EnclaveDNS

EnclaveDNS client for Linux, Windows and Android: DNS through EnclaveDNS (DNSSEC in an attested enclave), and .eth sites in the browser over local IPFS, Swarm, Arweave and Tor

Your device's DNS through EnclaveDNS, and .eth sites in an ordinary browser. For Linux, Windows and Android.

EnclaveDNS is a validating DNSSEC resolver that runs in an attested enclave on enclave.host: it checks every answer's signatures from the DNS root down before handing it out, keeps no query logs, and resolves ENS (.eth) names natively. This client makes a device use it:

All DNS goes to EnclaveDNS over DNS-over-HTTPS, through a local cache. If EnclaveDNS cannot be reached, lookups go to the device's own DNS (the servers its network provides) until it can. An answer from EnclaveDNS is final, SERVFAIL included, which is how a DNSSEC failure looks, so a forged answer is never "rescued" by the fallback. Set strict = true to use EnclaveDNS only: lookups then fail while it cannot be reached. .eth sites open in the browser. Most ENS names point at content (an IPFS or Swarm hash, an Arweave transaction, a Tor onion service), not an IP address. The client answers those names with a local gateway address and serves the site from software on your own machine: kubo (IPFS/IPNS), Bee (Swarm), an AR.IO gateway (Arweave) or Tor. It never falls back to a public gateway. When the software is missing, the browser gets a page that says which and how to start it, instead of "This site can't be reached". A url text record redirects, and a name with only a wallet address gets a page showing what it holds. Names with real DNS records stored on-chain keep them. HTTPS for .eth. No public CA can issue a certificate for an ENS name, so the client makes its own on first start, and signs a certificate per name on demand. The CA carries an X.509 name constraint (DNS:eth, DNS:ens): browsers reject anything it signs for any other name, even if its key leaked. The key never leaves the client's state directory, readable by the service alone. Many dapps require HTTPS, and Web Crypto, service workers and wallets need a secure context. Local names keep working. Names only your network knows (*.lan, a router's own zone) go to the network's own DNS servers. Firefox is told to keep its own DNS-over-HTTPS off (use-application-dns.net), so it uses the system resolver too. DNS never depends on a dead client. A watchdog (a systemd timer on Linux, a SYSTEM scheduled task on Windows) checks every minute that the client answers. If it does not, it restarts it; if it still does not, it gives DNS back to the network's own servers until the client answers again (with strict = true it only restarts it).

License

Enclave Source-Available License v1.0