I think this has a good chance of working! I've been fiddling with my wifi's dns settings by putting in resolver IPs that go nowhere. With this snippet, my SDK can still reach the proper destination (and without this snippet, it cannot):
/// The constants below are taken from Cloudflare's DNS over TLS reference:
/// https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/
///
/// The approach is from Quinn the Eskimo's forum post:
/// https://developer.apple.com/forums/thread/780602
func myURLSession() -> URLSession {
let host = NWEndpoint.hostPort(host: "one.one.one.one", port: 853)
let endpoints: [NWEndpoint] = [
.hostPort(host: "1.1.1.1", port: 853),
.hostPort(host: "1.0.0.1", port: 853),
.hostPort(host: "2606:4700:4700::1111", port: 853),
.hostPort(host: "2606:4700:4700::1001", port: 853)
]
let c = NWParameters.PrivacyContext.default
c.requireEncryptedNameResolution(true, fallbackResolver: .tls(host, serverAddresses: endpoints))
return URLSession(
configuration: .ephemeral,
delegate: self.delegate,
delegateQueue: nil
)
}
I'm not sure what happens when the system can access a valid resolver, but one that is missing my A records. Perhaps apple's framework will trust the first response as authoritative, without falling back to fallbackResolver to try again.
This is likely a nonissue, though, because I have my doubts that Comcast has a resolver that will satisfy requireEncryptedNameResolution to begin with.
Going to try a limited test in the wild.
Thank you Quinn!
