Encrypted DNS with NSURLSession

Since the sample code was provided in Swift, I want to confirm that the following code in Objective-C will configure NSURLSession to use encrypted DNS and that you can have more than one fallback resolver:

Code Block objective-c
nw_privacy_context_t defaultPrivacyContext = NW_DEFAULT_PRIVACY_CONTEXT;
nw_endpoint_t dohResolverEndpoint = nw_endpoint_create_url("https://dnsserver.example.net/dns-query");
nw_endpoint_t v4ResolverEndpoint = nw_endpoint_create_host("1.1.1.1", "443");
nw_endpoint_t v6ResolverEndpoint = nw_endpoint_create_host("2606:4700:4700::1111", "443");
nw_resolver_config_t fallbackResolvers = nw_resolver_config_create_https(dohResolverEndpoint);
nw_resolver_config_add_server_address(fallbackResolvers, v4ResolverEndpoint);		
nw_resolver_config_add_server_address(fallbackResolvers, v6ResolverEndpoint); 
nw_privacy_context_require_encrypted_name_resolution(defaultPrivacyContext, true, fallbackResolvers);


Up vote post of madsolar8582 Down vote post of madsolar8582
1.1k views
Posted by
madsolar8582
Reply
Add a Comment

Accepted Reply

Yes, you can add multiple addresses for your encrypted DNS server (or none at all, in which case the system will resolve the DNS server addresses over cleartext DNS). You can only have one server name (for DoT) or server URL (for DoH), however.
Posted by
Frameworks Engineer
Up vote reply of Frameworks Engineer Down vote reply of Frameworks Engineer
Post marked as solved
Add a Comment

Replies

Yes, you can add multiple addresses for your encrypted DNS server (or none at all, in which case the system will resolve the DNS server addresses over cleartext DNS). You can only have one server name (for DoT) or server URL (for DoH), however.
Posted by
Frameworks Engineer
Up vote reply of Frameworks Engineer Down vote reply of Frameworks Engineer
Post marked as solved
Add a Comment
So having multiple services for resiliency is not supported?

Example:
Code Block objective-c
nw_endpoint_t cloudflare = nw_endpoint_create_url("https://cloudflare-dns.com/dns-query");
nw_endpoint_t google = nw_endpoint_create_url("https://dns.google/dns-query");
fallbackResolvers = nw_resolver_config_create_https(cloudflare);
nw_resolver_config_add_server_address(fallbackResolvers, google);


Posted by
madsolar8582
Up vote reply of madsolar8582 Down vote reply of madsolar8582
Add a Comment
Correct, for any particular privacy context, you choose one DNS provider. You can have multiple privacy contexts, or modify the default privacy context to change which DNS provider you want to use.
Posted by
Frameworks Engineer
Up vote reply of Frameworks Engineer Down vote reply of Frameworks Engineer
Add a Comment