001:db8::1"},
80
+ {"ipv6/compressed", "2001-db8--1." + testPeerID + "." + domainSuffix, "2001:db8::1"},
81
+ {"ipv6/loopback", "0--1." + testPeerID + "." + domainSuffix, "::1"},
82
+ {"ipv6/all zeros", "0--0." + testPeerID + "." + domainSuffix, "::"},
83
+ }
84
+
85
+ for _, tt := range tests {
86
+ t.Run(tt.name, func(t *testing.T) {
87
+ assertLookupIP(t, r, tt.hostname, tt.wantIP)
88
+ })
89
+ }
90
+}
91
+
92
+func TestP2PForgeResolver_LookupIPAddr_MultipleSuffixes(t *testing.T) {
93
+ r := NewP2PForgeResolver([]string{domainSuffix, "custom.example.com"}, &mockResolver{})
94
+
95
+ tests := []struct {
96
+ hostname string
97
+ wantIP string
98
+ }{
99
+ {"192-168-1-1." + testPeerID + "." + domainSuffix, "192.168.1.1"},
100
+ {"10-0-0-1." + testPeerID + ".custom.example.com", "10.0.0.1"},
101
+ }
102
+
103
+ for _, tt := range tests {
104
+ t.Run(tt.hostname, func(t *testing.T) {
105
+ assertLookupIP(t, r, tt.hostname, tt.wantIP)
106
+ })
107
+ }
108
+}
109
+
110
+func TestP2PForgeResolver_LookupIPAddr_FallbackToNetwork(t *testing.T) {
111
+ fallbackIP := []net.IPAddr{{IP: net.ParseIP("93.184.216.34")}}
112
+
113
+ tests := []struct {
114
+ name string
115
+ hostname string
116
+ }{
117
+ {"peerID only", testPeerID + "." + domainSuffix},
118
+ {"invalid peerID", "192-168-1-1.invalid-peer-id." + domainSuffix},
119
+ {"invalid IP encoding", "not-an-ip." + testPeerID + "." + domainSuffix},
120
+ {"leading hyphen", "-192-168-1-1." + testPeerID + "." + domainSuffix},
121
+ {"too many parts", "extra.192-168-1-1." + testPeerID + "." + domainSuffix},
122
+ {"wrong suffix", "192-168-1-1." + testPeerID + ".example.com"},
123
+ }
124
+
125
+ // Build fallback records from test cases
126
+ ipRecords := make(map[string][]net.IPAddr, len(tests))
127
+ for _, tt := range tests {
128
+ ipRecords[tt.hostname] = fallbackIP
129
+ }
130
+ fallback := &mockResolver{ipRecords: ipRecords}
131
+ r := NewP2PForgeResolver([]string{domainSuffix}, fallback)
132
+
133
+ for _, tt := range tests {
134
+ t.Run(tt.name, func(t *testing.T) {
135
+ addrs, err := r.LookupIPAddr(t.Context(), tt.hostname)
136
+ require.NoError(t, err)
137
+ require.Len(t, addrs, 1, "should fallback to network")
138
+ assert.Equal(t, "93.184.216.34", addrs[0].IP.String())
139
+ })
140
+ }
141
+}
142
+
143
+func TestP2PForgeResolver_LookupIPAddr_FallbackError(t *testing.T) {
144
+ expectedErr := errors.New("network error")
145
+ r := NewP2PForgeResolver([]string{domainSuffix}, &mockResolver{ipErr: expectedErr})
146
+
147
+ // peerID-only triggers fallback, which returns error
148
+ _, err := r.LookupIPAddr(t.Context(), testPeerID+"."+domainSuffix)
149
+ require.ErrorIs(t, err, expectedErr)
150
+}
151
+
152
+func TestP2PForgeResolver_LookupTXT(t *testing.T) {
153
+ t.Run("delegates to fallback for ACME DNS-01", func(t *testing.T) {
154
+ acmeHost := "_acme-challenge." + testPeerID + "." + domainSuffix
155
+ fallback := &mockResolver{
156
+ txtRecords: map[string][]string{acmeHost: {"acme-token-value"}},
157
+ }
158
+ r := NewP2PForgeResolver([]string{domainSuffix}, fallback)
159
+
160
+ records, err := r.LookupTXT(t.Context(), acmeHost)
161
+ require.NoError(t, err)
162
+ assert.Equal(t, []string{"acme-token-value"}, records)
163
+ })
164
+
165
+ t.Run("returns empty when fallback has no records", func(t *testing.T) {
166
+ r := NewP2PForgeResolver([]string{domainSuffix}, &mockResolver{})
167
+
168
+ records, err := r.LookupTXT(t.Context(), "anything."+domainSuffix)
169
+ require.NoError(t, err)
170
+ assert.Empty(t, records)
171
+ })
172
+}
docs/changelogs/v0.40.md
+7
@@ -19,6 +19,7 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
19
- [Improved `ipfs dag stat` output](#improved-ipfs-dag-stat-output)
20
- [Skip bad keys when listing](#skip_bad_keys_when_listing)
21
- [Accelerated DHT Client and Provide Sweep now work together](#accelerated-dht-client-and-provide-sweep-now-work-together)
22
+ - [🌐 No unnecessary DNS lookups for AutoTLS addresses](#-no-unnecessary-dns-lookups-for-autotls-addresses)
23
- [⏱️ Configurable gateway request duration limit](#️-configurable-gateway-request-duration-limit)
24
- [🔧 Recovery from corrupted MFS root](#-recovery-from-corrupted-mfs-root)
25
- [📋 Long listing format for `ipfs ls`](#-long-listing-format-for-ipfs-ls)
@@ -118,6 +119,12 @@ Change the `ipfs key list` behavior to log an error and continue listing keys wh
119
120
Previously, provide operations could start before the Accelerated DHT Client discovered enough peers, causing sweep mode to lose its efficiency benefits. Now, providing waits for the initial network crawl (about 10 minutes). Your content will be properly distributed across DHT regions after initial DHT map is created. Check `ipfs provide stat` to see when providing begins.
121
122
+#### 🌐 No unnecessary DNS lookups for AutoTLS addresses
123
+
124
+Kubo no longer makes DNS queries for [AutoTLS](https://blog.libp2p.io/autotls/) addresses like `1-2-3-4.peerid.libp2p.direct`. Since the IP is encoded in the hostname (`1-2-3-4` means `1.2.3.4`), Kubo extracts it locally. This reduces load on the public good DNS servers at `libp2p.direct` run by [Shipyard](https://ipshipyard.com), reserving them for web browsers which lack direct DNS access and must rely on the browser's resolver.
125
+
126
+To disable, set [`AutoTLS.SkipDNSLookup`](https://github.com/ipfs/kubo/blob/master/docs/config.md#autotlsskipdnslookup) to `false`.
127
+
128
#### ⏱️ Configurable gateway request duration limit
129
130
[`Gateway.MaxRequestDuration`](https://github.com/ipfs/kubo/blob/master/docs/config.md#gatewaymaxrequestduration) sets an absolute deadline for gateway requests. Unlike `RetrievalTimeout` (which resets on each data write and catches stalled transfers), this is a hard limit on the total time a request can take.
docs/config.md
+18
-1
@@ -779,6 +779,22 @@ Default: `true`
779
780
Type: `flag`
781
782
+### `AutoTLS.SkipDNSLookup`
783
+
784
+Optional. Controls whether to skip network DNS lookups for [p2p-forge] domains like `*.libp2p.direct`.
785
+
786
+This applies to DNS resolution performed via [`DNS.Resolvers`](#dnsresolvers), including `/dns*` multiaddrs resolved by go-libp2p (e.g., peer addresses from DHT or delegated routing).
787
+
788
+When enabled (default), A/AAAA queries for hostnames matching [`AutoTLS.DomainSuffix`](#autotlsdomainsuffix) are resolved locally by parsing the IP address directly from the hostname (e.g., `1-2-3-4.peerID.libp2p.direct` resolves to `1.2.3.4` without network I/O). This avoids unnecessary DNS queries since the IP is already encoded in the hostname.
789
+
790
+If the hostname format is invalid (wrong peerID, malformed IP encoding), the resolver falls back to network DNS, ensuring forward compatibility with potential future DNS record types.
791
+
792
+Set to `false` to always use network DNS for these domains. This is primarily useful for debugging or if you need to override resolution behavior via [`DNS.Resolvers`](#dnsresolvers).
793
+
794
+Default: `true`
795
+
796
+Type: `flag`
797
+
798
### `AutoTLS.DomainSuffix`
799
800
Optional override of the parent domain suffix that will be used in DNS+TLS+WebSockets multiaddrs generated by [p2p-forge] client.
