From 096e1ce8b669b2fa2376a6afef233f47060cd4c7 Mon Sep 17 00:00:00 2001 From: windyboy Date: Wed, 12 Aug 2026 22:12:32 +0800 Subject: [PATCH] docs(dns): correct idle-mosdns premise in alternatives research (W1N-56) --- docs/lan-dns-alternatives.md | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/docs/lan-dns-alternatives.md b/docs/lan-dns-alternatives.md index 27dffe3..bbcf219 100644 --- a/docs/lan-dns-alternatives.md +++ b/docs/lan-dns-alternatives.md @@ -2,11 +2,19 @@ **Status: research only. No configuration was changed.** This page evaluates resolvers/splitters that are genuinely better than — or meaningfully different -from — the current "AdGuard Home (AGH) + idle mosdns" setup on +from — the current "AdGuard Home (AGH) + mosdns" setup on [`dns.windy.lan`](../hosts/dns.windy.lan.md) (`.36`), for a GFW-constrained China home LAN. Claims are cited to primary sources (official repos, official docs, upstream READMEs); anything not verified is flagged as such. +> 2026-08-12: facts in this page's scope recap were refreshed by W1N-56 live +> verification — mosdns on `.1` is **not idle**, it is clash's +> `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution); the +> canonical decision record is +> [`lan-dns-architecture.md`](lan-dns-architecture.md) (final verdict aligned, +> Phase 0 kill-test evidence incl. a measured upstream-blackhole degradation +> gap). + Scope recap (from [`lan-overview.md`](lan-overview.md), verified 2026-08-06): - Clients get DNS via EdgeRouter DHCP option 6 → AGH `192.168.66.36:53`. @@ -14,8 +22,10 @@ Scope recap (from [`lan-overview.md`](lan-overview.md), verified 2026-08-06): `https://adg.chans.xyz/dns-query`. **DNSSEC disabled** (known-bad-signature check failed on the selected path). Rewrites: `hass.local` / `hass.windy.lan`. - `gfw` OpenWrt (`.1`) runs OpenClash fake-ip + TPROXY; dnsmasq → clash DNS - `127.0.0.1#7874`. A `mosdns` binary listens on `127.0.0.1:6052` but is **not** - on the active path. + `127.0.0.1#7874`. `mosdns` on `127.0.0.1:6052` is clash's + `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution: domestic → + AGH `.36:53`, foreign → `223.5.5.5`/`119.29.29.29`); it is **not** in the LAN + client query path. - No local authoritative PTR source yet; private reverse DNS is a known gap. --- @@ -45,9 +55,12 @@ The genuinely worthwhile changes, in order of value: [blocky](https://0xerr0r.github.io/blocky/latest/configuration/#dnssec-validation)) and re-test a known-bad-signature domain; or (b) insert a validating resolver (blocky is the lightest) between AGH and the upstreams. -3. **Either actually configure mosdns or delete it.** It is idle on the active - path; leaving a half-configured listener is surface area with no benefit. If - kept, be aware its cache strips EDNS0 and it performs no DNSSEC validation +3. **mosdns on `.1` is resolved, not idle** — it is clash's + `nameserver`/`default-nameserver` (DIRECT-rule real-IP resolution, verified + 2026-08-12), so "delete it" is off the table; its role is documented in + [`lan-dns-architecture.md`](lan-dns-architecture.md) §1. If a future change + moves this role to an AGH-side companion, keep in mind mosdns's cache strips + EDNS0 and it performs no DNSSEC validation ([mosdns v5 executable plugins](https://irine-sistiana.gitbook.io/mosdns-wiki/mosdns-v5/ru-he-pei-zhi-mosdns/ke-zhi-xing-cha-jian.md)). Top-3 alternatives worth pursuing (see §3 for detail): @@ -138,7 +151,7 @@ Verdict: **Already installed and capable of the geo-split itself.** The current setup under-uses it: only a load-balanced CN pair + fallback, no per-domain routing and no validating upstream. This is the cheapest "better" state — see §5. -### 3.2 mosdns v5 — installed but idle +### 3.2 mosdns v5 — installed, active as clash nameserver (gateway-side) What it is: "一个 DNS 转发器" (a DNS forwarder) — plugin-based, sequence-driven ([README](https://github.com/IrineSistiana/mosdns), GPL-3.0, ~3.7k★).