Resource Rules, Match Type: DNS records

[MarcHagen]

Summary

We have ASN and Country filtering, however some providers are using multiple services to call endpoints.
They often have a DNS entry for the IPs they use.

For example:

dig +short A ips.updown.io
45.32.107.181
91.121.222.175
192.99.37.47
45.63.29.207
104.238.136.194
45.32.74.41
104.238.159.87
45.76.104.117
178.63.21.176

Motivation

This reduces the complexity and duplicate rules creation for Resource Rules per site to a minimum.

Proposed Solution

Adding a Resource Rules match type DNS that frequently polls the dns record for A and AAAA entries.

Alternatives Considered

Separate rules for each entry.

Additional Context

No response

[Blacks-Army]

I actually think this is a really good idea.

It would make things way easier for cases where providers use a bunch of changing IPs, instead of having to constantly maintain lots of CIDR or IP rules.

Just a couple of things that came to mind:

• DNS poisoning / spoofing could be a concern, since the rule would depend on whatever IPs DNS returns at that moment and from which DNS resolver.
• And in some cases DNS can return a lot of IPs, which might get a bit messy or hard to manage.

But overall I really like the proposed feature just wanted to flag those edge cases.

[DennaGherlyn]

This also would allow to whitelist the public IP address of your home network based on a DynDNS record.