dns Documentation

Go library by @celzero focused on dns-library, dnssec, go. Includes documentation and AI agent context with 8.8k stars.

8,777 stars Go Go 1 file · ~5,159 tokens #dns#dns-library#dnssec#go
RAW Doc

1. Project Overview & Quickstart (celzero/dns)

dns

DNS library in Go

Repository Details

  • Repository: celzero/dns
  • GitHub Stars: ⭐ 8,679
  • Primary Language: Go

Note: High-volume repository documentation is actively indexed and synchronized by YakaAI.

2. Official Technical Reference & Guides (celzero/docs)

File: README.md

RethinkDNS + Firewall Documentation

API, Manual, Tutorial for RethinkDNS + Firewall

Docusaurus

Contributing

Preview contributions

This repository is setup to deploy a preview of changes made in any branch to GitHub pages (except gh-pages branch).

When you make a fork of this repository and make changes on GitHub, you are usually prompted to commit to a new branch patch-* branch, where * is a number. Making such commits allows you to preview your changes before you send a pull request.

To use this functionality:

  1. Head over to Actions tab of your fork repository and Confirm that you want to use Actions, if asked.
  2. Now goto Settings tab of your fork repository and scroll down to find Github Pages. Change the Source from 'None' to 'gh-pages' and click Save.
  3. Now if you make any changes and commit, a GitHub action will be triggered, which you can see in the Actions tab, when it completes successfully, you can see the preview of the changes you made at https://.github.io/docs/ where `` is your GitHub username.

File: docs/firewall/introduction.md

title: Rethink Firewall

slug: /firewall

RethinkDNS comes with a companion Firewall app for Android, that lets you monitor and control Internet access to apps installed on your device.

The app lets you view searchable network log per connection; reveals apps that were blocked and when; Reveals apps that are connected to where and when.

It also lets you block individual IPs.

You would be able to set rules such as, block apps by category, block when app is in the background, block an app when device is locked, or block an app forever.

RethinkDNS Firewall when configured DNS, you can analyse DNS requests in real-time and read through aggregated reports in the App logs. And it also helps evade Internet censorship as enforced in most countries.

Goto RethinkDNS.com to download.

File: docs/firewall/orbot.md

title: Orbot Integration

RethinkDNS comes with an option to configure Orbot (Tor) to be used along with the RethinkDNS as a Proxy server to change the IP address.

Configurations Steps

Manual Method

  1. Start Orbot (do not start it in the VPN mode).
  2. Notice what Orbot says against "SOCKS5" and "HTTP" fields on its home-screen. Those are port numbers.
  3. Open the RethinkDNS app; Start it and goto Settings.
  4. Enable HTTP Proxy and enter the HTTP port number (as seen in Orbot), if you want just the browsers to use Orbot's Tor bridge.
  5. Enable SOCKS5 (TCP) Proxy and enter the port number (from step 2), choose App (as Orbot), optionally enable Block all UDP traffic except DNS to stop leaking UDP (WhatsApp calls, Zoom, Chromecast may stop working; Orbot doesn't support UDP).
  6. Note: The IP address field to be set in RethinkDNS is 127.0.0.1 for both those proxies (for Orbot).
  7. Visit dnsleaktest.com. It shouldn't be able to tell where you're from and not be able to show your actual IP.

Automatic Method

Starting from Version 0.53c, we have introduced one click setup

  1. To use that Open RethinkDNS app and go to Settings Tab by clicking Gear Icon at the bottom menu.

  2. In settings, you will find Setup Orbot in VPN & Proxy section, click on it.

  3. Now, you will be presented with a drawer at bottom, where you will find options to setup Orbot as per your liking (HTTP Proxy, TCP-Only Proxy, TCP + HTTP Proxy and None).

  4. Select the one you like and click on the Orbot icon at top of the drawer to open Orbot app and then start Orbot (tor network). Once you see 100% you are good to go.

File: docs/dns/introduction.md

title: Rethink DNS

slug: /dns

RethinkDNS is DNS Resolver Service with custom rules and blocklists. A DNS resolver is an address book of the internet-- it helps locate IP addresses of the servers given a domain name. For example, dns.google.com (a domain name) is located at 8.8.8.8 (IP address). This mapping is retrieved by a DNS resolver.

You can configure RethinkDNS in the companion firewall app or even in your own device / internet browser that supports Secure DNS (aka DNS over HTTPS). See below on how to configure.

