The DNS Resolution System resolves domain names to IP addresses with ALG (Application Level Gateway) translation, multi-transport support, request coalescing, TTL-based caching, and blocklist enforcement. It intercepts DNS queries from applications, applies policy-based routing, and synthesizes fake IP addresses for split-tunneling and per-app proxy selection.
Key features:
100.64.x.x, 64:ff9b:1:da19::x) for proxy routing decisions. intra/dnsx/alg.go63-67 intra/dnsx/alg.go70-76core.Barrier. intra/dnsx/cacher.go104 intra/dnsx/cacher.go139-140RdnsResolver and DNSListener. intra/dnsx/transport.go169-175 intra/backend/dnsx_listener.go126-139For network handler integration, see Protocol Handlers (TCP/UDP/ICMP). For proxy selection, see Proxy Management System.
| Page | Title | What It Covers |
|---|---|---|
| 2.1 | DNS Gateway and ALG System | dnsgateway struct, Gateway interface, ALG/NAT/PTR maps, IP address translation, fake IP generation, DNS64/NAT64 integration. |
| 2.2 | DNS Transport Implementations | DoH, DoT, DNS53, DNSCrypt, ODoH, mDNS, and Go system resolvers; ECH support, connection pooling, and proxy integration. |
| 2.3 | DNS Caching System | ctransport wrapper, 128-bucket sharded store, request coalescing via core.Barrier, TTL bumping, and periodic scrubbing. |
| 2.4 | IP Address Management and DNS Integration | IPMapper, IPSet types, hostname-to-IP resolution, health tracking, and reverse lookup via IP trees. |
The DNS resolution system consists of four major layers: the Resolver core that manages transports and routes queries, the Gateway (ALG) layer that performs IP translation, the transport layer with caching, and the RDNS blocklist integration.
The following diagram maps high-level system components to their corresponding entities in the dnsx package.
Sources:
The resolver struct implements the Resolver interface and serves as the central orchestrator. It maintains a registry of transports and routes queries based on policy preferences determined by the DNSListener.
The resolver manages internal state including fake DNS endpoints (dnsaddrs), the ALG gateway, and blocklist resolvers (rdnsl, rdnsr).
Sources:
| Method | Purpose | File Reference |
|---|---|---|
NewResolver() | Initializes the resolver with default transports and gateway. | intra/dnsx/transport.go221-240 |
Add() | Adds a new transport to the registry, wrapping it with ctransport. | intra/dnsx/transport.go306-318 |
Serve() | Entry point for handling DNS queries from network connections. | intra/dnsx/transport.go726-735 |
Gateway() | Returns the ALG gateway instance. | intra/dnsx/transport.go185-186 |
MDNS() | Returns the mDNS transport for local service discovery. | intra/dnsx/transport.go187-188 |
For details, see DNS Gateway and ALG System.
The dnsgateway performs bidirectional mapping between real IPs and synthetic ALG IPs. This is critical for split-tunneling where the system must identify which application or proxy should handle a specific IP range.
The gateway uses tracking maps to manage translations:
xips and expaddr structs. intra/dnsx/alg.go210-221 intra/dnsx/alg.go132-136translate method. intra/dnsx/alg.go101-102Sources:
For details, see DNS Transport Implementations.
The system supports a variety of protocols, each wrapped in a common Transport interface.
| Transport Type | Code Entity | Purpose |
|---|---|---|
| DoH | doh.NewTransport | DNS over HTTPS (POST/GET) |
| DNS53 | dns53.NewTransportFromHostname | Standard UDP/TCP DNS |
| DNSCrypt | dnscrypt.NewDcMult | Multi-server DNSCrypt |
| ODoH | doh.NewOdohTransport | Oblivious DoH |
| mDNS | dns53.NewMDNSTransport | Local service discovery |
| Plus | dnsx.NewPlusTransport | Hybrid multi-transport orchestrator |
The plus transport specifically provides a robust failover mechanism, cycling through available transports like Default, System, and Preferred based on user-defined strategies (e.g., PlusOrderFastest). intra/dnsx/plus.go146-206 It uses a core.Barrier for ordered transport selection. intra/dnsx/plus.go62
Sources:
For details, see DNS Caching System.
The ctransport layer provides high-performance caching and request deduplication. It sits between the resolver and the actual network transports.
defbuckets) to reduce lock contention. intra/dnsx/cacher.go37 intra/dnsx/cacher.go98reqbarrier (a core.Barrier). intra/dnsx/cacher.go139-140halflife up to a maximum number of bumps. intra/dnsx/cacher.go246-258scrubCache. intra/dnsx/cacher.go207-234Sources:
For details, see IP Address Management and DNS Integration.
The IPMapper bridges the gap between the DNS resolution layer and the network stack's dialers.
SetSystemDNS. intra/dns.go56-92Sources:
Refresh this wiki