DnsClientX 2.3.1

The PowerShell Gallery package preserves Authenticode signatures on its manifest-loaded format and type XML. I've rebuilt it with the shared publisher fix from PSPublishModule #1233.

This patch includes 2.3.0's Native AOT compatibility work across the .NET 8 and .NET 10 libraries. Library-owned response and persistence JSON uses generated contracts, and caller-owned payloads can supply JsonTypeInfo metadata. General serializers and dynamic provider loaders retain explicit annotations.

Native consumer checks cover loopback resolution, typed answers, caching, JSON, profiles and scores, Ed25519 signatures, ODoH configuration and DNSCrypt native asset loading on Windows, Linux and macOS for both modern targets. The core NuGet package, PowerShell module and 12 CLI archives are included. Optional providers remain source-only.

DnsClientX 2.3.0

DnsClientX's .NET 8 and .NET 10 libraries are trim and Native AOT compatible. Library-owned response and persistence JSON uses generated contracts, and caller-owned payloads can supply JsonTypeInfo metadata. Existing general serializers and dynamic provider loaders retain explicit annotations.

Strict analyzers and native publish/runtime checks cover both modern targets on Windows, Linux and macOS. The consumer checks loopback resolution, typed answers, caching, JSON, profiles and scores, Ed25519 signatures, ODoH configuration and DNSCrypt native asset loading. Legacy test fixtures now complete UDP receives against their owned sockets.

The release contains the core NuGet package and PowerShell module. The optional provider projects remain source-only.

PowerShell Gallery signing issue

The format and type XML files in the 2.3.0 Gallery package lack Authenticode signatures, which prevents importing them under an AllSigned execution policy. The GitHub module ZIP retains valid signatures on those files. The shared publisher fix is included in PSPublishModule #1233, and a corrected DnsClientX patch is being prepared.

2.2.0 - 2026-11-02

The CLI archives cover Windows, Linux and macOS on x64 and ARM64. They are framework-dependent: choose the .NET 8 or .NET 10 archive matching your installed runtime. Windows CLI executables are signed.

• Publish the core NuGet package, PowerShell module and CLI archives without optional provider dependencies. DnsClientX.Odoh, DnsClientX.DnsCrypt and DnsClientX.DnsSec.EdDsa are not published on NuGet and are excluded from this release; their examples require source-built providers.

• Include the DNS correctness, configuration, DNSSEC, cache and cross-platform workflow fixes from #581, authenticated DNS administration and discovery workflows from #582, and stable resolver-candidate identity and reporting from #583.

• Add a deterministic provider-by-transport JSON catalog at Assets/Data/provider-profiles.json, generated with the README from the library's supported formats and default configurations. Packaged-module validation checks both outputs against the library.

• Refresh dependencies and improve regression coverage across the supported .NET and PowerShell targets.

• Normalize recognized JSON EDE comments into structured extended DNS errors without replacing provider comments or explicit error arrays.

• Select published provider transports without changing existing preset defaults, with shared provider definitions for configuration, resolver expansion and generated documentation.

• Configure DNSCrypt and ODoH providers from role-specific DNS stamps, inspect privacy stamps from CLI/PowerShell, and load trusted optional providers explicitly for queries without adding crypto dependencies to the core or CLI.

• Add New-DnsPrivacyTransport for caller-owned PowerShell setup and CLI privacy query options using the shared response and explanation workflow.

• Preserve completed TCP/DoT replies when a peer closes while the request write finishes, avoiding a false failure and duplicate retry.

• Add data_normalized to record JSON while preserving the existing raw data field.

• Show provider diagnostics in regular CLI text output and include DNS status in PowerShell warnings through shared display-safe formatting.

• Give cooperative PowerShell query cleanup up to one second to finish when the pipeline is stopped, using the canonical async cmdlet implementation.

• Add CleanBrowsing Security, Adult, and Family DoH presets, and Control D Unfiltered, Malware, Ads & Tracking, and Family DoH presets.