RethinkDNS is private, secure, and fast DNS resolver and has 190+ pre-defined blacklists for you to configure.

With our paid plans (coming soon), you'll also be able to define your own custom blocklists that can be configured with RethinkDNS. The paid plan will also allow you to store you dns logs and view analytics, all in the cloud. You will be able to analyse your DNS requests and read through aggregated reports.

RethinkDNS is highly-available with servers in over 200+ locations across the globe for fast DNS resolution.

How To Configure DNS {#how-to}

A custom DNS resolver can be configured here: rethinkdns.com/configure. This will give a DNS resolver address that looks something like https://basic.bravedns.com/1:YASAAQBwIAA= according to blocklists or rules that you selected. This address can then be used as your DNS resolver in your device or browser.

Configure blocklists on the Companion Firewall App

  1. Open RethinkDNS on your Android Smartphone
  2. Click START to start the RethinkDNS resolver and Firewall, once it starts up properly, you'll see a 'PROTECTED' status below it.
  3. Now tap on 'CONFIGURE' in the DNS section, which will open up a page that will allow you to set your DNS resolver. By default, it is set to RethinkDNS Basic, which blocks a set of few malware and trackers. But, you can add your own custom DNS or choose the pre-defined ones.
  4. To configure blocklists, choose RethinkDNS Plus and tap on 'CONFIGURE' button below it, this will open up the rethinkDNS configuration page. Here, you can select a set of blocklists with 'Simple View' or tap on 'Advanced View' to select Individual blocklists.
  5. After you select your desired blocklists, tap on 'Done' at the bottom bar. This will close the configuration page and the selected blocklists will be automatically configured withe app. You will see an android toast message Configured URL has been updated successfully to confirm this.
  6. You have successfully configured RethinkDNS with blocklists in the companion firewall app.

File: docs/dns/open-source.md

title: Open Source

The free and open source RethinkDNS Resolver is serverless and supports protocols: DNS over HTTPS (DoH) & DNS over TLS (DoT). It can be configured with custom blocklists. And can be hosted on cloudflare, fly.io or deno-deploy. Source code is made available at github.com/serverless-dns/serverless-dns.

Hosting your own DNS Resolver {#hosting}

This serverless DNS can be hosted to three platforms: Cloudflare, Deno-Deploy and Fly.io. Easiest way would be to use Cloudflare. The below table summarizes the platforms available.

Platform Difficulty Resolver Protocol Instructions
⛅ Cloudflare Easy DoH Read Instructions
🦕 Deno Deploy Moderate DoH Read Instructions
🪂 Fly.io Hard DoH and DoT Read Instructions

Using Cloudflare {#cloudflare}

Rethink serverless can be hosted to cloudflare. User will be liable for cloudflare billing. Click the button below to deploy.

  • Configure

    • Once the hosting is successful, lets consider rethink serverless dns is hosted
      to example.com.
    • To configure your dns level blocking visit to example.com/configure which
      will take to configuration page, which currently contains 191 blocklists with
      ~13.5 Million blockable domains in category like notracking, dating, gambling,
      privacy, porn, cryptojacking, security ...
    • Navigate through and select your blocklists.
    • Once selected you can find your domain name example.com followed by
      configuration token on screen like this https://example.com/1:AIAA7g== copy
      it and add to your dns DOH client.
    • Now your own trusted dns resolver with custom blocking is up and running.

  • Change Resolver

    • By default dns request are resolved by cloudflare cloudflare-dns.com.
    • To change resolver login to your cloudflare dash board
      • click on worker
      • click on serverless-dns worker
      • click on Settings tab
      • under Environment Variables click on Edit variables
      • if your new DOH resolver url is example.dns.resolver.com/dns-query/resolve
      • change below variables and click on save button
        CF_DNS_RESOLVER_URL = example.dns.resolver.com/dns-query/resolve
      • alternatively, you can modify your CF_DNS_RESOLVER_URL in your forked serverless-dns repo. Head to src/core/env.js and modify either your CF_DNS_RESOLVER_URL or CF_DNS_RESOLVER_URL_2 DNS server

Using Deno-Deploy {#deno-deploy}

This project can be hosted on deno.com/deploy and supports DoH only. User will be liable for deno.com billing.

