tina-hello / doh-cf-workers Goto Github PK

View Code? Open in Web Editor NEW

374.0 9.0 424.0 39 KB

DNS-over-HTTPS proxy on Cloudflare Workers

License: BSD Zero Clause License

JavaScript 100.00%

cloudflare-workers dns-over-https serverless

doh-cf-workers's Introduction

doh-cf-workers

A very minimalist DNS-over-HTTPS proxy on Cloudflare Workers.

Sign up for a free Cloudflare Workers account, create a new worker, replace the Script with the content of index.js, deploy the worker, and you're done, use the address anywhere DoH is accepted (AdGuard, browsers secure DNS settings, YogaDNS, Intra, Nebulo etc). Feel free to replace the doh variable with any DNS-over-HTTPS server you want. Confirmed to work with Cloudflare itself, Google, and NextDNS. The rarely supported JSON API is available through the dohjson variable. Some providers use identical URL (Cloudlfare, NextDNS), some use /resolve instead of /dns-query for path (Google, AdGuard).

Why? In case ISPs start banning known DoH providers, you can use your own proxy. Even if they block workers.dev wholesale, you can use your own domain (it must be hosted on Cloudflare, add a CNAME record targeting anything and bind the route from your website Workers tab). If you want to use domain not hosted on Cloudflare, use doh-cf-pages instead, where even CNAME records from FreeDNS is enough for custom domain.

Daily request on free tier is limited to 100 thousands, should be enough for most personal use, or even a family. If you need more, upgrade to paid plan (card needed) and edit the wrangler.toml, though with minimum $5 monthly you might be better off just hosting AdGuard Home on a proper VPS ($5 on Vultr, pretty much unlimited request) which you can also put behind Cloudflare to hide your VPS IP. Once Cloudfare Snippet is released and if it's available on free tier, the code will be updated to adopt it for unlimited daily request.

You can also deploy the project using the button below, useful if you want to quickly modify the parameter/code without manually deploying to Cloudflare. Keep in mind the Action logs are visible to public unless you make your repository private (you'll need to unfork), so anyone can see your Cloudflare Worker address. Remember to remove the logs after deploying if you leave the repository public unless you're OK with others using your daily request quota.

Want more control of the filter? Use serverless-dns which powers RethinkDNS

Want to host on Google Cloud Function or see how this is implemented in .NET? Use my doh-gcf

doh-cf-workers's People

Contributors

Stargazers

Watchers

Forkers

jackyes pepsimans klennix tanimpavel marksix warther yyqyu imanbarati nicennnnnnnlee shahinza dgbkn farshadseifi minaduki-shigure revintec aria001 fliptip sysuu ketuikiri xf22001 bingbaga aliicex dmcimi githubusermr zjb19981222 jalonyou uavg timmyvo bbvv77 zer0wave njkhanh ybmgq mengduize xinkeji joejoelam myzone6178 sunnygy tiktoins vhued yungancestor noliaz hermesthecat whinee lessmore92 zylquinal alphacf farisproject lucsenl yurhett mmmelttt securitytest-debug zjw88282740 a52948 mumetngoding akumax1 kaxubyha me26530 babutree micheal0906 maskedeken empty-c0de hiksea mantoulee asdfok h4mid007 7071ms qq1203632211 u9sky sunlintao30 troke12 zoioz zer0lightning 2wnsf0lk tohis1154 qq1906 danxiaonuo rwv ciyuri humanglitch191 yqk100 dasferco blueberry-pie-11 ariorasaneh henry010125 jarmohu swim233 ks-oto rihcus dfsafhhdrtg yunus-home alphadlplus anhnguyen1212 deniscioata lmfuture-me calx24 robustmaster aleksa1302 moyuwuhen601 guigeng dingba809 karep01

doh-cf-workers's Issues

DNS leaks when using with worker.

Hi Tina,
Could you please spend your free time to have a check DNS leaking issue when using this script?
I notice when I change the DoH endpoint to my nextDNS DoH link. Instead there should only be NextDNS server for queries, it's going to leak to OpenDNS, YandexDNS, google DNS as well.
I did use YogaDNS for resolving on my windows. Even setting up fix DoH native on Windows 11. Sometimes, it is still leaking to other servers.
I suspect the worker.dev domain might be the culprit in this case but I don't have enough technical knowledge to dig deeply into the issue. Hopefully you can have a quick check.
Notice that I have no DNS leaking when I use directly my nextDNS DoH endpoint with YogaDNS app, not proxy through the workers scripts.
Thank you for you support. Cheers.

ecs support

If the upstream dns supports ecs, can cf-doh support ecs?

DoT & DoQ support

With the recent release of connect() for making outbound TCP connection in Cloudflare Workers, it's technically possible to currently write a forwarding to DoT servers instead DoH, and in the future, once the support for inbound TCP and QUIC is added, also forwarding from DoT & DoQ to any DoH, DoT, and DoQ server.

However, aside from the nonzero effort to learn about the new API and implement them, forwarding DoH GET requests to DoT/DoQ will be slightly more involved than simply forwarding DoH POST to DoT/DoQ, since the URL in DoH GET must be decoded first.

The actual benefit of extending support for DoT & DoQ will be minimal, for outbound, most servers that support DoT & DoQ likely support DoH too, and for inbound, if a government blocks DoH servers, then they likely already block DoT & DoQ entirely by closing down port 853.

Minimal doesn't mean none, Inbound DoT is very practical for Android users due to its native support, and even with an outbound that already supports DoT, using Cloudflare's cert avoids the dilemma in LetsEncrypt where supporting newer Android DoT means abandoning older Android DoT, and vice versa. So if someone creates a pull request about DoT/DoQ support, I will still review it.

How to update?

Hi Tina,

I saw you had updated this repository a few times. To update it, I need to copy the contents from index.js index.js and change my DNS provider and update in the Cloudflare worker section right? Is there anything else I have to do? Because I think the last time when I deployed it, I did it manually.
Will it automatically support http/3? I am using nextdns.io, and they recently supported doh3.nextdns.io as their http/3 DNS. But not sure if I have to change anything in the code to make it work.

possible to use multiple upstreams in the worker script?

thanks

Consider FSF / OSI approved 0BSD or MIT0 instead of CC0

CC0 (public domain dedication as a fallback) isn't legal in all jurisdictions (France and Germany from the top of my head) and some FOSS projects (ex: Fedora) and corps (ex: Google) ban CC0-licensed code (as they see it more of a content / art license): https://archive.is/ukIC5

Here's an interesting discussion on suitability of CC0 (does not wavier patent rights) and Unlicense (attempts public domain dedication) for code: https://news.ycombinator.com/item?id=30554087

General recommendation is to use 0BSD / MIT0: https://archive.is/6YgVt

IANAL.

Cf pages

Hello can you please create a tutorial or point me to one on how to add a custom domain to cf pages? I am trying and reading about it but I haven't been successful so far.

How to configure the Routing, it's not working for me

I am from CN and wanted to use the NextDNS, but it was always slow. I followed your script and now, it works smoothly. Thank you so much.

Snippets

Cloudflare Snippets, which limit script size to 32KB, RAM to 2MB, and execution (cpu) time to 5ms (all plenty for a DoH proxy), are literally $0 for any number of requests! This means, anyone can run a public DoH proxy without worrying about bots and costs. Total game changer.

Still in private alpha, but may hit public beta in about 6 months time. Opening this bug so this project switches over to snippets / experiments with it at the very least.

For ref, we are tracking it here: serverless-dns/zero#1