[pull] main from jason5ng32:main - #125
Merged
Merged
Conversation
Replace the since-discontinued Quad101 with two verified Taiwan resolvers (issue #391 was rescoped to reachable public resolvers): - HiNet (Chunghwa Telecom) 168.95.1.1 - GIGA (Taiwan Fixed Network) 203.133.1.6 Both are UDP-only (no JSON DoH endpoint). Also add a contributor rule to the data-file header requiring that a resolver actually answer with the ra flag before a PR, so future additions verify reachability instead of trusting published docs. Co-authored-by: OpenAI Codex <codex@openai.com>
Retarget the rescoped Europe-resolver issue (#392) to CZ.NIC's ODVR (193.17.47.1), a verified reachable European public resolver run by the .cz registry. UDP-only: its DoH endpoint does not serve the JSON API. Co-authored-by: OpenAI Codex <codex@openai.com>
Add Yandex.DNS (77.88.8.8), a reachable Russian public resolver, to the curated list. UDP-only: Yandex's DoH endpoint speaks RFC 8484 wire format rather than the application/dns-json API this endpoint queries. Co-authored-by: OpenAI Codex <codex@openai.com>
Feat(dns): add HiNet and GIGA (Taiwan) resolvers
Feat(dns): add Yandex.DNS (Russia) resolver
Feat(dns): add CZ.NIC ODVR (Czechia) resolver
Run a daily and dev-push probe for every curated UDP resolver, checking recursive answers and honest NXDOMAIN responses. Add mocked unit coverage and publish a machine-readable report in the Actions summary. Co-authored-by: OpenAI Codex <codex@openai.com>
Add SOA and CAA to the DNS resolver's record types, resolved through the existing backend switch. The DoH path is unchanged. SOA is formatted in DNS presentation order. CAA property tags are derived from each record's own key rather than a fixed whitelist, so a provider-specific tag renders as itself instead of collapsing to a placeholder. Node's Resolver returns `critical` and `type` as metadata alongside that one extensible tag, so both are excluded when picking it. Eight record types no longer fit one row on a phone, where the control previously pushed past its parent. The selector is now a four-column grid on narrow viewports and stays a single row from `md` up. Formatting is exported and covered offline by unit tests, including a provider-specific CAA tag. No test performs a real DNS lookup. Closes #400 Co-Authored-By: Claude <noreply@anthropic.com>
Completes the 53-key privacy dataset for pt-BR. Co-authored-by: Codex <codex@openai.com>
Route DNS resolver requests through the shared domain guard so hostname presence, syntax, and canonical lowercasing follow the same contract as other domain-taking APIs. Co-Authored-By: GPT-5 <noreply@openai.com>
Feat(i18n): add Brazilian Portuguese privacy policy
Align the telemetry disclosure with the English source so the named Sentry recipient does not contradict a broader claim that data is never shared with third parties. Co-Authored-By: GPT-5 <noreply@openai.com>
RFC 8659 allows any alphanumeric property tag, `type` and `critical` included. Node writes the tag onto the record under its own name, so such a tag overwrites the metadata field of the same name and the scan for a non-metadata key finds nothing. Destructuring undefined then threw, and the surrounding handler turned an otherwise valid answer into N/A for that resolver. The tag is now recovered from whichever field stopped holding a metadata value: `type` is otherwise always the constant 'CAA', and `critical` is otherwise always a number. A tag named `critical` displaces the flag itself, which Node has already lost by that point, so it falls back to 0. Reported by review on #442. The suggested fix there was to stop excluding `type`, which would break every ordinary record: a live google.com answer is `{critical: 0, type: 'CAA', issue: 'pki.goog'}`, and without the exclusion the scan picks `type` and renders `0 type "CAA"` instead of `0 issue "pki.goog"`. Co-Authored-By: Claude <noreply@anthropic.com>
Keep resolver health checks on demand and surface actionable runtime availability failures through the shared logger. Remove the GitHub Actions workflow so transient resolver connectivity does not affect code CI. Co-authored-by: OpenAI Codex <codex@openai.com>
Chore(dns): add scheduled resolver health checks
Feat(dnsresolver): support SOA and CAA record lookups
