feat(dns): skip DNS lookups for AutoTLS hostnames #11140

lidel · 2026-01-12T17:11:06Z

p2p-forge hostnames encode IP addresses directly (e.g., 1-2-3-4.peerID.libp2p.direct -> 1.2.3.4), so DNS queries are wasteful. kubo now parses these IPs in-memory.

cc @aschmahmann as this aims to address #11136

This PR

applies to both default libp2p.direct eTLD and custom AutoTLS.DomainSuffix
TXT queries still delegate to network for ACME DNS-01 compatibility
Fixes Do not require network i/o for *.libp2p.direct domain resolution #11136
Closes DNS.Resolvers should be used for DNS multiaddrs: /dnsaddr /dns /dns4 /dns6 #9199 (iiuc was fixed since ~v0.20)

Notes on DNS wiring

Using `DNS.Resolvers` for go-libp2p too

iiuc the dependency injection chain is:

core/node/dns.go:13 - DNSResolver() creates *madns.Resolver with p2p-forge support
core/node/groups.go:357,375 - fx.Provide(DNSResolver) makes it available in both Online and Offline modes
core/node/groups.go:32 - BaseLibP2P includes fx.Provide(libp2p.MultiaddrResolver)

core/node/libp2p/dns.go:9-11 - MultiaddrResolver takes *madns.Resolver as a dependency and wires it into go-libp2p:

func MultiaddrResolver(rslv *madns.Resolver) (opts Libp2pOpts, err error) {
    opts.Opts = append(opts.Opts, libp2p.MultiaddrResolver(swarm.ResolverFromMaDNS{Resolver: rslv}))
    return opts, nil
}

The fx dependency injection automatically connects these - when MultiaddrResolver needs a *madns.Resolver, fx provides the one from DNSResolver() which now includes the p2p-forge local resolution.

This means all /dns4/*.libp2p.direct/... and /dns6/*.libp2p.direct/... multiaddrs resolved by go-libp2p's swarm will use the new local resolver, avoiding network I/O. This includes peer addresses discovered via DHT, delegated routing, or any other source.

Regression tests

I confirmed this with extra manual test:

$ ipfs config DNS.Resolvers '{"." : "https://invalid.broken.resolver.test/dns-query"}'
$ ipfs swarm connect /dnsaddr/bootstrap.libp2p.io

Error: Post "https://invalid.broken.resolver.test/dns-query": dial tcp: lookup
invalid.broken.resolver.test on 127.0.0.1:53: no such host

The error proves DNS.Resolvers IS being used for /dnsaddr multiaddr resolution too.

Added e2e test to test/cli to ensure we have regression test that detects if this wiring is ever broken due to future go-libp2p update or our own refactors etc.

p2p-forge hostnames encode IP addresses directly (e.g., 1-2-3-4.peerID.libp2p.direct -> 1.2.3.4), so DNS queries are wasteful. kubo now parses these IPs in-memory. - applies to both default libp2p.direct and custom AutoTLS.DomainSuffix - TXT queries still delegate to network for ACME DNS-01 compatibility Fixes #11136

regression test for #9199 confirms that DNS.Resolvers config is used when resolving /dnsaddr multiaddrs during swarm connect, not just for DNSLink resolution

aschmahmann · 2026-01-12T18:48:22Z

core/node/p2pforge_resolver.go

+	// split subdomain into parts: should be [ip-prefix, peerID] or just [peerID]
+	parts := strings.Split(subdomain, ".")
+	if len(parts) < 2 {
+		// peerID only, no IP component - return empty (NODATA equivalent)
+		return nil, nil
+	}


We can do this, but should we? e.g. under normal circumstances this shouldn't happen and in theory in the future .libp2p.direct could point at a given IP address.

Maybe a fallback here is better? Generally speaking shouldn't we use a fallback everywhere we can't give a definitive answer?

You are right, we don't want to hard-fail here, as that would close the door for future features.

Changed all error paths to fall back to network DNS.

aschmahmann · 2026-01-12T19:00:00Z

core/node/p2pforge_resolver.go

+		return nil, fmt.Errorf("hostname %q does not match any p2p-forge suffix", hostname)
+	}
+
+	// split subdomain into parts: should be [ip-prefix, peerID] or just [peerID]


shouldn't we do a "is this a valid peerID" check like happens at libp2p.direct?

Added peer.Decode() validation with fallback on failure

aschmahmann · 2026-01-12T19:03:29Z

core/node/dns.go

+	for _, domain := range forgeDomains {
+		opts = append(opts, madns.WithDomainResolver(domain+".", forgeResolver))
+	}


How is this meant to interact with say the user hard-coding a resolver in the config for *.libp2p.direct?

