v1.12.0 — DNS resolver engine (35 providers)

DNS resolver engine

A tunnel can be perfectly healthy and still leak every domain you visit to your
provider's resolver. This release adds a separate engine for that decision:
it switches the system resolver to a curated pair of addresses, and can put
the machine back exactly the way it was found.

Both addresses are written, primary first, so a dead primary falls through to
the secondary instead of to the DHCP server. That is the whole point of a pair
— and the old tools dns-set path could only ever set one address.

35 providers in three groups

The sanctions and speed groups start with XDNS's own lists — the exact
primary/secondary pairs that single-file Windows client switches between.

Group	Provider	Primary	Secondary
sanctions	Shecan	178.22.122.100	185.51.200.2
sanctions	Electro	78.157.42.100	78.157.42.101
sanctions	Begzar	185.55.226.26	185.55.226.25
sanctions	Radar	10.202.10.10	10.202.10.11
sanctions	403.online	10.202.10.202	10.202.10.102
sanctions	OpenDNS	208.67.222.222	208.67.220.220
speed	Yandex	77.88.8.8	77.88.8.1
speed	Cloudflare	1.1.1.1	1.0.0.1
speed	Cloudflare Security	1.1.1.2	1.0.0.2
speed	Cloudflare Family	1.1.1.3	1.0.0.3
speed	Google	8.8.8.8	8.8.4.4
speed	DNS.SB	185.222.222.222	45.11.45.11
speed	Control D	76.76.2.0	76.76.10.0
speed	Level3	4.2.2.1	4.2.2.2
speed	Vercara (Neustar)	64.6.64.6	64.6.65.6
speed	Comodo	8.26.56.26	8.20.247.20
speed	Gcore	95.85.95.85	2.56.220.2
speed	Oracle Dyn	216.146.35.35	216.146.36.36
speed	Wikimedia	185.71.138.138	—
speed	DNS4EU	86.54.11.100	86.54.11.200
extra	Quad9	9.9.9.9	149.112.112.112
extra	Quad9 Unfiltered	9.9.9.10	149.112.112.10
extra	AdGuard	94.140.14.14	94.140.15.15
extra	AdGuard Family	94.140.14.15	94.140.15.16
extra	AdGuard Unfiltered	94.140.14.140	94.140.14.141
extra	CleanBrowsing	185.228.168.9	185.228.169.9
extra	CleanBrowsing Family	185.228.168.168	185.228.169.168
extra	NextDNS	45.90.28.0	45.90.30.0
extra	Mullvad	194.242.2.2	194.242.2.4
extra	OpenDNS FamilyShield	208.67.222.123	208.67.220.123
extra	Yandex Safe	77.88.8.88	77.88.8.2
extra	Yandex Family	77.88.8.7	77.88.8.3
extra	Alibaba	223.5.5.5	223.6.6.6
extra	Tencent	119.29.29.29	182.254.116.116
extra	114DNS	114.114.114.114	114.114.115.115

69 addresses, no duplicates (a duplicate would make find() ambiguous — there
is a test for it).

Using it

blackout dns                       # what is in use, and which pair it matches
blackout dns list                  # every provider, both addresses
blackout dns list -c sanctions     # one group; add -v for the notes
blackout dns set shecan            # write BOTH Shecan addresses
blackout dns set cloudflare --adapter "Wi-Fi"
blackout dns restore               # put the old resolvers back
blackout dns bench -n 3            # time every provider, fastest first

Every command speaks --json.

How it applies, per OS

Platform	Write	Restore
Windows	netsh interface ip set/add dns … validate=no	netsh … set dns … dhcp
Linux	resolvectl dns, else /etc/resolv.conf (backed up)	resolvectl revert, else the saved file
macOS	networksetup -setdnsservers	networksetup … Empty

validate=no matters: without it netsh asks "the configured DNS server is
incorrect, continue?" on a terminal with no stdin and the command hangs.

The resolvers being replaced are snapshotted to
~/.blackout-kit/dns_state.json before anything changes, which is what
restore reads. Applying a resolver needs Administrator / root, and the
command says so instead of failing silently.

Blackout Console

A DNS screen on n: category buttons, the provider list with both addresses,
and apply / restore / flush / benchmark — each on a background worker, so a
slow netsh cannot freeze the UI.

Changed

• blackout tools dns-set <name> now reads the same catalogue instead of its
  own copy, so the two commands cannot drift apart. Side effect:
  shecan is XDNS's primary (178.22.122.100) and shecan2 is the old value
  (185.51.200.2). The <name>2 suffix now means "the secondary address of
  that provider" for every entry.
• blackout dns list uses wrap=False: at 80 columns rich was folding
  182.254.116.116 into 182.254.116.1 / 16.

Also in this release

• .claude/ is gitignored — 60 MB of agent worktrees had been sitting
  untracked in the repository root.

Verification

1658 tests pass (3 skipped: an unbuilt awg-go core, libtorrent on Windows,
and one Linux-only case). New: tests/test_dns_engine.py,
tests/test_cli_dns.py, tests/test_tui_dns.py — 41 tests covering the
catalogue values, target parsing, apply/restore bookkeeping and the TUI screen.