farrokhi/dnsdiag v2.10.0

dnsdiag 2.10.0

on GitHub

What's Changed

dnsdiag 2.10.0 moves to dnspython 2.9, which requires Python 3.11 or newer, and fixes DNS-over-HTTPS and DNS-over-QUIC in the binary packages.

Breaking Changes

• Python 3.11 or newer is required. Python 3.10 is EoL since 2026-10-01.
• dnspython 2.9.0 or newer is required. dnspython now does DoH through httpx2 instead of httpx. This changes the dependencies to dnspython[doh,doq] and httpx2. The dependency on httpx, h2 and aioquic is therefore removed.
• DoH verifies server certificates against the OS trust store, instead of certificates that are bundled with certifi. This means you will need to have system CA certificates installed (for example the ca-certificates package) on Linux.

Security

• dnspython 2.9.0 limits DNS name decompression chains, so a crafted response can no longer make name parsing use excessive CPU (GHSA-45c3-73f7-pv4m). This also impacts dnsdiag, since it parses responses from arbitrary servers.

New Features

• Added Python 3.15 support

Bug Fixes

• Fixed DoH and DoQ in the binary packages. In 2.9.4, --doh reported "python httpx module not available" and --quic crashed, because the packages did not include the package metadata dnspython checks before enabling these protocols.
• Fixed a crash in dnsping -v on EDNS options that dnspython parses into typed classes, such as Report-Channel and the EDE language and filtering options added in dnspython 2.9.
• dnsping now prints "Malformed response" and counts the query as lost when a response cannot be parsed, and dnseval shows "Invalid Response". dnspython 2.9 rejects more malformed responses than before, for example ECS options with non-zero padding bits.
• dnsping exits with an error message instead of a traceback when DoQ or DoH3 support is unavailable.

Improvements

• With --flags, the EDNS CO flag (Compact Answers OK, RFC 9824) is now shown by name, and flag bits without a name appear as FLAGn instead of being dropped.
• Docker images are built for linux/amd64 and linux/arm64 from the tagged source and are about 31 MB (down from about 171 MB).

Testing & CI/CD

• Added offline tests for transport error handling, using stubbed exceptions and local stand-in servers that send malformed replies or refuse DoH connections.
• CI tests Python 3.11 through 3.15.
• The binary build checks that DoH, DoH3 and DoQ work in every built package.

Full Changelog: v2.9.4...v2.10.0

Installation

# Using pip
pip install --upgrade dnsdiag

# Using uvx
uvx --from dnsdiag dnsping google.com

# Using pipx
pipx install dnsdiag

# Docker
docker pull farrokhi/dnsdiag:2.10.0

Binary packages: Available for Linux (x86_64, aarch64), macOS (Intel, Apple Silicon), and Windows (x86_64) in the release assets below.