docs/Cloudflare-DoH-Worker.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="620px" preserveAspectRatio="none" style="width:1399px;height:620px;background:#FFFFFF;" version="1.1" viewBox="0 0 1399 620" width="1399px" zoomAndPan="magnify"><defs/><g><rect height="26.7999" style="stroke:#00000000;stroke-width:1.0;fill:none;" width="300" x="551.25" y="10"/><text fill="#000000" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="290" x="556.25" y="28.9999">Cloudflare DoH Worker Sequence Diagram</text><rect fill="#FFFFFF" height="490.6003" style="stroke:#181818;stroke-width:1.0;" width="10" x="579" y="84.5999"/><rect height="254.4001" style="stroke:#000000;stroke-width:1.5;fill:none;" width="559" x="834.5" y="121.1999"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="584" x2="584" y1="74.5999" y2="584.2001"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="906.5" x2="906.5" y1="74.5999" y2="584.2001"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="1150.5" x2="1150.5" y1="74.5999" y2="584.2001"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="1227.5" x2="1227.5" y1="74.5999" y2="584.2001"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="1289.5" x2="1289.5" y1="74.5999" y2="584.2001"/><line style="stroke:#181818;stroke-width:0.5;fill:none;stroke-dasharray:5.0,5.0;" x1="1347.5" x2="1347.5" y1="74.5999" y2="584.2001"/><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="82" x="543" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="68" x="550" y="63.7999">DNS Client</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="82" x="543" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="68" x="550" y="604.2001">DNS Client</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="125" x="844.5" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="111" x="851.5" y="63.7999">Cloudflare Worker</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="125" x="844.5" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="111" x="851.5" y="604.2001">Cloudflare Worker</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="57" x="1122.5" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="43" x="1129.5" y="63.7999">Quad9</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="57" x="1122.5" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="43" x="1129.5" y="604.2001">Quad9</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="77" x="1189.5" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="63" x="1196.5" y="63.7999">Cloudflare</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="77" x="1189.5" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="63" x="1196.5" y="604.2001">Cloudflare</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="26" x="1276.5" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="12" x="1283.5" y="63.7999">...</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="26" x="1276.5" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="12" x="1283.5" y="604.2001">...</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="71" x="1312.5" y="42.7999"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="57" x="1319.5" y="63.7999">NextDNS</text><rect fill="#E2E2F0" height="30.7999" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="71" x="1312.5" y="583.2001"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="57" x="1319.5" y="604.2001">NextDNS</text><rect fill="#FFFFFF" height="490.6003" style="stroke:#181818;stroke-width:1.0;" width="10" x="579" y="84.5999"/><polygon fill="#181818" points="895,102.1999,905,106.1999,895,110.1999,899,106.1999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="589" x2="901" y1="106.1999" y2="106.1999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="294" x="596" y="101.5999">GET https://cloudflare-worker-domain/endpoint/path</text><path d="M834.5,121.1999 L927.5,121.1999 L927.5,128.7999 L917.5,138.7999 L834.5,138.7999 L834.5,121.1999 " fill="#EEEEEE" style="stroke:#000000;stroke-width:1.5;"/><rect fill="none" height="254.4001" style="stroke:#000000;stroke-width:1.5;" width="559" x="834.5" y="121.1999"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacing" textLength="48" x="849.5" y="135.1999">Parallel</text><polygon fill="#181818" points="1139,156.3999,1149,160.3999,1139,164.3999,1143,160.3999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="907" x2="1145" y1="160.3999" y2="160.3999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="220" x="914" y="155.7999">GET https://dns11.quad9.net/dns-query</text><polygon fill="#181818" points="918,185.9999,908,189.9999,918,193.9999,914,189.9999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="912" x2="1150" y1="189.9999" y2="189.9999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="127" x="924" y="185.3999">Quad9 DNS Response</text><polygon fill="#181818" points="1216,215.5999,1226,219.5999,1216,223.5999,1220,219.5999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="907" x2="1222" y1="219.5999" y2="219.5999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="235" x="914" y="214.9999">GET https://cloudflare-dns.com/dns-query</text><polygon fill="#181818" points="918,245.1999,908,249.1999,918,253.1999,914,249.1999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="912" x2="1227" y1="249.1999" y2="249.1999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="147" x="924" y="244.5999">Cloudflare DNS Response</text><polygon fill="#181818" points="1277.5,274.7999,1287.5,278.7999,1277.5,282.7999,1281.5,278.7999" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="907" x2="1283.5" y1="278.7999" y2="278.7999"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="240" x="914" y="274.1999">GET https://some-other-provider/dns-query</text><polygon fill="#181818" points="918,304.4,908,308.4,918,312.4,914,308.4" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="912" x2="1288.5" y1="308.4" y2="308.4"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="208" x="924" y="303.8">Some Other Provider DNS Response</text><polygon fill="#181818" points="1336,334,1346,338,1336,342,1340,338" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="907" x2="1342" y1="338" y2="338"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="304" x="914" y="333.4">GET https://dns.nextdns.io/abc123 &lt;- Configuration ID</text><polygon fill="#181818" points="918,363.6,908,367.6,918,371.6,914,367.6" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="912" x2="1347" y1="367.6" y2="367.6"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="142" x="924" y="363">NextDNS DNS Response</text><polygon fill="#181818" points="600,481.2001,590,485.2001,600,489.2001,596,485.2001" style="stroke:#181818;stroke-width:1.0;"/><line style="stroke:#181818;stroke-width:1.0;" x1="594" x2="906" y1="485.2001" y2="485.2001"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="191" x="606" y="480.6001">Cloudflare Worker DNS Response</text><path d="M5,387.6 L5,568.6 L574,568.6 L574,397.6 L564,387.6 L5,387.6 " fill="#FEFFDD" style="stroke:#181818;stroke-width:0.5;"/><path d="M564,387.6 L564,397.6 L574,397.6 L564,387.6 " fill="#FEFFDD" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="257" x="11" y="405.6">If any of the DNS Providers respond back with</text><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacing" textLength="48" x="271" y="405.6">0.0.0.0/0</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="11" x="322" y="405.6">or</text><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacing" textLength="6" x="336" y="405.6">::</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="114" x="342" y="405.6">, they are marked as</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="45" x="459" y="405.6">blocked</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="3" x="504" y="405.6">.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="257" x="11" y="421.2">If any of the DNS Providers respond back with</text><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacing" textLength="72" x="271" y="421.2">NXDOMAIN</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="114" x="343" y="421.2">, they are marked as</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="96" x="460" y="421.2">possibly blocked</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="3" x="556" y="421.2">.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="4" x="11" y="436.8"> </text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="281" x="11" y="452.4">The first condition that matches sends a response:</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="182" x="17" y="468.0001">* The response at the start of the</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="45" x="202" y="468.0001">blocked</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="16" x="250" y="468.0001">list</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="182" x="17" y="483.6001">* The response at the start of the</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="96" x="202" y="483.6001">possibly blocked</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="16" x="301" y="483.6001">list</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="248" x="17" y="499.2001">* An error if multiple providers are marked as</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="28" x="268" y="499.2001">main</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="267" x="17" y="514.8001">* An error if all providers responded with an error</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="30" x="17" y="530.4001">* The</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="62" x="50" y="530.4001">successful</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="211" x="115" y="530.4001">response from the provider marked as</text><text fill="#000000" font-family="sans-serif" font-size="13" font-style="italic" lengthAdjust="spacing" textLength="28" x="329" y="530.4001">main</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="263" x="17" y="546.0001">* The response from any provider that didn't fail</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="276" x="17" y="561.6001">* An error because we don't know what happened</text><!--MD5=[e83c22713a2ee53bf48eb4893f695c13]
@startuml
title Cloudflare DoH Worker Sequence Diagram