It overrides it. Documented in DNS.Resolvers section of config.md.

aschmahmann · 2026-01-12T19:05:05Z

core/node/dns.go

+
+	// Build list of p2p-forge domains to resolve locally without network I/O.
+	// AutoTLS hostnames encode IP addresses directly (e.g., 1-2-3-4.peerID.libp2p.direct),
+	// so DNS lookups are wasteful. We always resolve these in-memory.


Is there a reason we'd want to be able to turn this feature off? I can't think of a good reason other than debugging right now so I suspect not but wanted to ask in case.

Unlikely, but could be useful for testing/debugging.
Added AutoTLS.SkipDNSLookup config flag (enabled by default).

aschmahmann · 2026-01-12T19:07:18Z

test/cli/dns_resolvers_multiaddr_test.go

+// It verifies that DNS.Resolvers config is used when resolving /dnsaddr,
+// /dns, /dns4, /dns6 multiaddrs during peer connections, not just for
+// DNSLink resolution.
+func TestDNSResolversApplyToMultiaddr(t *testing.T) {


Should we also add a test that even when we override the default resolver, libp2p.direct still uses the custom resolver or just extra noise because we have sufficient tests around the configurability elsewhere?

I think its good idea: added test verifying local resolution with broken DNS.Resolvers

Changes based on PR review comments: - #11140 (comment) use fallback to network DNS instead of returning errors when local parsing fails, ensuring forward compatibility with future DNS records - #11140 (comment) add peerID validation using peer.Decode(), matching libp2p.direct server behavior, with fallback on invalid peerID - #11140 (comment) document interaction with DNS.Resolvers in config.md - #11140 (comment) add AutoTLS.SkipDNSLookup config flag to disable local resolution (useful for debugging or custom DNS override scenarios) - #11140 (comment) add E2E test verifying libp2p.direct resolves locally even when DNS.Resolvers points to a broken server additional improvements: - use madns.BasicResolver interface instead of custom basicResolver - add compile-time interface checks for p2pForgeResolver and madns.Resolver - refactor tests: merge IPv4/IPv6, add helpers, use config.DefaultDomainSuffix - improve changelog to explain public good benefit (reducing DNS load)

lidel added 2 commits January 12, 2026 17:57

test(cli): verify DNS.Resolvers applies to multiaddr resolution

52ddea7

regression test for #9199 confirms that DNS.Resolvers config is used when resolving /dnsaddr multiaddrs during swarm connect, not just for DNSLink resolution

lidel changed the title ~~feat(dns): resolve libp2p.direct addresses locally without network I/O~~ feat(dns): skip DNS lookups for AutoTLS hostnames Jan 12, 2026

lidel marked this pull request as ready for review January 12, 2026 18:05

lidel requested a review from a team as a code owner January 12, 2026 18:05

lidel requested a review from aschmahmann January 12, 2026 18:05

lidel added the status/ready Ready to be worked label Jan 12, 2026

aschmahmann reviewed Jan 12, 2026

View reviewed changes

lidel added 2 commits January 19, 2026 22:49

Merge origin/master into feat/p2pforge-dns-resolver

2924ac5

lidel requested a review from aschmahmann January 19, 2026 22:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(dns): skip DNS lookups for AutoTLS hostnames #11140

feat(dns): skip DNS lookups for AutoTLS hostnames #11140

lidel commented Jan 12, 2026 •

edited

Loading

Uh oh!

aschmahmann Jan 12, 2026

Uh oh!

lidel Jan 19, 2026

Uh oh!

aschmahmann Jan 12, 2026

Uh oh!

lidel Jan 19, 2026

Uh oh!

aschmahmann Jan 12, 2026

Uh oh!

lidel Jan 19, 2026

Uh oh!

aschmahmann Jan 12, 2026

Uh oh!

lidel Jan 19, 2026

Uh oh!

aschmahmann Jan 12, 2026

Uh oh!

lidel Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

feat(dns): skip DNS lookups for AutoTLS hostnames #11140

Are you sure you want to change the base?

feat(dns): skip DNS lookups for AutoTLS hostnames #11140

Conversation

lidel commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This PR

Notes on DNS wiring

Using DNS.Resolvers for go-libp2p too

Regression tests

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lidel commented Jan 12, 2026 •

edited

Loading

Using `DNS.Resolvers` for go-libp2p too