Needed to join the DNS resolver's record-type Select and its input into one bordered control. Added through the shadcn-vue CLI, so the files stay verbatim upstream output and can be re-synced. The same run resynced ui/separator, which still carried a hand-written early-refactor version, to current upstream — data-slot and data-[orientation] variants instead of a JS ternary, behaviourally the same for all three existing callers. It also refreshed one transitive postcss patch in the lockfile. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The pattern rejected any name containing an underscore, so the DNS resolver could not look up `_dmarc.example.com` or a `_domainkey` selector — the two most common TXT lookups there are — even though TXT has been a supported record type all along. Underscore is allowed as a label prefix only, per RFC 8552, and never in the TLD: `_dmarc.example.com` passes, `has_underscore.com` and `example._com` still do not. Widening the shared helper rather than adding a DNS-only variant also lets Whois and the OONI route reach the same names; both simply fail upstream on a name their provider has nothing for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every provider contributes two rows to the results table, and the whole premise of the tool is that a difference between rows means something happened. Three cosmetic mismatches were reading as real disagreements: - SOA dropped the trailing root dots that the DoH path returns, though the MX branch had appended them for that exact reason. - CNAME and NS had the same gap; both transports now normalize through withRootDot, which also covers a DoH endpoint that strips them. - A SOA query below the zone apex returned N/A on every row, because the answer arrives in the authority section. dohRecords now falls back to it, filtered to the SOA type so a stray NS never leaks in. Also drops the CAA tag-collision fallback that arrived with #442: it guessed at a record shape that cannot occur, and admitted in its own comment that the flag was unrecoverable in the case it handled. The shared record-type list lands here because withRootDot needs to know which types are name-valued; the guard and the picker read it next. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`?type=` was never validated. The UDP branch fell through to a throw and returned N/A, but the DoH branch interpolated whatever arrived straight into the upstream URL, which made the route a query proxy for record types we never intended to support. requireValidRecordType checks it against DNS_RECORD_TYPES and uppercases it in place, the same way requireValidDomain lowercases its param — so `?type=caa` now works as well. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Eight record types no longer fit one line as toggle buttons, and the region filter grows every time a resolver from a new country is added — both were solved by wrapping, which is what the connected ToggleGroup form is worst at: its border-l-0 seam only reads as one bar on a single line and breaks apart the moment it wraps. So the record type becomes a Select joined to the input inside a ButtonGroup, with the run button beside it — one row at every width, the trigger floored at CNAME's width so switching type does not jolt the row. The region filter becomes detached pills, the same shape IPHistory uses, which wraps cleanly at any number of countries. The type list now comes from common/, so the picker cannot drift from what the backend guard accepts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The old text was written years ago for one audience: it led with operators contaminating domains for political reasons and warned that some built-in providers were Chinese. Naming a country in product copy is not something we do any more, and it buried what the tool is. The new copy answers three questions instead — what it does, what a difference between providers usually means, and how to run it. Filtering and redirection are still named as a cause, just as a phenomenon rather than as anyone's fault. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every common/ helper re-exported through frontend/utils/ is supposed to ship a spec that imports both paths and asserts they agree — that is what stops a bridge from quietly regrowing a second implementation. The dns-record-types bridge shipped without one. Also pins the two invariants that would otherwise fail silently: the lookup set matching the ordered list, and every name-valued type actually being a supported one, since a type missing from the list would skip withRootDot and surface as punctuation noise rather than an error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A SOA query for an aliased name returns the CNAME chain in Answer with the zone SOA in Authority; taking Answer verbatim rendered the CNAME target as the SOA value and made the row disagree with its UDP twin. Filter SOA answers by record type on both sections. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Node DNS errors carry the looked-up name in err.message, and warn-level logs mirror to telemetry; the availability branch now logs only the error code, which is the whole signal for a timeout anyway. The local-only debug branch keeps the full error for diagnosis. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The provider-id comment block sat above requireValidRecordType; move it back over requireValidProviderId. Also drop needless quote escapes in the resolver-check script and match the ui/ double-quote style in ButtonGroupSeparator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )