shoenig / donutdns Goto Github PK

In trying to block PayPal, turns out they hold an absurd number of domains (nearly 3000). Rather than appending these to a block list, might be nice to have a directory of block lists we can load from.

https://robbiesblog.com/domain-names-owned-by-paypal-inc/7500

e.g.

... isn't 65 ASCII for 'A'? Not sure what's happening here

Aug 28 22:02:12 thinkcentre donutdns[19572]: [INFO] plugin/donutdns: BLOCK query (A) for roomapi.stocktwits.com.
Aug 28 22:02:12 thinkcentre donutdns[19572]: [DEBUG] plugin/donutdns: query: ql.stocktwits.com. type: 65 not an A or AAAA record, fallthrough
Aug 28 22:02:12 thinkcentre donutdns[19572]: [DEBUG] plugin/donutdns: query: roomapi.stocktwits.com. type: 65 not an A or AAAA record, fallthrough
Aug 28 22:02:12 thinkcentre donutdns[19572]: [DEBUG] plugin/donutdns: query: www.googletagservices.com. type: 65 not an A or AAAA record, fallthrough
Aug 28 22:02:12 thinkcentre donutdns[19572]: [DEBUG] plugin/donutdns: query: www.google-analytics.com. type: 65 not an A or AAAA record, fallthrough
Aug 28 22:02:12 thinkcentre donutdns[19572]: [DEBUG] plugin/donutdns: query: cds.s5x3j6q5.hwcdn.net. type: 65 not an A or AAAA record, fallthrough

Instead of merging #4 directly, it'd be nice to be able to incorporate such sub-tools into the donutdns binary itself - avoiding the large chunk of duplicate code.

As a first small command, I always wanted a way to check if a query would be blocked or not without going through the trouble of launching donutdns and using dig to send a query, etc.

Instead let us do something like

donutdns check <domain>

And the output would be something like one of

Blocked by default list exact match
Blocked by custom list exact match
Blocked by custom list suffix match
Allowed

It would be nice to have a way to track metrics around DNS queries and whether they were blocked, and if so, in what manner (default vs. custom list).

Not sure if we should pick one metrics format, need to look into what's common these days (e.g. prometheus vs. statsd, etc.)

Currently we download the default lists one at a time, which can be kinda slow depending on network/instance circumstances. Try running them in parallel up to GOMAXPROCS at a time.

Use the UPSTREAM_0 for the initial bootstrapping of source lists

Being able to block domains based on suffix would be helpful against sites with lots of fqdns