# Exploration report: IPFS + DNSLink + Handshake

Below is a result of exploration done by @lidel with `unidium` name on Handshake (2021-05-20).
Thank you for gifting the domain for enabling this!

[TOC]

## Setting DNSLink

Easy process. After getting the domain, setting A or TXT record can be done via UI at https://www.namebase.io/domain-manager/ubidium, no need to delegate domain to external server, one provided by default does just fine:

> 

Using DNS protocol instead of inventing own record types is a big advantage here: there is no need for running additional translation layer.

## Resolving DNSLink

This requires setting DNS resolver to one provided at hdns.io:

- https://docs.namebase.io/guides-1/resolving-handshake-1/hdns.io
- https://www.hdns.io/

Resolution over Handshake-aware DNS server works as expected:

$ dig +short TXT _dnslink.ubidium @103.196.38.39
dnslink=/ipfs/QmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR

## Opt-in: Handshake DoH for resolving specific FQDN

There is also DoH endpoint at https://query.hdns.io/dns-query which is fantastic, because it enables use in [`DNS` config](https://github.com/ipfs/go-ipfs/blob/master/docs/config.md#dns) section introduced in go-ipfs 0.9.0-rc1.

Setting Handshake as preferred resolver for `ubidium.` FQDN can be done with one-liner:

$ ipfs config --json DNS.Resolvers '{ "ubidium.": "https://query.hdns.io/dns-query" }

Or via _Settings_ screen in [ipfs-webui](https://github.com/ipfs/ipfs-webui#readme)

After restarting go-ipfs the config is applies and DNSLink resolution works as expected, content path from DNS TXT record is returned correctly:

$ ipfs resolve /ipns/ubidium
/ipfs/QmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR

At this point I knew it will also work in Brave (after we ship go-ipfs 0.9.0), so I made a quick test to confirm and produce this glorious proof:

> 

## Opt-in: Handshake DoH as global fallback resolver

It is possible to set Handshake as global DoH resolver by applying it to FQDN representing DNS root:

$ ipfs config --json DNS.Resolvers '{ ".": "https://query.hdns.io/dns-query" }

This works surprisingly well. Handshake denylisted all ICANN names, and the DoH endpoint acts like a regular DNS server for ICANN TLDs, so DNSLink on regular websites continues to work.

We have implicit defaults for `.eth` and `.crypto`, and `.` does not override those, so even ENS and UnstoppableDomains work:

$ ipfs resolve /ipns/ubidium # Handshake
/ipfs/QmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR

$ ipfs resolve /ipns/ipfs.eth # ENS
/ipfs/bafybeiddamod5xk4uipjz52xodu4z62ul5xk6lzo3qaiz32yc3t6vd7xqa

$ ipfs resolve /ipns/brave.crypto # UnstoppableDomains
/ipfs/QmWrdNJWMbvRxxzLhojVKaBDswS4KNVM7LvjsN7QbDrvka

$ ipfs resolve /ipns/en.wikipedia-on-ipfs.org # ICANN
/ipfs/bafybeiaysi4s6lnjev27ln5icwm6tueaw2vdykrtjkwiphwekaywqhcjze

Problem with setting Handshake as global resolver is sending DNS queries for ICANN names to HNS endpoint. This is a privacy concern which blocks it from being enabled by default (user needs to opt-in to that behavior, because it changes the way ICANN names are resolved).

## Open Questions

### Q1: How to make a Handshake gateway to be compatible with DNSLink websites?

I tried pointing http://ubidium.hns.to at IPFS gateway by setting ALIAS to gateway.ipfs.io:

> 

But http://ubidium.hns.to does not seems to load (will retry later).

### Q2: How to enable Handshake by default in go-ipfs?

We would like to support Handshake next to ENS and UnstoppableDomains to give users more choice, and enable naming services to compete on technical merit, without artificial onboarding barriers.

Note that ENS is a prior art similar to Handshake in that it supports arbitrary TLDs, but by default IPFS nodes only support `.eth` namespace.

#### Option A: Introduce HAndshake universe under some artificial TLD suffix?

The default DNS config in go-ipfs 0.9.0-rc1 uses OS-level resolver for ICANN names and supports `.eth` and `.crypto` via implicit DoH at https://resolver.cloudflare-eth.com/dns-query

This TLD-based separation of namespaces ensures there is no surface for conflicts or ambiguity.

Potential way to move forward for out-of-the-box Handshake support is to introduce HNS names under some TLD.
ENS has gateway at http://eth.link, and a Handshake gateway at http://hns.to exists, so perhaps `hns.to` (or `hns`)

It would be equivalent of:

$ ipfs config --json DNS.Resolvers '{ "hns.to": "https://query.hdns.io/dns-query" }

To make this work, a tweak to DoH endpoint at https://query.hdns.io/dns-query is accept queries for Handshake names with `.hns.io` suffix (or whatever is picked as its namespace) and return respective TXT record with DNSLink value.

#### Option B: ???

Perhaps there is a better way? Please write ideas below.

### Q3: TLS for Handshake names for use in js-ipfs+go-ipfs setups

Needs exploration, TBD