  1. Fork the serverless-dns repository (requires a GitHub account).
  2. In the repository you just forked, click on the Actions tab and Confirm that you want to use Actions, if prompted.
  3. Now, navigate to deno.com/deploy and Sign Up for an account.
  4. Create a new project via the deno dashboard by just clicking on the New Project button.
  5. Select your forked repository from the list of repositories that appear. If your GitHub username does not show up, click on + Add GitHub Account and install the Deno Deploy GitHub App with the necessary permissions.
  6. Once you select your forked repository, input boxes for project configuration show up. You need to do two things here; enter deno task prepare in the Build Step, and select src/server-deno.ts in Entrypoint field.
  7. Click on the Deploy Project button.
  8. Once your project is successfully deployed, you will see "Success!" page with a URL to your deployment that looks like https://.deno.dev. If you found any issues, reach out to us over on GitHub.
  9. Optionally, if you need to configure environment variables, you can do so in the project settings page that you can access either by clicking on the Add environment variables link shown in the "Success!" page, or by navigating to https://dash.deno.com/projects//settings#environment-variables.

Using Fly.io {#fly-io}

This project can be hosted on fly.io, and can support both DoT and DoH protocols. User will be liable for fly.io billing.

  1. Install flyctl on your device (ref).
  2. Signup and/or login to fly.io (ref).
  3. Create an empty directory anywhere on your PC. Open you terminal or powershell and navigate to this directory.
  4. Launch a fly app
    bash
    flyctl launch
    • Choose a unique name here or let it auto-generate.
    • Choose a location (the closer to your users, the better).
    • Note down the name of the app and you may delete this directory along with the generated fly.toml.
  5. Now, you would need a SSL or TLS certificate for your domain name. Both getting a domain name and CA certificate generation are beyond the scope of this README. Let's Encrypt and ZeroSSL vend public certs for free, valid for a maximum of 90 days.
  6. Once you have your CA certificate and key files, you need to encode them as base64 with no wrapping. How this can be done in bash terminal is shown below.
    bash
    # Locate your CA certificate & key files
CRT="path/to/full-chain-certificate.pem"
KEY="path/to/key.pem"
    bash
    # Encode them in base64 with no wrappings and store them in variables
B64NOWRAP_KEY="$(base64 -w0 "$KEY")"
B64NOWRAP_CRT="$(base64 -w0 "$CRT")"
  7. As described in .env.example file, this base64 encoded certificate-key pair need to set as a single environment variable called TLS_. Within this variable, the certificate and key encodings needs to be separated by a newline (\n) and described by CRT= and KEY=. On a bash terminal this can be done by following steps continued by by above.
    bash
    # This creates a single file called "FLY_TLS" in the current directory
echo "KEY=$B64NOWRAP_KEY" > FLY_TLS
echo "CRT=$B64NOWRAP_CRT" >> FLY_TLS
# And now, this "FLY_TLS" file contains both certificate and key encoded and
# as required
    • Upload this to fly secrets like so in terminal or powershell:
      bash
      fly secrets set TLS_CERTKEY=- < FLY_TLS -a <app-id>
      where <app-id> is the name of the fly app you had launched in step 4.
    • Other essential environment variables are already present in fly.toml file of this repository, but you may read .env.example for it's use case and configuration.
  8. Fork the serverless-dns repository (you will need a GitHub account).
  9. In your fork, click on the Actions tab and Confirm that you want to use Actions, if asked.
  10. Similarly, click on Settings tab and select Secrets on the left pane. Add a new GitHub secret called FLY_APP_NAME and set it's value as the name of the fly app you had launched in step 4. And add another secret called FLY_API_TOKEN and set's value as what you get from running flyctl auth token in terminal or powershell.
  11. Head back to Actions tab and click on Fly on the left pane. Click on the Run workflow dropdown on the right side, and run the workflow using the Run workflow button.
  12. Once this action workflow finishes, open the terminal or powershell again and type in:
    bash
    flyctl ips list -a <app-id>
    where <app-id> is the name of the fly app you had launched in step 4.
    • Here, you can get the IP address of the application, update the DNS records of your domain name you had used in step 5.
  13. Done. Your application should be available on the said domain name in a few minutes. To configure, for example, the upstream resolver, you can edit the environment variables in the fly.toml file of your fork and re-run the Action workflow.

File: docs/proxy/wireguard.md

title: WireGuard

Adding a WireGuard Configuration to Rethink DNS + Firewall + VPN App

This guide will walk you through the steps to add a WireGuard configuration to the Rethink DNS + Firewall + VPN app.

