Feature request: support tls/https for dns resolver #357

New Issue

saavagebueno · 2025-11-20T04:23:06-05:00

saavagebueno commented

2025-11-20 04:23:06 -05:00

Originally created by @qdm12 on GitHub (Feb 2, 2024).

In internal/resolver/resolver.go

Ideally use github.com/qdm12/dns when v2 is out

Originally created by @qdm12 on GitHub (Feb 2, 2024). In `internal/resolver/resolver.go` Ideally use `github.com/qdm12/dns` when v2 is out

saavagebueno added the Category: Good idea 🎯Status: 🔒 After next release labels 2025-11-20 04:23:06 -05:00

saavagebueno commented

2025-11-20 04:23:06 -05:00

@danielfreer commented on GitHub (Apr 8, 2025):

This feature will help when using UniFi Ad-Blocking feature and with split-dns (again using UniFi DNS).

Right now I have local DNS records for my domain set up in UniFi DNS to point to local addresses:

$ dig microbot.invalid +noall +answer
microbot.invalid.	0	IN	A	192.0.2.5

And public DNS records set up in Cloudflare:

$ dig @1.1.1.1 microbot.invalid +noall +answer
microbot.invalid.	281	IN	A	198.51.100.5

So I need to use RESOLVER_ADDRESS: "1.1.1.1:53" in order to correctly resolve the current public DNS address.

But when UniFi Ad-Blocking is enabled, it hijacks any plain DNS query and redirects it to it's internal DNS: https://help.ui.com/hc/en-us/articles/9794438523799-UniFi-Gateway-Ad-Blocking

Note: Clients using custom DNS servers are redirected to use the UniFi Gateway DNS server when Ad Blocking is enabled.

So now queries to Cloudflare get hijacked and return local addresses:

$ dig @1.1.1.1 microbot.invalid +noall +answer
microbot.invalid.	0	IN	A	192.0.2.5

Clearly there are workarounds on my end to resolve this issue, but being able to resolve DoH should help too (from above UniFi help article):

Limitations
Some client-specific privacy or DNS features may prevent ads from being blocked.

These include:

Encrypted DNS (DoH / DoT).

@danielfreer commented on GitHub (Apr 8, 2025): This feature will help when using UniFi Ad-Blocking feature and with split-dns (again using UniFi DNS). Right now I have local DNS records for my domain set up in UniFi DNS to point to local addresses: ``` $ dig microbot.invalid +noall +answer microbot.invalid. 0 IN A 192.0.2.5 ``` And public DNS records set up in Cloudflare: ``` $ dig @1.1.1.1 microbot.invalid +noall +answer microbot.invalid. 281 IN A 198.51.100.5 ``` So I need to use `RESOLVER_ADDRESS: "1.1.1.1:53"` in order to correctly resolve the current public DNS address. But when UniFi Ad-Blocking is enabled, it hijacks any plain DNS query and redirects it to it's internal DNS: https://help.ui.com/hc/en-us/articles/9794438523799-UniFi-Gateway-Ad-Blocking > Note: Clients using custom DNS servers are redirected to use the UniFi Gateway DNS server when Ad Blocking is enabled. So now queries to Cloudflare get hijacked and return local addresses: ``` $ dig @1.1.1.1 microbot.invalid +noall +answer microbot.invalid. 0 IN A 192.0.2.5 ``` Clearly there are workarounds on my end to resolve this issue, but being able to resolve DoH should help too (from above UniFi help article): > Limitations > Some client-specific privacy or DNS features may prevent ads from being blocked. > > These include: > > Encrypted DNS (DoH / DoT).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#357