Improvements

• Reworked DNS resolution logic to support both A and AAAA records
• Added recursive resolution for CNAME chains, improving accuracy in CDN and complex DNS setups
• Improved fallback handling when IP is not available from webRequest
• Enhanced DoH queries using multiple resolvers (Cloudflare and Google) with response validation
• Added deduplication of DNS responses to avoid redundant IP entries

New Features

• ASN validation using RIPEstat API
• Verification of IP against announced ASN prefixes for better ownership validation
• FCrDNS (Forward-confirmed reverse DNS) validation added as an additional trust layer
• TLS detection to identify if the connection is encrypted (HTTPS vs HTTP)
• Real-time badge updates with priority-based status (OK, SUSPICIOUS, CRITICAL)
• Smart notification system with rate limiting to prevent alert spam

Security Enhancements

• Multi-layer validation strategy combining:

• Direct DNS resolution
• ASN ownership verification
• Reverse DNS validation (FCrDNS)

• Improved detection of:

• DNS mismatches
• Rogue or unexpected IP addresses
• Invalid ASN associations

Behavior Changes

• Status evaluation logic refined to reduce false positives in CDN scenarios
• Domains not directly matching DNS can now be validated via reverse lookup (FCrDNS)
• ASN lookup failures are now handled gracefully and marked as UNKNOWN instead of breaking analysis
• DNS queries now fallback to CNAME when A records are missing

Fixes

• Fixed issues where invalid JSON responses from DoH resolvers could break analysis
• Improved error handling for network failures and external API issues
• Fixed cases where missing IP information resulted in incorrect status
• Prevented duplicate DNS results from affecting validation logic

Internal Changes

• Refactored DNS query handling for better reliability and fault tolerance
• Added CIDR matching logic for ASN prefix validation
• Improved tab-based state tracking for results and badge status

Known Limitations

• ASN validation depends on external API availability (RIPEstat)
• Recursive DNS resolution may not cover all edge cases in deeply nested configurations
• Some CDN scenarios may still require further tuning for perfect accuracy