Module dns_resolver 

QDP identity resolution — Q42 DNS Overlay.

Resolution cascade (domain input)

1. Local Q42 zone cache          (zero-network, future hook)
2. NS record encoding            query TLD authoritative NS for
                                 ns*.{did-payload}.webizen.network patterns
3. HTTP QDP discovery            GET https://<domain>/.well-known/QDP
4. DNS TXT verification          _qdp.<domain> TXT via Cloudflare DoH

did:q42: shortcut

When the caller supplies a did:q42: URI directly, parse_did_q42() resolves it to a topological pointer with zero network activity.

NS record encoding (bare-registrar support)

Registrars that only allow NS-record editing (no DNS hosting) can still participate by encoding a DID payload directly into the NS hostname:

ns1.{base58-did-payload}.webizen.network.
ns2.{base58-did-payload}.webizen.network.

The local daemon queries the TLD authoritative nameserver directly (via DoH) for the domain’s NS records, extracts the payload, and resolves it as did:q42:{payload}. This leaves zero footprint on ISP resolvers or Cloudflare’s logging layer — the TLD registry becomes a globally distributed, cryptographically anchored key-value store at no cost to the user.

IETF alignment

Addresses RFC 7258 (pervasive surveillance), RFC 9518 (centralisation paradox) and the hyperlocal-root concept (RFC 8806) by moving truth into the local Q42 zone cache and only touching the network to bootstrap into it.

Structs

QdpProfile

QDP profile fields extracted from a domain’s /.well-known/QDP response.

ResolvedIdentity

Fully resolved identity from any resolution tier.

Enums

ResolutionSource

Functions

encode_did_for_ns

Encode a did:q42: DID as the NS hostname payload suitable for publishing at a bare-registrar.

fetch_qdp_profile

Fetch https://<domain>/.well-known/QDP and parse identity fields.

ns_records_for_did

Build the full NS record pair for a given did:q42: DID.

resolve_identity

Full resolution returning a ResolvedIdentity with tier metadata.

resolve_qdp_did

Resolve domain_or_did and return the canonical DID string.

verify_front_door_did_via_dns

Verify a domain’s Front Door DID via _qdp.<domain> DNS TXT record. Uses Cloudflare DoH — no platform DNS library needed.