{"id":28562868,"url":"https://github.com/icing/dns_https","last_synced_at":"2026-03-08T21:06:01.260Z","repository":{"id":55128728,"uuid":"522868650","full_name":"icing/dns_https","owner":"icing","description":"messing with HTTPS records in DNS","archived":false,"fork":false,"pushed_at":"2025-01-30T11:37:54.000Z","size":10,"stargazers_count":4,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-07T10:36:56.147Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/icing.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-09T08:40:07.000Z","updated_at":"2025-01-30T11:37:57.000Z","dependencies_parsed_at":"2022-08-14T12:50:45.836Z","dependency_job_id":null,"html_url":"https://github.com/icing/dns_https","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/icing%2Fdns_https","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/icing%2Fdns_https/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/icing%2Fdns_https/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/icing%2Fdns_https/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/icing","download_url":"https://codeload.github.com/icing/dns_https/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/icing%2Fdns_https/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259073025,"owners_count":22801094,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-10T12:11:50.059Z","updated_at":"2026-03-08T21:05:56.224Z","avatar_url":"https://github.com/icing.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dns_https\n\nmessing with HTTPS records in DNS since...2022.\n\nThis is a little Python tool that allows one to view HTTPS records (Type 65) in DNS. Example:\n\n```\n\u003e ./dns_https.py -j cloudflare.com\n{\n  \"priority\": 1,\n  \"params\": {\n    \"alpn\": [\n      \"h3\", \"h3-29\", \"h2\"\n    ],\n    \"ipv4hint\": [\n      \"104.16.132.229\", \"104.16.133.229\"\n    ],\n    \"ipv6hint\": [\n      \"2606:4700::6810:84e5\", \"2606:4700::6810:85e5\"\n    ]\n  }\n}\n```\n\n## How does it work?\n\n`dns_https.py` just invokes `dig +short +split=0 dns_name type65` and parses the record. HTTPS records in DNS are a blob, so what dig returns in the example above is:\n\n```\n\u003e dig +short +split=0 cloudflare.com type65\n\\# 67 0001000001000C0268330568332D323902683200040008681084E5681085E500060020260647000000000000000000681084E5260647000000000000000000681085E5\n```\n\nand I found that hard to read. There are probably lots of other tools out there that can analyze this, but I wanted to learn its internals, so I wrote this tool to dissect it.\n\n## Where is it defined?\n\n[dnsop-svcb-https-08](https://www.ietf.org/archive/id/draft-ietf-dnsop-svcb-https-08.html) is the draft I looked at. This refers to other RFCs and drafts. For example, the [draft for Encrypted Client Hellos](https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-13#section-4) is also connected to this.\n\n## Encrypted Client Hellos?\n\nThat TLS feature (in planning) is of interest to me. It will up your security on the internet by a bit by preventing\npeople to snoop on what sites you visit. The anti-snoop tech is, simplistically, the encryption of the important things you ask a server about. Like the site name, for example.\n\nSo, people can visit an abortion/press freedom/taiwan web site and the only thing your Internet Provider sees is that you are talking to Cloudflare (or Akamai or Fastly, etc.). \n\nIn order to get this working, a \"public key\" needs to be distributed. `HTTPS` records in DNS is one proposal on how to do that. There is an example site for ECH which uses that:\n\n```\n\u003e ./dns_https.py -j tls-ech.dev\n{\n  \"priority\": 1,\n  \"params\": {\n    \"ech\": [\n      {\n        \"version\": 65037,\n        \"pub_name\": \"public.tls-ech.dev\",\n        \"key\": {\n          \"id\": 43,\n          \"kem\": \"X25519\",\n          \"pubkey\": \"015881d41a3e2ef8f2208185dc479245d20624ddd0918a8056f2e26af47e2628\",\n          \"suites\": \"0001000100010003\"\n        },\n        \"max_name_len\": 64\n      }\n    ]\n  }\n}\n```\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ficing%2Fdns_https","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ficing%2Fdns_https","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ficing%2Fdns_https/lists"}