Repository navigation
doh-client does not respect preloaded IPs #184
Description
I have some records set in /etc/hosts, and I have an empty bootstrap list. The name resolution for these records is supposed to take the value from the /etc/hosts (as I understood from the documentation in the config file), but it forwards it to the upstream resolver instead.
/etc/hosts
127.0.0.1 github.com.
/etc/dns-over-https/doh-client.conf
[others]
# Bootstrap DNS server to resolve the address of the upstream resolver
# If multiple servers are specified, a random one will be chosen each time.
# If empty, use the system DNS settings.
# If you want to preload IP addresses in /etc/hosts instead of using a
# bootstrap server, please make this list empty.
bootstrap = [
## Google's resolver, good ECS, good DNSSEC
#"8.8.8.8:53",
#"8.8.4.4:53",
# CloudFlare's resolver, bad ECS, good DNSSEC
#"1.1.1.1:53",
#"1.0.0.1:53",
]
dig @127.0.0.1 github.com.
; ANSWER SECTION:
github.com. 44 IN A 140.82.121.3
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
journalctl -f
doh-client: 127.0.0.1:42826 "github.com. IN A"
doh-client: choose upstream: upstream type: <redacted>, upstream url: <redacted>
dns-over-https version: 2.3.10
Activity
m13253 commentedon Jan 2, 2026
If I remember correctly, only the resolution of the upstream DoH servers themselves go through /etc/hosts and the bootstrap list.
If you want to filter certain hosts (similar to #177), I would recommend chaining a dnsmasq or a dnsdist before the upstream.
WaleedMortaja commentedon Jan 4, 2026
@m13253 The comment can actually make that sense, especially that it is placed above that option. I think these are the lines that can confirm/deny that (but I could not confirm/deny it myself). If you find that it is currently used only to preload bootstrap servers, the comment can be changed to better clarify that.
Anyway, the first impression was that this is a general preload for any host. and I would prefer to have that simple option of resolving hosts from
/etc/hostsinstead of having to run a dedicated DNS server.Thanks!