HACKER Q&A
📣 HocusLocus

Any software specific to "SHTF DNS cache?"


I am curious if anyone ever considered a specific threat scenario: something that behaves as a local forwarder/resolver on your machine, but deliberately and meticulously caches DNS and periodically stores records efficiently and checkpoints to disk occasionally. Something that could run in the bg inexpensively and caches IPs most useful to you over time. With notable exceptions of course, and you know who they are.

The objective being, if the Internet ever experiences a sudden infrastructure attack with delayed side-effects, something deeply affects anycast routing or interprovider pipelines in the short term, or you as a customer or certain domains are blocked from queries (for what ever reason), and my personal favorite... some 'bad actor' government decides to trigger some "DNS kill switch" under the (confident) assumption that doing so will have its intended effect as DNS+browser TTLs expire, yet any specific hardening for such an attack implemented in secret relying on already-known addresses would result in continued connectivity by address only. For a time.

In any real calamity such as an announcement of an impending asteroid or declaration of cyberwar, routing will suffer along with the rest. But it is my hope (and curiosity) that such a cache may grant a brief window where you could visit some sites you have accessed often and from them, perhaps a bit more information about the root cause than you otherwise can access. It would be a sudden mode change on your PC which would return DNS from history before a certain time stamp. For example, if Big Brother decides to redirect DNS at 2pm, you could fall back to queries before 1:45pm. Enough time to find a credible rumor or someone aware of the situation.

I know it will break RFCs and a lot of other things when it is in the loop. I'm curious to see and experiment with what it would NOT break (for awhile).


  👤 LargoLasskhyfv Accepted Answer ✓
https://en.wikipedia.org/wiki/MaraDNS

https://maradns.samiam.org/

https://github.com/samboy/MaraDNS

for really being lean&mean enough to run it effortlessly on something like (even older) Raspberry Pis or similar SBCs, or routers running things like OpenWRT/DDWrt or similar.

While it has no GUI, it can do everything you asked for. F.E. snapshotting its data to file, either via its internal scripting language (Lua), or cron jobs.

To be further improved by using some upstream https://en.wikipedia.org/wiki/Alternative_DNS_root which doesn't do the shit you fear in the first place, thereby maybe widening the timeframe before SHTF is hitting you.

Or at least something from here https://en.wikipedia.org/wiki/Public_recursive_name_server

I'd recommend Mullvad, using it ATM because it's working excellently for me, without adding any noticable latency. But that may vary with your location.

Please note: Can be used without its VPN service

https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

You can use the ad/game/porn-blocking in various levels or steps, or not at all. I think it's nice to have as a first layer of defense for gadgets where it's impractical to install adblocking on device.

HTH