域名解析与DoH策略治理（白名单/超时/重试）最佳实践

背景与价值域名解析是外联的前置环节。通过白名单与DoH解析策略，可降低劫持风险并提升可控性与审计性。统一规范白名单：仅允许批准域名解析与外联。超时与重试：解析请求设置超时与最大重试次数，指数退避。记录审计：对解析结果与失败原因进行结构化记录。核心实现策略与解析const allowDomains = new Set(['example.com','app.example.com'])

function domainAllowed(d: string): boolean { return allowDomains.has(d) }

function backoff(baseMs: number, attempt: number, maxMs: number): number {

const exp = Math.min(maxMs, baseMs * Math.pow(2, attempt))

const jitter = Math.random() * exp * 0.5

return Math.floor(exp * 0.75 + jitter)

}

type DoHRes = { Status: number; Answer?: { name: string; data: string; type: number }[] }

async function dohResolve(domain: string, timeoutMs: number): Promise<DoHRes | null> {

const ctrl = new AbortController()

const t = setTimeout(() => ctrl.abort(), timeoutMs)

try {

const r = await fetch('https://cloudflare-dns.com/dns-query?name=' + encodeURIComponent(domain) + '&type=A', { headers: { 'accept': 'application/dns-json' }, signal: ctrl.signal })

clearTimeout(t)

if (!r.ok) return null

return r.json()

} catch {

clearTimeout(t)

return null

}

}

type Audit = { domain: string; status: number; answers: string[] }

async function resolveWithPolicy(domain: string, attempts = 3, baseMs = 100, maxMs = 1000): Promise<Audit | null> {

if (!domainAllowed(domain)) return null

let last: DoHRes | null = null

for (let i = 0; i < attempts; i++) {

const res = await dohResolve(domain, 800)

if (res && res.Status === 0) return { domain, status: res.Status, answers: (res.Answer || []).map(a => a.data) }

last = res

await new Promise(r => setTimeout(r, backoff(baseMs, i, maxMs)))

}

if (!last) return null

return { domain, status: last.Status || -1, answers: [] }

}

落地建议解析与外联仅允许白名单域名，统一DoH通道并设置超时与重试策略。对解析结果进行审计，失败与异常统一记录并报警。配合出口治理阻断对非白名单域的直接访问。验证清单请求域名是否命中白名单；解析是否在超时与重试策略内完成。审计是否记录解析结果与失败原因。