}

func runDNSCache(ctx *cli.Context) {
	dnsTTL := ctx.Duration("dns-cache-ttl")
	// Check if we have configured a custom DNS cache TTL.
	if dnsTTL <= 0 {
		if orchestrated {
			dnsTTL = 30 * time.Second
		} else {
			dnsTTL = 10 * time.Minute
		}
	}

	// Call to refresh will refresh names in cache.
	go func() {
		// Baremetal setups set DNS refresh window up to dnsTTL duration.
		t := time.NewTicker(dnsTTL)

    var routeSelector = newRouteSelector(address)
    dns[PROXY_A_HOST] = dns.allocate(1)
    dns[PROXY_B_HOST] = dns.allocate(1)

    // Mark the ProxyA route as failed.
    val selection = routeSelector.next()
    dns.assertRequests(PROXY_A_HOST)
    val route = selection.next()
    assertRoute(route, address, proxyA, dns.lookup(PROXY_A_HOST, 0), PROXY_A_PORT)
    routeDatabase.failed(route)

  private lateinit var dns: Dns
  private val cacheFs = FakeFileSystem()
  private val bootstrapClient =
    OkHttpClient.Builder()
      .protocols(listOf(Protocol.HTTP_2, Protocol.HTTP_1_1))
      .build()

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
    server.protocols = bootstrapClient.protocols
    dns = buildLocalhost(bootstrapClient, false)
  }

  @Test

    this.server1 = server
    this.server2 = server2

    socketFactory = SpecificHostSocketFactory(InetSocketAddress(server.hostName, server.port))

    client =
      clientTestRule.newClientBuilder()
        .dns(dns)
        .socketFactory(socketFactory)
        .eventListenerFactory(clientTestRule.wrap(listener))
        .build()
  }

  @Test
  fun http2OneBadHostOneGoodNoRetryOnConnectionFailure() {

/**
 * [DNS over HTTPS implementation][doh_spec].
 *
 * > A DNS API client encodes a single DNS query into an HTTP request
 * > using either the HTTP GET or POST method and the other requirements
 * > of this section.  The DNS API server defines the URI used by the
 * > request through the use of a URI Template.
 *
 * [doh_spec]: https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-13
 */

        .addSubjectAlternativeName("differentdns.com")
        .build()
    serverIps = Dns.SYSTEM.lookup(server.hostName)
    dns[server.hostName] = serverIps
    dns["san.com"] = serverIps
    dns["nonsan.com"] = serverIps
    dns["www.wildcard.com"] = serverIps
    dns["differentdns.com"] = listOf()
    val handshakeCertificates =
      HandshakeCertificates.Builder()

	}
	if err == nil && dnsURL != "" {
		bootstrapTraceMsg("initialize remote bucket DNS store")
		globalDNSConfig, err = dns.NewOperatorDNS(dnsURL,
			dns.Authentication(dnsUser, dnsPass),
			dns.RootCAs(globalRootCAs))
		if err != nil {
			configLogIf(ctx, fmt.Errorf("Unable to initialize remote webhook DNS config %w", err))
		}
	}

///

### DNS

Now let's focus on all the actual HTTPS parts.

First, the browser would check with the **DNS servers** what is the **IP for the domain**, in this case, `someapp.example.com`.

The DNS servers would tell the browser to use some specific **IP address**. That would be the public IP address used by your server, that you configured in the DNS servers.

<img src="/img/deployment/https/https01.svg">

Kotlin calling OkHttp 3.x:

```kotlin
val client = OkHttpClient.Builder()
    .dns { hostname -> InetAddress.getAllByName(hostname).toList() }
    .build()
```

Kotlin calling OkHttp 4.x:

```kotlin
val client = OkHttpClient.Builder()
    .dns(object : Dns {
      override fun lookup(hostname: String) =
          InetAddress.getAllByName(hostname).toList()
    })

```
KEY:
etcd  federate multiple clusters for IAM and Bucket DNS

ARGS:
endpoints*       (csv)       comma separated list of etcd endpoints e.g. "http://localhost:2379"
path_prefix      (path)      namespace prefix to isolate tenants e.g. "customer1/"
coredns_path     (path)      shared bucket DNS records, default is "/skydns"
client_cert      (path)      client cert for mTLS authentication