@thedarktangent dnsmasq has --ipset and --nftset options. e.g., nftset=/cdn.network.com/4#inet#filter#allow4 adds every A record answered for that domain (and its subdomains) to an nftables set.
Unbound has an ipset module that does basically the same thing. It has to be compiled in with --enable-ipset, and you tag the zones with local-zone: "network.com" ipset.
There are a couple others but these are two solid DNS projects.
@hrbrmstr My concern there is that the CDN is basically a class A of v4 addresses and an equally giant amount of v6. Over time the table could hold hundreds or thousands of allowed addresses.
@thedarktangent ipset is pretty efficient
@hrbrmstr What I meant was that over time the rule would become less and less effective. Soon it would allow my server to connect out to hundreds or thousands of IP addresses on a public CDN network, when it really needs to only talk to a single IP for a few seconds.
@thedarktangent @hrbrmstr the nftset can have an expiry time associated with it, entries not touched get pruned.
For eg a curl “one and done” lookup+connect, set the timeout to say 5s, long enough for the 3-way handshake to end up in conntrack, then you can drop the entry, established connections are usually allowed to continue.