Encrypted DNS with NSURLSession

Question

Created Jun ’20

Replies 3

Boosts 0

Views 1.3k

Participants 2

Since the sample code was provided in Swift, I want to confirm that the following code in Objective-C will configure NSURLSession to use encrypted DNS and that you can have more than one fallback resolver:

Code Block objective-cnw_privacy_context_t defaultPrivacyContext = NW_DEFAULT_PRIVACY_CONTEXT;
nw_endpoint_t dohResolverEndpoint = nw_endpoint_create_url("https://dnsserver.example.net/dns-query");
nw_endpoint_t v4ResolverEndpoint = nw_endpoint_create_host("1.1.1.1", "443");
nw_endpoint_t v6ResolverEndpoint = nw_endpoint_create_host("2606:4700:4700::1111", "443");
nw_resolver_config_t fallbackResolvers = nw_resolver_config_create_https(dohResolverEndpoint);
nw_resolver_config_add_server_address(fallbackResolvers, v4ResolverEndpoint);		
nw_resolver_config_add_server_address(fallbackResolvers, v6ResolverEndpoint); 
nw_privacy_context_require_encrypted_name_resolution(defaultPrivacyContext, true, fallbackResolvers);

Answered by Engineer in 615052022

Yes, you can add multiple addresses for your encrypted DNS server (or none at all, in which case the system will resolve the DNS server addresses over cleartext DNS). You can only have one server name (for DoT) or server URL (for DoH), however.

Boost

Answer 1

Engineer OP

Apple

Jun ’20

Accepted Answer

Yes, you can add multiple addresses for your encrypted DNS server (or none at all, in which case the system will resolve the DNS server addresses over cleartext DNS). You can only have one server name (for DoT) or server URL (for DoH), however.

1

Answer 2

madsolar8582 OP

Jun ’20

So having multiple services for resiliency is not supported?

Example:

Code Block objective-cnw_endpoint_t cloudflare = nw_endpoint_create_url("https://cloudflare-dns.com/dns-query");
nw_endpoint_t google = nw_endpoint_create_url("https://dns.google/dns-query");
fallbackResolvers = nw_resolver_config_create_https(cloudflare);
nw_resolver_config_add_server_address(fallbackResolvers, google);

0

Answer 3

Engineer OP

Apple

Jun ’20

Correct, for any particular privacy context, you choose one DNS provider. You can have multiple privacy contexts, or modify the default privacy context to change which DNS provider you want to use.

0