• Add Comodo Secure DNS and DNS.WATCH plain-DNS presets, including DNS.WATCH's IPv6 resolvers.

• Refresh AdGuard presets to the current adguard-dns.com hostnames and share their endpoint definitions with multi-resolver queries.

• Document personal NextDNS profile URLs and distinguish generic resolution, filtering policy, and encrypted transports.

What's Changed

• Bind shared Resolve-Dns options consistently across resolver sources by @PrzemyslawKlys in #573
• Unify SVCB and HTTPS records and preserve DNS response evidence by @PrzemyslawKlys in #574
• Record DnsClientX 2.1.1 release version metadata by @PrzemyslawKlys in #577
• Validate compact DNSSEC denial consistently across query paths by @PrzemyslawKlys in #576
• Unify DNSSEC algorithm capabilities and optional provider configuration by @PrzemyslawKlys in #575
• Restore authored PowerShell command examples by @PrzemyslawKlys in #578
• Reject NXNAME updates and clarify command help by @PrzemyslawKlys in #580

Full Changelog: Compare DnsClientX-v2.1.1 to DnsClientX-v2.1.2

What's Changed

• Unify asynchronous PowerShell cmdlet lifecycle by @PrzemyslawKlys in #527
• build: 🧹 Use PowerForge native cmdlet documentation by @PrzemyslawKlys in #528
• Bump BouncyCastle.Cryptography from 2.6.2 to 2.7.0 by @dependabot[bot] in #529
• Configure grouped low-noise Dependabot updates by @PrzemyslawKlys in #530
• build(deps): bump the all-dependencies group with 5 updates by @dependabot[bot] in #531
• Bump the all-dependencies group with 2 updates by @dependabot[bot] in #532
• Bump the all-dependencies group with 1 update by @dependabot[bot] in #533
• Bump the all-dependencies group with 1 update by @dependabot[bot] in #534
• Bump the all-dependencies group with 3 updates by @dependabot[bot] in #535
• Bump the all-dependencies group with 1 update by @dependabot[bot] in #536
• Fix DNSSEC proof authority and authenticated cache lifetimes by @PrzemyslawKlys in #537
• Recover lost DNS stream replies and preserve root query options by @PrzemyslawKlys in #538
• Preserve DNS response fidelity and isolate resolver policies by @PrzemyslawKlys in #539
• Stabilize cross-platform DNS test fixtures by @PrzemyslawKlys in #540
• Bind DNSSEC validation to response status and requested name by @PrzemyslawKlys in #541
• Bind DNSSEC compatibility checks to signed key material by @PrzemyslawKlys in #542
• Make resolver cooldown test independent of runner timing by @PrzemyslawKlys in #544
• Bound resolver-list URL imports before buffering by @PrzemyslawKlys in #543
• Bound HTTP DNS response bodies and validate success envelopes by @PrzemyslawKlys in #545
• Fix stream timeout test races by @PrzemyslawKlys in #546
• Escape terminal controls in DNS CLI text output by @PrzemyslawKlys in #547
• fix(wire): Bound DNS section allocations by packet length by @PrzemyslawKlys in #548
• fix(update): Handle RFC 2136 response forms by @PrzemyslawKlys in #549
• test(stream): Keep replacement socket open through reply by @PrzemyslawKlys in #550
• docs: clarify resolver defaults and DNS UPDATE targets by @PrzemyslawKlys in #551
• fix(dnssec): keep RFC 5011 state path stable across retries by @PrzemyslawKlys in #552
• Require explicit targets for wire DNS updates by @PrzemyslawKlys in #554
• Use system DNS consistently for default clients by @PrzemyslawKlys in #553
• fix(tests): 🐛 Stabilize DoT authentication failure fixture by @PrzemyslawKlys in #555
• fix(tests): 🐛 Reserve UDP and TCP fallback fixtures together by @PrzemyslawKlys in #556
• Qualify native DNS stream cancellation and retain failure diagnostics by @PrzemyslawKlys in #557
• fix(doh): 🐛 Bound IP-literal HTTP upgrades and qualify native DNS by @PrzemyslawKlys in #558
• test(axfr): 🧪 Reserve DNS fixture sockets before CLI queries by @PrzemyslawKlys in #561
• build(deps): bump actions/upload-artifact from 6 to 7 in the all-dependencies group by @dependabot[bot] in #560
• Bump the all-dependencies group with 1 update by @dependabot[bot] in #559
• fix(cache): 🐛 Keep admission until owned DNS work stops by @PrzemyslawKlys in #563
• fix(cache): 🐛 Isolate mutable typed response values by @PrzemyslawKlys in #562
• fix(resolver): 🐛 Preserve endpoint configuration and execution identity by @PrzemyslawKlys in #564
• fix(quic): Close pool admission and share disposal completion by @PrzemyslawKlys in #565
• perf(resolvers): ⚡ Bound query workers and expose warm connection runs by @PrzemyslawKlys in #566
• perf(dnssec): ⚡ Reuse NSEC3 hashing buffers by @PrzemyslawKlys in #567
• test(dns): 🧪 Stabilize recursive AXFR and TLS teardown fixtures by @PrzemyslawKlys in #568
• Expose consistent combined text and fragments in typed TXT records by @PrzemyslawKlys in #570
• Remove persistent private keys from TLS test fixtures by @PrzemyslawKlys in #571
• Normalize DNS record data consistently across providers by @PrzemyslawKlys in #572

