dnsdist: Is there a way to start DoT for specific domain name (wild-card certificate)?

[ousatov-ua]

Hi all!
Can you please help me?
I have a wild-card certificate: *.my-domain.name.
I want to start local DoT (addTLSLocal) for only specific domain requested:

client-1.my-domain.name
client-2.my-domain.name

Is there a way to do it?

Thank you in advance!

[rgacogne]

No, it's not possible to only listen for specific domains as we listen on an IP address and port. It is possible to filter queries during the rule processing on the TLS name requested by the client, see SNIRule: https://dnsdist.org/reference/selectors.html#SNIRule

[ousatov-ua]

@rgacogne Thank you!