bine VS dns

That is a bummer, although for now I guess it would be better than nothing to reach out to api.protonmail.ch through Tor. I'd be more motivated if it were an onion though. I had a look at the likely places it would need to be modified: https://github.com/ProtonMail/proton-bridge/search?q=dial and I think all it would take is to make a struct that extends https://github.com/cretz/bine so that it implements TLSDialer to make a drop-in Tor based connection. That would be very thorough and pretty escape-proof. I'm steadily talking myself into doing it...

Sure. I wrote https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).

> Or a self-hosted option where the API could be deployed to the company's cloud of choice?

Can put it on Tor and give an ephemeral onion link (I wrote https://github.com/cretz/bine to help w/ just these use cases). So people could access via Tor browser or via the same CLI with a "client"/"get" command. Can even have the ephemeral server determine its been HTTP "GET"d and kill itself. Then you don't even need a public website.

Shameless plug, I also wrote a simple lib that makes onion services easy: https://github.com/cretz/bine (OP's project uses a fork of it and I plan on putting more time into it soon)

https://github.com/ipsn/go-libtor and https://github.com/cretz/bine are excellent libraries to get you started. They do exactly what you are asking.

The heavylifting is done by this package: https://github.com/miekg/dns.

Apart from `dig`, clients like https://github.com/miekg/dns show the same behavior.

For the DNS i wrote a PiHole clone, which on the core it uses github.com/miekg/dns, to upstream queries and also to handle the custom entries, i've been wanting to publish that project but haven't done so cause the code is a bit messy since i did it as a PoC mostly, when comparing it to pihole it has the advantage that its really resource light mostly on the admin features, the dns resolving performs pretty much the same.

coredns uses github.com/miekg/dns under the hood

You can do the same with net.Resolver, either by just setting it's Dial function (and PreferGo=true). You can use https://pkg.go.dev/golang.org/x/net/dns/dnsmessage or https://github.com/miekg/dns to implement an in-process server, either over TCP/UDP or skipping real networking completely, just like you can do with https://golang.org/pkg/net/http/httptest

Had a similar problem a couple years ago where I needed to use alternative DNS libraries to troubleshoot issues in a company's infrastructure.

Golang's rules for what implementation to use are found here: https://golang.org/pkg/net/#hdr-Name_Resolution

A really solid alternative DNS client implementation can be found here: https://github.com/miekg/dns. Real easy to read and vet compared to a few other libraries I ran into when working on this problem.