DoH virtual sites
A virtual site assigns a runtime to a policy through a DoH endpoint at https://doh.securd.com/{address}, with no IP registration. The address identifies the policy and is handled as a credential.
Configuration and reference code for DoH virtual sites
Where the URL comes from
Create a virtual site in the console and copy the URL. Each virtual site binds to a policy.
https://doh.securd.com/<address>
Runtimes that speak DoH natively
Configure the runtime with the URL. Node 20 and later support a custom resolver; browsers and mobile operating systems accept a DoH profile through MDM.
// Node: resolve a name through the Securd identity before fetching
async function dohLookup(name: string): Promise<string[]> {
const url = `https://doh.securd.com/${process.env.SECURD_DOH_ADDRESS}?name=${encodeURIComponent(name)}&type=A`;
const res = await fetch(url, { headers: { accept: "application/dns-json" } });
const json = await res.json();
return (json.Answer ?? []).filter((a: any) => a.type === 1).map((a: any) => a.data);
}
Runtimes that do not
Run a local DoH-to-Do53 proxy (cloudflared, dnsproxy, or dnscrypt-proxy) configured with the virtual site URL, and set the operating system resolver to 127.0.0.1. The runtime requires no changes.
dnsproxy -l 127.0.0.1 -p 53 -u "https://doh.securd.com/$SECURD_DOH_ADDRESS"
Address handling
Any client with the address resolves under the policy and appears in the compartment's logs. Store the address in a secret manager and rotate it by creating a new virtual site.
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the recorded destinations with your team.