Struct DnsResolver 

pub struct DnsResolver { /* private fields */ }

Async DNS resolver for crawler verification with rate limiting.

Implementations

impl DnsResolver

pub async fn new( timeout_ms: u64, max_concurrent: usize, ) -> Result<Self, DnsError>

Create a new DNS resolver with rate limiting.

Arguments

• timeout_ms - DNS lookup timeout in milliseconds
• max_concurrent - Maximum concurrent DNS lookups (semaphore permits)

pub fn available_permits(&self) -> usize

Get current number of available permits (for metrics)

pub fn max_concurrent(&self) -> usize

Get maximum concurrent lookups configured

pub async fn reverse_lookup( &self, ip: IpAddr, ) -> Result<Option<String>, DnsError>

Reverse DNS lookup: IP -> hostname.

Rate-limited via semaphore to prevent resource exhaustion.

pub async fn forward_lookup( &self, hostname: &str, ) -> Result<Vec<IpAddr>, DnsError>

Forward DNS lookup: hostname -> IPs.

Rate-limited via semaphore to prevent resource exhaustion.

pub async fn verify_ip( &self, ip: IpAddr, ) -> Result<(bool, Option<String>), DnsError>

Verify IP via reverse+forward DNS lookup.

Returns (verified, hostname) where verified is true only if:

1. Reverse lookup (IP -> hostname) succeeds
2. Forward lookup (hostname -> IPs) succeeds
3. Original IP is contained in the forward lookup results

This prevents DNS rebinding attacks where an attacker controls a domain that initially resolves to a legitimate IP, then changes after verification.

Security

The IP round-trip check is critical: we verify that the hostname the IP claims to be actually resolves back to that IP.

pub async fn verify_ip_strict(&self, ip: IpAddr) -> Result<String, DnsError>

Verify IP with explicit rebinding protection.

Same as verify_ip but returns a specific error on IP mismatch instead of just returning (false, hostname).

Trait Implementations

impl Debug for DnsResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.