Repository navigation
S4 — DNS steering fails closed #2252
Description
Slice
A steered name answers SERVFAIL while the proxy is down, AAAA, HTTPS and SVCB answer NODATA, and UDP 443 from a blocked box is rejected at once.
Tasks:
- T30 — Steer credentialed names to the proxy and fail closed while it is down #2281 — Steer credentialed names to the proxy and fail closed while it is down
- T31 — Reject UDP to port 443 where a box's QUIC stance is blocked #2282 — Reject UDP to port 443 where a box's QUIC stance is blocked
- T32 — DNS steering fails closed, end to end #2289 — DNS steering fails closed, end to end
Activity
norrietaylor commentedon Oct 31, 2026
Closing in the 2026-10-31 backlog triage: the work has shipped.
Evidence: All tasks closed COMPLETED: #2281 (T30), #2282 (T31) and #2289 (T32, e2e). Follow-up #2515 (host_ip cohort QUIC) is tracked separately.
Two independent reviewers checked this closure; neither refuted it. Reopen if it's wrong.