Encrypted Resolver Builder

A utility that constructs a DNS resolver which prefers DDR-discovered encrypted endpoints and falls back to configured encrypted transports while honoring custom security settings.

Capabilities

DDR discovery first

• When given a service domain and bootstrap IP, perform DDR discovery and use any encrypted resolver endpoints found to configure the resolver. On success, record that DDR was used. @test

Encrypted fallback order

• If DDR yields no usable endpoints, build the resolver from provided DoH, DoQ, and DoT endpoint lists, selecting the first available transport in the order DoH -> DoQ -> DoT. @test

Enforced encrypted queries

• Resolves A and AAAA records through the configured resolver and rejects plaintext-only configurations with a clear exception. @test

Custom security settings

• Accepts optional TLS/HTTPS settings (e.g., SNI override, CA bundle path, session reuse) and applies them when constructing encrypted transport clients before running queries. @test

Implementation

@generates

API

from typing import Iterable, Optional

class EncryptedResolver:
    def __init__(
        self,
        service_name: str,
        bootstrap_ip: str,
        doh_endpoints: Optional[Iterable[str]] = None,
        doq_endpoints: Optional[Iterable[str]] = None,
        dot_endpoints: Optional[Iterable[str]] = None,
        tls_settings: Optional[dict] = None,
    ): ...

    def refresh(self) -> None:
        """Re-run discovery/configuration using DDR and provided fallbacks."""

    def resolve(self, hostname: str, rrtype: str = "A") -> list[str]:
        """Resolve a hostname using the configured encrypted resolver."""

    @property
    def transport(self) -> str:
        """Current transport label (e.g., 'DDR', 'DoH', 'DoQ', 'DoT')."""

Dependencies { .dependencies }

dnspython { .dependency }

DNS resolution with DDR discovery and encrypted resolver transports.