reference DNS over HTTPS endpoints

rule:
  meta:
    name: reference DNS over HTTPS endpoints
    namespace: communication/dns
    authors:
      - markus.neis@swisscom.com / @markus_neis
    scopes:
      static: file
      dynamic: file
    mbc:
      - Communication::DNS Communication::Server Connect [C0011.002]
    references:
      - https://github.com/curl/curl/wiki/DNS-over-HTTPS
    examples:
      - 749e7becf00fccc6dff324a83976dc0d:0x00004589  # https://dns.google.com/resolve?name=
      - 749e7becf00fccc6dff324a83976dc0d:0x000045d6  # https://cloudflare-dns.com/dns-query?ct=application/dns-json&name= 
  features:
    - or:
      - string: /https://doh\.seby\.io:8443/dns-query.*/i
      - string: /https://family\.cloudflare-dns\.com/dns-query.*/i
      - string: /https://free\.bravedns\.com/dns-query.*/i
      - string: /https://doh\.familyshield\.opendns\.com/dns-query.*/i
      - string: /https://doh-de\.blahdns\.com/dns-query.*/i
      - string: /https://adblock\.mydns\.network/dns-query.*/i
      - string: /https://bravedns\.com/configure.*/i
      - string: /https://cloudflare-dns\.com/dns-query.*/i
      - string: /https://commons\.host.*/i
      - string: /https://dns\.aa\.net\.uk/dns-query.*/i
      - string: /https://dns\.alidns\.com/dns-query.*/i
      - string: /https://dns-asia\.wugui\.zone/dns-query.*/i
      - string: /https://dns\.containerpi\.com/dns-query.*/i
      - string: /https://dns\.containerpi\.com/doh/family-filter/.*/i
      - string: /https://dns\.containerpi\.com/doh/secure-filter/.*/i
      - string: /https://dns\.digitale-gesellschaft\.ch/dns-query.*/i
      - string: /https://dns\.dnshome\.de/dns-query.*/i
      - string: /https://dns\.dns-over-https\.com/dns-query.*/i
      - string: /https://dns\.dnsoverhttps\.net/dns-query.*/i
      - string: /https://dns\.flatuslifir\.is/dns-query.*/i
      - string: /https://dnsforge\.de/dns-query.*/i
      - string: /https://dns\.google/dns-query.*/i
      - string: /https://dns\.nextdns\.io/<config_id>.*/i
      - string: /https://dns\.rubyfish\.cn/dns-query.*/i
      - string: /https://dns\.switch\.ch/dns-query.*/i
      - string: /https://dns\.twnic\.tw/dns-query.*/i
      - string: /https://dns\.wugui\.zone/dns-query.*/i
      - string: /https://doh-2\.seby\.io/dns-query.*/i
      - string: /https://doh\.42l\.fr/dns-query.*/i
      - string: /https://doh\.applied-privacy\.net/query.*/i
      - string: /https://doh\.armadillodns\.net/dns-query.*/i
      - string: /https://doh\.captnemo\.in/dns-query.*/i
      - string: /https://doh\.centraleu\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.cleanbrowsing\.org/doh/family-filter/.*/i
      - string: /https://doh\.crypto\.sx/dns-query.*/i
      - string: /https://doh\.dnslify\.com/dns-query.*/i
      - string: /https://doh\.dns\.sb/dns-query.*/i
      - string: /https://dohdot\.coxlab\.net/dns-query.*/i
      - string: /https://doh\.eastas\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.eastau\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.eastus\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.ffmuc\.net/dns-query.*/i
      - string: /https://doh\.libredns\.gr/dns-query.*/i
      - string: /https://doh\.li/dns-query.*/i
      - string: /https://doh\.northeu\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.powerdns\.org.*/i
      - string: /https://doh\.tiarap\.org/dns-query.*/i
      - string: /https://doh\.tiar\.app/dns-query.*/i
      - string: /https://doh\.westus\.pi-dns\.com/dns-query.*/i
      - string: /https://doh\.xfinity\.com/dns-query.*/i
      - string: /https://example\.doh\.blockerdns\.com/dns-query.*/i
      - string: /https://fi\.doh\.dns\.snopyta\.org/dns-query.*/i
      - string: /https://ibksturm\.synology\.me/dns-query.*/i
      - string: /https://ibuki\.cgnat\.net/dns-query.*/i
      - string: /https://jcdns\.fun/dns-query.*/i
      - string: /https://jp\.tiarap\.org/dns-query.*/i
      - string: /https://jp\.tiar\.app/dns-query.*/i
      - string: /https://odvr\.nic\.cz/doh.*/i
      - string: /https://ordns\.he\.net/dns-query.*/i
      - string: /https://rdns\.faelix\.net/.*/i
      - string: /https://resolver-eu\.lelux\.fi/dns-query.*/i
      - string: /https://doh-jp\.blahdns\.com/dns-query.*/i