Local Rules First
Hosts-style A/AAAA overrides with hot reload and live query telemetry.
A protected, binary-only macOS resolver for deterministic local overrides, encrypted upstream forwarding, and operator-grade observability—without shipping source.
Industrial-track positioning: deployable artifact, documented tradeoffs, and a validation harness—optimized for single-seat macOS workflows.
Hosts-style A/AAAA overrides with hot reload and live query telemetry.
DoH, DoT, and dual-stack UDP with failover across resolver targets.
Protected encrypted artifacts. No Swift source ships to operators.
Menu bar resident service with optional port 53 pf redirect.
[macOS apps] --UDP--> +------------------+
| DNSEngine |
| RulesIndex O(1) |
+--------+---------+
|
+-------------+-------------+
| local hit | miss |
v v v
[A/AAAA answer] [DoH/DoT/UDP upstream]
|
[Query log / menu bar UI]
Loopback DNS stays classic UDP. Upstream legs encrypt via DoH or DoT. Default listen port is 5300 with optional pf redirect from port 53.
Homebrew tap → trust → install. Binary-only payload.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"brew tap shyamalschandra/tapbrew trust --tap shyamalschandra/tapbrew install dns-server-mosopen "$(brew --prefix dns-server-mos)/MenuBarDNS.app", add 127.0.0.1 to macOS DNS, then enable the port 53 redirect in Settings.Public artifacts exposed for Homebrew verification. Repository source remains private; only encrypted binaries and tap metadata are published here.
Homebrew downloads the encrypted artifact, verifies SHA-256, decrypts at install time, and places dns-server-mos plus MenuBarDNS.app.
IEEE-style industrial-track design paper for dns-server-mos. Download or read inline below.