@@ -3489,7 +3505,7 @@ Please remove this option from your config.
3505
3506
## `DNS`
3507
3492
-Options for configuring DNS resolution for [DNSLink](https://docs.ipfs.tech/concepts/dnslink/) and `/dns*` [Multiaddrs][libp2p-multiaddrs].
3508
+Options for configuring DNS resolution for [DNSLink](https://docs.ipfs.tech/concepts/dnslink/) and `/dns*` [Multiaddrs][libp2p-multiaddrs] (including peer addresses discovered via DHT or delegated routing).
3509
3510
### `DNS.Resolvers`
3511
@@ -3519,6 +3535,7 @@ Be mindful that:
3535
- The default catch-all resolver is the cleartext one provided by your operating system. It can be overridden by adding a DoH entry for the DNS root indicated by `.` as illustrated above.
3536
- Out-of-the-box support for selected non-ICANN TLDs relies on third-party centralized services provided by respective communities on best-effort basis.
3537
- The special value `"auto"` uses DNS resolvers from [AutoConf](#autoconf) when enabled. For example: `{".": "auto"}` uses any custom DoH resolver (global or per TLD) provided by AutoConf system.
3538
+- When [`AutoTLS.SkipDNSLookup`](#autotlsskipdnslookup) is enabled (default), domains matching [`AutoTLS.DomainSuffix`](#autotlsdomainsuffix) (default: `libp2p.direct`) are resolved locally by parsing the IP directly from the hostname. Set `AutoTLS.SkipDNSLookup=false` to force network DNS lookups for these domains.
3539
3540
Default: `{".": "auto"}`
3541
test/cli/dns_resolvers_multiaddr_test.go
new
+143
@@ -0,0 +1,143 @@
1
+package cli
2
+
3
+import (
4
+ "strings"
5
+ "testing"
6
+ "time"
7
+
8
+ "github.com/ipfs/kubo/config"
9
+ "github.com/ipfs/kubo/test/cli/harness"
10
+ "github.com/stretchr/testify/assert"
11
+ "github.com/stretchr/testify/require"
12
+)
13
+
14
+// testDomainSuffix is the default p2p-forge domain used in tests
15
+const testDomainSuffix = config.DefaultDomainSuffix // libp2p.direct
16
+
17
+// TestDNSResolversApplyToMultiaddr is a regression test for:
18
+// https://github.com/ipfs/kubo/issues/9199
19
+//
20
+// It verifies that DNS.Resolvers config is used when resolving /dnsaddr,
21
+// /dns, /dns4, /dns6 multiaddrs during peer connections, not just for
22
+// DNSLink resolution.
23
+func TestDNSResolversApplyToMultiaddr(t *testing.T) {
24
+ t.Parallel()
25
+
26
+ t.Run("invalid DoH resolver causes multiaddr resolution to fail", func(t *testing.T) {
27
+ t.Parallel()
28
+
29
+ node := harness.NewT(t).NewNode().Init("--profile=test")
30
+
31
+ // Set an invalid DoH resolver that will fail when used.
32
+ // If DNS.Resolvers is properly wired to multiaddr resolution,
33
+ // swarm connect to a /dnsaddr will fail with an error mentioning
34
+ // the invalid resolver URL.