Step 1: Open the App

  1. Open the Rethink DNS + Firewall + VPN app on your device.

Step 2: Navigate to the WireGuard Section

  1. Tap on the VPN tab at the bottom of the screen.
  2. Select WireGuard from the list of available VPN options.

Step 3: Add a New WireGuard Configuration

  1. Tap on the + (plus) button or the Add Configuration option.
  2. You will see three options:
    • Manual Entry
    • Import Config
    • Scan QR Code

Step 4: Manual Entry

  1. Select Manual Entry to enter the configuration details manually.
  2. Enter a name for the configuration in the Name field.

Enter WireGuard Configuration Details

  1. Public Key: Enter the public key provided by your WireGuard server.
  2. Private Key: Enter your private key. (Ensure this is kept secure and never shared.)
  3. Endpoint: Enter the endpoint URL or IP address of your WireGuard server along with the port (e.g., vpn.example.com:51820).
  4. Allowed IPs: Enter the IP addresses that should be routed through the WireGuard tunnel (e.g., 0.0.0.0/0 to route all traffic).

Optional - Set Additional Parameters

  1. DNS: Enter the DNS server(s) to be used with this WireGuard configuration.

  2. Persistent Keepalive: Enter a value (in seconds) to keep the connection alive, if required by your server configuration (e.g., 25).

  3. Once all the necessary details have been entered, tap on the Save button.

Step 5: Import Configuration

  1. Select Import Config.
  2. Navigate to the location of your WireGuard configuration file (.conf).
  3. Select the configuration file to import the details automatically.
  4. The app will parse the configuration file and fill in the necessary fields for you.
  5. Review and adjust the settings if necessary, then tap on the Save button.

Step 6: Scan QR Code

  1. Select Scan QR Code.
  2. Allow the app to access your camera if prompted.
  3. Scan the QR code provided by your WireGuard server.
  4. The app will automatically fill in the configuration details from the QR code.
  5. Review and adjust the settings if necessary, then tap on the Save button.

Step 7: Enable the WireGuard Configuration

  1. After saving, you will see the newly added WireGuard configuration in the list.
  2. Tap on the configuration name to enable it.
  3. You may be prompted to grant VPN permissions; allow the necessary permissions to proceed.

Step 8: Switch Between Simple and Advanced Modes

  1. By default, the WireGuard configuration is in Simple Mode.
  2. To switch to Advanced Mode, tap on the Advanced option.
  3. In Advanced Mode, you have additional settings available, including the ability to select specific apps to use with the WireGuard VPN.

Selecting Apps in Advanced Mode

  1. In the Advanced Mode settings, tap on Select Apps.
  2. Choose the apps you want to route through the WireGuard VPN.
  3. Save your selection and exit the settings.

Step 9: Verify Connection

  1. Once connected, you should see a status indication that the WireGuard VPN is active.
  2. You can verify the connection by checking your IP address or using any network diagnostic tool to ensure your traffic is being routed through the WireGuard VPN.

Troubleshooting

  • Connection Issues: Ensure that your WireGuard server details are correct and that the server is running.
  • DNS Issues: Verify that the DNS servers specified in the configuration are reachable and correctly configured.
  • Permission Issues: Make sure that the app has the necessary permissions to establish a VPN connection.

Conclusion

You have successfully added a WireGuard configuration to the Rethink DNS + Firewall + VPN app. If you encounter any issues or need further assistance, please refer to the support documentation or contact the support team.

File: docs/interactiveDoc.mdx

id: mdx title: Powered by MDX

You can write JSX and use React components within your Markdown thanks to MDX.

The .mdx extension is not required, but will enable better support from tooling (IDE, Prettier...).

export const Highlight = ({children, color}) => (
alert('Highlight pressed!')}>
{children}

);

Docusaurus green and
Facebook blue
 are my favorite colors.

I can write Markdown alongside my JSX!

File: docs/introdcution.md

id: introduction title: Rethink DNS + Firewall sidebar_label: Welcome slug: /

2B+ Android users deserve access to a safer and open Internet. Rethink DNS and Firewall offer a fast, secure, configurable, private DNS + Firewall for Android.

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#dns Browse dns catalog → #dns-library Browse dns-library catalog → #dnssec Browse dnssec catalog → #go Browse go catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →