Parsing DNS replies in DNS proxy network extension

Question

Created Jul ’25

Replies 2

Boosts 0

Participants 2

Context

I'm working on a DNS proxy network extension and would like to be able to parse replies from the upstream DNS server for extracting the TTL for caching purposes.

I already have a working DNS proxy network extension, but at the moment I am not handling the responses and just forward all queries to an upstream DNS server.

My understanding is that I have to take care of result caching myself because I cannot use the system resolver in the DNS proxy network extension.

Question

What is the best way to parse DNS replies in Swift to extract e.g. the TTL?

I found an old thread (https://forums.swift.org/t/parse-dns-packet-requests-and-responses/41797/5) describing a way to achieve this using dns_util. The solution described there works - but dns_parse_packet in dns_util have been marked deprecated since iOS 16. So, I am wondering if there is a better way to achieve the parser.

I tried to utilize the dnssd framework but was unable to figure out how to achieve only parsing of the raw DNS reply. If that is possible it would be great to get some pointers.

Answered by DTS Engineer in 851122022

<dns_util.h> is still supported, in the sense that I’ll answer questions about it. However, it’s not really the right answer here.

IMO what you need here is a modern DNS packet parsing library, written in Swift, that avoids unsafe constructs. That’s my ‘gold standard’ for parsing complex structures coming from an untrusted source. {mac,i}OS doesn’t have such an API, so you’ll need to either write or acquire it.

There are such libraries available from other third-party developers. I don’t have direct experience with them, so I can’t offer any opinions. You’ll have to evaluate them like you would any other proposed dependency.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

da-kami OP

Jul ’25

I dug through some more code and docs; here's some findings:

Tech note TN3151: Choosing the right networking API | Apple Developer Documentation still mentions that dns_util is the way to go for handling DNS outside of the system resolver
It may be possible to use the NIO based NIODns client https://github.com/orlandos-nl/DNSClient - it includes message decoding but I feel using NIODns is a bit of an overkill for my network extension (at least for now)

Given that the tech notes mention to use dns_parse_packet in dns_util I assume it should still be supported.

Eskimo, if you come across this post it would be great to get your 2 cents for what is recommended for my use-case.

0

Answer 2

DTS Engineer OP

Apple

Jul ’25

Recommended

<dns_util.h> is still supported, in the sense that I’ll answer questions about it. However, it’s not really the right answer here.

IMO what you need here is a modern DNS packet parsing library, written in Swift, that avoids unsafe constructs. That’s my ‘gold standard’ for parsing complex structures coming from an untrusted source. {mac,i}OS doesn’t have such an API, so you’ll need to either write or acquire it.

There are such libraries available from other third-party developers. I don’t have direct experience with them, so I can’t offer any opinions. You’ll have to evaluate them like you would any other proposed dependency.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0