DNS Resolver

Filter malware, trackers, and custom domains at the DNS layer.

Every proxy resolves domain names before forwarding a request. By default, proxies use your host machine's system resolver. CIFP DNS lets you swap that out for a private, security-hardened DNS resolver that actively blocks malware, ad networks, and data-exfiltration attempts — before a single byte of traffic leaves your proxy.

Pro+ feature

The CIFP DNS resolver and per-proxy blocklist management are available on the Pro+ plan. All other resolver presets (Quad9, Cloudflare, Google) are available on all plans.

Resolver Presets

Open the proxy detail page and click the DNS tab to choose a resolver. Changes take effect within seconds — no proxy restart required.

Preset	Address	Description
`system`	Host default	The proxy machine's default resolver. No filtering.
`cloudflare`	`1.1.1.1` / `1.0.0.1`	Fast public resolver. No content filtering.
`google`	`8.8.8.8` / `8.8.4.4`	Google Public DNS. No content filtering.
`quad9`	`9.9.9.9` / `149.112.112.112`	Blocks known malicious domains using threat intelligence feeds.
`cifp`	`cifp-dns.vril.dev`	Pro+ — private resolver with blocklists, custom domains, and entropy detection.

How CIFP DNS Works

When you set a proxy to the cifp preset, the proxy's sidecar automatically obtains a short-lived cryptographic token and registers your proxy's custom blocklist configuration with the CIFP DNS server. From that point on, every DNS query from your proxy passes through three checks before being forwarded upstream:

Entropy check — The name of each DNS label is scored using Shannon entropy. Labels with abnormally high randomness (long strings of mixed letters, digits, and dashes) are blocked with NXDOMAIN. This catches DGA malware, DNS tunnelling tools, and base64-encoded data exfiltration in the domain name itself — before any connection is made.
Blocklist lookup — The full domain is checked against a merged, in-memory Bloom filter built from your enabled blocklist subscriptions plus any custom domains you have added. Bloom filter lookups are O(1) regardless of blocklist size.
DNS-over-HTTPS forwarding — Clean queries are forwarded to Cloudflare's DoH endpoint (https://cloudflare-dns.com/dns-query) over an encrypted HTTPS connection, preventing DNS interception on the path between your proxy and the upstream resolver.

If a domain is blocked at any stage, the resolver returns NXDOMAIN. The connection attempt fails before any network traffic leaves your proxy to that destination.

Blocklist Subscriptions

On the DNS → Blocklists tab of your proxy, you can subscribe to curated community blocklists. Each subscription is per-proxy — different proxies can have different blocklist configurations.

List	Focus	Approx. size
OISD Small	Ads, trackers	~50 k domains
OISD Big	Ads, trackers, social widgets	~250 k domains
StevenBlack Unified	Ads, malware, gambling, adult	~150 k domains
URLhaus	Active malware distribution URLs	~30 k domains
Malware Domains	Known malware C2 and delivery	~30 k domains

Blocklists are refreshed automatically every 24 hours. You can trigger an immediate refresh from the dashboard or via the API.

Custom Blocked Domains

You can add your own domains to block on a per-proxy basis. These are pushed to the CIFP DNS server in real time whenever you add or remove them — no sync delay.

bash

# Add a custom blocked domain via API
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/blocklists/custom \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"domain": "malicious-site.example.com"}'

# Remove a custom blocked domain
curl -X DELETE https://cifp.vril.dev/api/proxies/proxy-id/blocklists/custom \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{"domain": "malicious-site.example.com"}'

API Reference

Get current resolver

bash

GET /api/proxies/:id/dns-resolver

curl https://cifp.vril.dev/api/proxies/proxy-id/dns-resolver \
  -H "Authorization: Bearer cifp_your_api_key"

Response

{
  "preset": "cifp",
  "nameservers": ["159.65.174.78"]
}

Set resolver

bash

PATCH /api/proxies/:id/dns-resolver

curl -X PATCH https://cifp.vril.dev/api/proxies/proxy-id/dns-resolver \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"preset": "cifp"}'

Get blocklist subscriptions

bash

GET /api/proxies/:id/blocklists

curl https://cifp.vril.dev/api/proxies/proxy-id/blocklists \
  -H "Authorization: Bearer cifp_your_api_key"

Response

{
  "subscriptions": [
    { "key": "oisd-small",      "name": "OISD Small",          "enabled": true  },
    { "key": "oisd-big",        "name": "OISD Big",             "enabled": false },
    { "key": "stevenblack",     "name": "StevenBlack Unified",  "enabled": true  },
    { "key": "urlhaus",         "name": "URLhaus",              "enabled": true  },
    { "key": "malware-domains", "name": "Malware Domains",      "enabled": false }
  ],
  "customDomains": ["internal-bad-actor.corp"]
}

Enable / disable a blocklist

bash

PATCH /api/proxies/:id/blocklists/:key

curl -X PATCH https://cifp.vril.dev/api/proxies/proxy-id/blocklists/oisd-big \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"enabled": true}'

Force blocklist refresh

bash

POST /api/proxies/:id/blocklists/refresh

curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/blocklists/refresh \
  -H "Authorization: Bearer cifp_your_api_key"

Security Notes

The CIFP DNS resolver is self-hosted on a dedicated cloud instance at cifp-dns.vril.dev. It is not a shared public resolver — only proxies with valid, non-expired JWT tokens can push custom blocklist configuration.
JWT tokens are obtained automatically by your proxy's sidecar using its existingINTERNAL_API_KEY. There is nothing to configure. Tokens are short-lived (1 hour) and refreshed in the background every 50 minutes.
DNS queries over port 53 are not authenticated (standard DNS protocol limitation). The authentication applies to the blocklist management API, not to individual DNS lookups.
Entropy-based blocking has a configurable threshold. The default value is tuned to avoid false positives on legitimate CDN hostnames while catching practical DGA patterns.