Full Changelog: Compare DnsClientX-v20260724095714 to DnsClientX-v2.1.1

What's Changed

• Add production DNS transport, policy, transfer, and DNSSEC capabilities by @PrzemyslawKlys in #526

Full Changelog: Compare DnsClientX-v20260721142015 to DnsClientX-v20260724095714

What's Changed

• Update NuGet dependencies by @PrzemyslawKlys in #506
• Prepare release hygiene and resolver workflows by @PrzemyslawKlys in #507
• Bump coverlet.collector from 10.0.0 to 10.0.1 by @dependabot[bot] in #509
• Bump Microsoft.Bcl.AsyncInterfaces from 10.0.7 to 10.0.8 by @dependabot[bot] in #510
• Bump System.Text.Json from 10.0.7 to 10.0.8 by @dependabot[bot] in #511
• Bump Microsoft.NET.Test.Sdk from 18.5.0 to 18.5.1 by @dependabot[bot] in #508
• Bump Microsoft.NET.Test.Sdk from 18.5.1 to 18.6.0 by @dependabot[bot] in #512
• Bump Spectre.Console from 0.55.2 to 0.56.0 by @dependabot[bot] in #513
• Bump Spectre.Console from 0.56.0 to 0.57.0 by @dependabot[bot] in #515
• Bump Microsoft.Bcl.AsyncInterfaces from 10.0.8 to 10.0.9 by @dependabot[bot] in #514
• Bump System.Text.Json from 10.0.8 to 10.0.9 by @dependabot[bot] in #516
• Bump Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0 by @dependabot[bot] in #517
• Bump Spectre.Console from 0.57.0 to 0.57.1 by @dependabot[bot] in #518
• Bump Spectre.Console from 0.57.1 to 0.57.2 by @dependabot[bot] in #519
• Harden DNS protocol handling and add local DNSSEC validation by @PrzemyslawKlys in #523
• Bump Microsoft.Bcl.AsyncInterfaces from 10.0.9 to 10.0.10 by @dependabot[bot] in #520
• Bump Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1 by @dependabot[bot] in #521
• Bump System.Text.Json from 10.0.9 to 10.0.10 by @dependabot[bot] in #522
• Complete DNS correctness and resolver reliability by @PrzemyslawKlys in #524
• Update NuGet signing certificate by @PrzemyslawKlys in #525

Full Changelog: Compare DnsClientX-PowerShellModule.v1.0.5 to DnsClientX-v20260721142015