35
+ invalidResolver := "https://invalid.broken.resolver.test/dns-query"
36
+ node.SetIPFSConfig("DNS.Resolvers", map[string]string{
37
+ ".": invalidResolver,
38
+ })
39
+
40
+ // Clear bootstrap peers to prevent background connection attempts
41
+ node.SetIPFSConfig("Bootstrap", []string{})
42
+
43
+ node.StartDaemon()
44
+ defer node.StopDaemon()
45
+
46
+ // Give daemon time to fully start
47
+ time.Sleep(2 * time.Second)
48
+
49
+ // Verify daemon is responsive
50
+ result := node.RunIPFS("id")
51
+ require.Equal(t, 0, result.ExitCode(), "daemon should be responsive")
52
+
53
+ // Try to connect to a /dnsaddr peer - this should fail because
54
+ // the DNS.Resolvers config points to an invalid DoH server
55
+ result = node.RunIPFS("swarm", "connect", "/dnsaddr/bootstrap.libp2p.io")
56
+
57
+ // The connection should fail
58
+ require.NotEqual(t, 0, result.ExitCode(),
59
+ "swarm connect should fail when DNS.Resolvers points to invalid DoH server")
60
+
61
+ // The error should mention the invalid resolver, proving DNS.Resolvers
62
+ // is being used for multiaddr resolution
63
+ stderr := result.Stderr.String()
64
+ assert.True(t,
65
+ strings.Contains(stderr, "invalid.broken.resolver.test") ||
66
+ strings.Contains(stderr, "no such host") ||
67
+ strings.Contains(stderr, "lookup") ||
68
+ strings.Contains(stderr, "dial"),
69
+ "error should indicate DNS resolution failure using custom resolver. got: %s", stderr)
70
+ })
71
+
72
+ t.Run("libp2p.direct resolves locally even with broken DNS.Resolvers", func(t *testing.T) {
73
+ t.Parallel()
74
+
75
+ h := harness.NewT(t)
76
+ nodes := h.NewNodes(2).Init("--profile=test")
77
+
78
+ // Configure node0 with a broken DNS resolver
79
+ // This would break all DNS resolution if libp2p.direct wasn't resolved locally
80
+ invalidResolver := "https://invalid.broken.resolver.test/dns-query"
81
+ nodes[0].SetIPFSConfig("DNS.Resolvers", map[string]string{
82
+ ".": invalidResolver,
83
+ })
84
+
85
+ // Clear bootstrap peers on both nodes
86
+ for _, n := range nodes {
87
+ n.SetIPFSConfig("Bootstrap", []string{})
88
+ }
89
+
90
+ nodes.StartDaemons()
91
+ defer nodes.StopDaemons()
92
+
93
+ // Get node1's peer ID in base36 format (what p2p-forge uses in DNS hostnames)
94
+ // DNS is case-insensitive, and base36 is lowercase-only, making it ideal for DNS
95
+ idResult := nodes[1].RunIPFS("id", "--peerid-base", "base36", "-f", "<id>")
96
+ require.Equal(t, 0, idResult.ExitCode())
97
+ node1IDBase36 := strings.TrimSpace(idResult.Stdout.String())
98
+ node1ID := nodes[1].PeerID().String()
99
+ node1Addrs := nodes[1].SwarmAddrs()
100
+
101
+ // Find a TCP address we can use
102
+ var tcpAddr string
103
+ for _, addr := range node1Addrs {
104
+ addrStr := addr.String()
105
+ if strings.Contains(addrStr, "/tcp/") && strings.Contains(addrStr, "/ip4/127.0.0.1") {
106
+ tcpAddr = addrStr
107
+ break
108
+ }
109
+ }
110
+ require.NotEmpty(t, tcpAddr, "node1 should have a local TCP address")
111
+
112
+ // Extract port from address like /ip4/127.0.0.1/tcp/12345/...
113
+ parts := strings.Split(tcpAddr, "/")
114
+ var port string
115
+ for i, p := range parts {
116
+ if p == "tcp" && i+1 < len(parts) {
117
+ port = parts[i+1]
118
+ break
119
+ }
120
+ }
121
+ require.NotEmpty(t, port, "should find TCP port in address")
122
+
123
+ // Construct a libp2p.direct hostname that encodes 127.0.0.1
124
+ // Format: /dns4/<ip-encoded>.<peerID-base36>.libp2p.direct/tcp/<port>/p2p/<peerID>
125
+ // p2p-forge uses base36 peerIDs in DNS hostnames (lowercase, DNS-safe)
126
+ libp2pDirectAddr := "/dns4/127-0-0-1." + node1IDBase36 + "." + testDomainSuffix + "/tcp/" + port + "/p2p/" + node1ID
127
+
128
+ // This connection should succeed because libp2p.direct is resolved locally
129
+ // even though DNS.Resolvers points to a broken server
130
+ result := nodes[0].RunIPFS("swarm", "connect", libp2pDirectAddr)
131
+
132
+ // The connection should succeed - local resolution bypasses broken DNS
133
+ assert.Equal(t, 0, result.ExitCode(),
134
+ "swarm connect to libp2p.direct should succeed with local resolution. stderr: %s",
135
+ result.Stderr.String())
136
+
137
+ // Verify the connection was actually established
138
+ result = nodes[0].RunIPFS("swarm", "peers")
139
+ require.Equal(t, 0, result.ExitCode())
140
+ assert.Contains(t, result.Stdout.String(), node1ID,
141
+ "node0 should be connected to node1")
142
+ })
143
+}