Can't get this to work with DiG 9.19.9

[abcbarryn]

I created a folder called /dns-query and copied the php file to index.php in that folder. I am running the PHP 8.2.21 apache module.
I tried to query DoH using the dig command and got this result...

dig @127.0.0.1 +https example.com

;; Connection to 127.0.0.1#443(127.0.0.1) for example.com failed: end of file.
;; Connection to 127.0.0.1#443(127.0.0.1) for example.com failed: end of file.
;; Connection to 127.0.0.1#443(127.0.0.1) for example.com failed: end of file.

When I switch back to BIND 9.19.9 (Development Release) server which support DoH and query that, it works fine.

dig @127.0.0.1 +https example.com

; <<>> DiG 9.19.9 <<>> @127.0.0.1 +https example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47163
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ff62e0868d4257530100000067dbec9056351e9e60a0ee27 (good)
;; QUESTION SECTION:
;example.com. IN A

;; ANSWER SECTION:
example.com. 52 IN A 23.215.0.138
example.com. 52 IN A 23.192.228.80
example.com. 52 IN A 96.7.128.198
example.com. 52 IN A 23.192.228.84
example.com. 52 IN A 23.215.0.136
example.com. 52 IN A 96.7.128.175

;; Query time: 7 msec
;; SERVER: 127.0.0.1#443(127.0.0.1) (HTTPS)
;; WHEN: Thu Mar 20 06:23:12 EDT 2025
;; MSG SIZE rcvd: 164

[gentoosys]

the same

[NotMikeDEV]

Hi,

Dig's support is limited and does not allow specifying the path, so it always sends the request to "/dns-query". If you place the file as index.php in a directory with this name then your web server will return a redirect to "/dns-query/" (added / on the end). Dig appears to (rightly IMO, even though this seems to be a violation of the specs) not follow this redirect.

I don't get the exact same error message (just says failure), however I needed to use a rewrite rule to rewrite /dns-query to the path of the php script to get this working with dig.

[abcbarryn]

Please share the exact rewrite rule(s) that you are using that work. Thanks.

[gentoosys]

This code works with dig

<?php

// Upstream DNS server (e.g., Google DNS)
$upstreamDns = '8.8.8.8';
$dnsPort = 53;

/**
 * Send DNS query over UDP and get response
 */
function resolveDns($dnsQuery, $upstream, $port) {
        $socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
        if ($socket === false) {
                throw new Exception('socket_create() failed: ' . socket_strerror(socket_last_error()));
        }

        socket_set_nonblock($socket);
        // Send DNS query
        $sent = socket_sendto($socket, $dnsQuery, strlen($dnsQuery), 0, $upstream, $port);
        if ($sent === false) {
                socket_close($socket);
                throw new Exception('socket_sendto() failed: ' . socket_strerror(socket_last_error()));
        }

        // Wait for response with timeout
        $timeout = 2; // seconds
        $tv = array('sec' => $timeout, 'usec' => 0);
        $read = array($socket);
        $write = $except = null;

        $ready = socket_select($read, $write, $except, $tv['sec'], $tv['usec']);

        if ($ready === false) {
                socket_close($socket);
                throw new Exception('socket_select() failed: ' . socket_strerror(socket_last_error()));
        } elseif ($ready === 0) {
                // Timeout
                socket_close($socket);
                throw new Exception('DNS query timed out');
        }

        // Read response
        $response = '';
        do {
                $buf = socket_recv($socket, $chunk, 512, 0);
                if ($buf === false || $buf === 0) {
                        break;
                }
                $response .= $chunk;
        } while (true);

        socket_close($socket);
        return $response;
}

/**
 * Handle incoming DoH request
 */
try {
        // Read raw DNS query from the HTTP request body
        $dnsQuery = file_get_contents('php://input');
        if (!$dnsQuery) {
                http_response_code(400);
                echo "Bad Request: No DNS query data.";
                exit;
        }

        // Resolve DNS query over UDP
        $dnsResponse = resolveDns($dnsQuery, $upstreamDns, $dnsPort);

        // Send DNS response with correct headers
        header('Content-Type: application/dns-message');
        header('Content-Length: ' . strlen($dnsResponse));
        echo $dnsResponse;
} catch (Exception $e) {
        // Handle errors
        http_response_code(500);
        echo "Internal Server Error: " . htmlspecialchars($e->getMessage());
}

[abcbarryn]

That code still leaves the rewrite issue unresolved. Please share the rewrite rule(s) that work.

[gentoosys]

    location / {
            # This is cool because no php is touched for static content.
            # include the "?$args" part so non-default permalinks doesn't break when using query string
            try_files $uri $uri/ /index.php?$args;
    }
    location ~ \.php$ {
            #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
                    include fastcgi_params;
                    fastcgi_buffers 256 4k;
                    fastcgi_intercept_errors on;
                    fastcgi_read_timeout 14400;
                    #try_files $uri =404;
                    fastcgi_pass unix:/var/run/php/php5.6-fpm.sock;
                    fastcgi_index index.php;
                    fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    }