activate "DNS Client"

"DNS Client" -> "Cloudflare Worker": GET https://cloudflare-worker-domain/endpoint/path

group Parallel
  "Cloudflare Worker" -> "Quad9": GET https://dns11.quad9.net/dns-query
  "Cloudflare Worker" <- "Quad9": Quad9 DNS Response
  "Cloudflare Worker" -> "Cloudflare": GET https://cloudflare-dns.com/dns-query
  "Cloudflare Worker" <- "Cloudflare": Cloudflare DNS Response
  "Cloudflare Worker" -> ...: GET https://some-other-provider/dns-query
  "Cloudflare Worker" <- ...: Some Other Provider DNS Response
  "Cloudflare Worker" -> "NextDNS": GET https://dns.nextdns.io/abc123 <- Configuration ID
  "Cloudflare Worker" <- "NextDNS": NextDNS DNS Response
end

"Cloudflare Worker" -> "DNS Client": Cloudflare Worker DNS Response

note left
  If any of the DNS Providers respond back with **0.0.0.0/0** or **::**, they are marked as //blocked//.
  If any of the DNS Providers respond back with **NXDOMAIN**, they are marked as //possibly blocked//.

  The first condition that matches sends a response:
    * The response at the start of the //blocked// list
    * The response at the start of the //possibly blocked// list
    * An error if multiple providers are marked as //main//
    * An error if all providers responded with an error
    * The //successful// response from the provider marked as //main//
    * The response from any provider that didn't fail
    * An error because we don't know what happened
end note
@enduml

PlantUML version 1.2022.5(Sat Apr 30 10:55:52 GMT 2022)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Default Encoding: UTF-8
Language: en
Country: US
--></g></svg>