Replace c-ares with a DNS resolver in safe Rust

.gitattributes

@@ -28,6 +28,7 @@ test/aot/parallel/the-head-of-the-text-of-a-function-is-laid-as-bun-prints-it/**
 # Compared line by line with what a runner prints, which ends a line with \n on every system.
 test/cli/format/*/expected.txt text eol=lf
 test/cli/lint/conformance/expected*.txt text eol=lf
+test/js/node/dns/dns-simulation-c-ares.txt text eol=lf
 # Embedded in the executable, which splits them at \n.
 src/lint/linter/config/presets.txt text eol=lf
 src/lint/linter/deprecated.txt text eol=lf

CLAUDE.md

@@ -147,7 +147,7 @@ The Rust side is a Cargo workspace of ~200 crates rooted at `Cargo.toml`. The ke
 
 #### Vendored Dependencies (`vendor/`)
 
-Third-party native libraries are vendored locally and can be read from disk (not git submodules): boringssl (TLS/crypto), brotli, cares (async DNS), highway (SIMD), libdeflate, libuv (Windows event loop), lolhtml (HTML rewriter), lshpack (HTTP/2 HPACK), lsqpack + lsquic (HTTP/3), mimalloc (allocator), nodejs (headers), picohttpparser, rust-argon2 (argon2 for `Bun.password`, Rust), tinycc (FFI JIT, fork: oven-sh/tinycc), WebKit (JavaScriptCore), zlib (zlib-ng), zstd. Build configuration for these is in `scripts/build/deps/*.ts`.
+Third-party native libraries are vendored locally and can be read from disk (not git submodules): boringssl (TLS/crypto), brotli, highway (SIMD), libdeflate, libuv (Windows event loop), lolhtml (HTML rewriter), lshpack (HTTP/2 HPACK), lsqpack + lsquic (HTTP/3), mimalloc (allocator), nodejs (headers), picohttpparser, rust-argon2 (argon2 for `Bun.password`, Rust), tinycc (FFI JIT, fork: oven-sh/tinycc), WebKit (JavaScriptCore), zlib (zlib-ng), zstd. Build configuration for these is in `scripts/build/deps/*.ts`.
 
 ### JavaScript Class Implementation (C++)
 

Cargo.toml

@@ -8,7 +8,7 @@
   "src/bundler",
   "src/collections",
   "src/css",
   "src/errno",
   "src/glob",
   "src/http",
   "src/install",
@@ -53,13 +53,13 @@
   "src/threading",
   "src/valkey",
   "src/watcher",
-  "src/cares_sys",
   "src/clap",
   "src/clap_macros",
   "src/crash_handler",
   "src/csrf",
   "src/css_jsc",
   "src/dns",
+  "src/dns_resolver",
   "src/dotenv",
   "src/event_loop",
   "src/executable",
@@ -434,13 +434,13 @@
 bun_threading = { path = "src/threading" }
 bun_valkey = { path = "src/valkey" }
 bun_watcher = { path = "src/watcher" }
-bun_cares_sys = { path = "src/cares_sys" }
 bun_clap = { path = "src/clap" }
 bun_clap_macros = { path = "src/clap_macros" }
 bun_crash_handler = { path = "src/crash_handler" }
 bun_csrf = { path = "src/csrf" }
 bun_css_jsc = { path = "src/css_jsc" }
 bun_dns = { path = "src/dns" }
+bun_dns_resolver = { path = "src/dns_resolver" }
 bun_dotenv = { path = "src/dotenv" }
 bun_event_loop = { path = "src/event_loop" }
 bun_exe_format = { path = "src/exe_format" }

LICENSE.md

@@ -34,7 +34,7 @@ Bun statically links these libraries:
 | [`tinycc`](https://github.com/tinycc/tinycc) | LGPL v2.1 |
 | [`uSockets`](https://github.com/uNetworking/uSockets) | Apache 2.0 |
 | [`zlib-ng`](https://github.com/zlib-ng/zlib-ng) | zlib |
-| [`c-ares`](https://github.com/c-ares/c-ares) | MIT licensed |
+| [`c-ares`](https://github.com/c-ares/c-ares) (not linked: `src/dns_resolver` and `src/bun_core/ip_address.rs` are derived from parts of it) | MIT licensed |
 | [`libicu`](https://github.com/unicode-org/icu) 78 | [license here](https://github.com/unicode-org/icu/blob/main/icu4c/LICENSE) |
 | [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE) | BSD 2-Clause |
 | [`libuv`](https://github.com/libuv/libuv) (on Windows) | MIT |

docs/project/license.mdx

@@ -39,7 +39,7 @@ Bun statically links these libraries:
 | [`tinycc`](https://github.com/tinycc/tinycc)                                                                                                     | LGPL v2.1                                                                                    |
 | [`uSockets`](https://github.com/uNetworking/uSockets)                                                                                            | Apache 2.0                                                                                   |
 | [`zlib-ng`](https://github.com/zlib-ng/zlib-ng)                                                                                                  | zlib                                                                                         |
-| [`c-ares`](https://github.com/c-ares/c-ares)                                                                                                     | MIT licensed                                                                                 |
+| [`c-ares`](https://github.com/c-ares/c-ares) (not linked: `src/dns_resolver` and `src/bun_core/ip_address.rs` are derived from parts of it)      | MIT licensed                                                                                 |
 | [`libicu`](https://github.com/unicode-org/icu) 78                                                                                                | [ICU license](https://github.com/unicode-org/icu/blob/main/icu4c/LICENSE)                    |
 | [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE)                                                                              | BSD 2-Clause                                                                                 |
 | [`libuv`](https://github.com/libuv/libuv) (on Windows)                                                                                           | MIT                                                                                          |

docs/runtime/networking/dns.mdx

@@ -25,7 +25,7 @@ dns.prefetch("bun.com", 443);
 
 `Bun.dns.lookup()` accepts a `backend` option that selects the resolver implementation:
 
-- `"c-ares"`: the [c-ares](https://c-ares.org/) asynchronous resolver. It reads `/etc/resolv.conf` directly, so it does not consult NSS modules such as `systemd-resolved`. This backend is the default for `Bun.dns.lookup()` on Linux.
+- `"c-ares"`: Bun's own asynchronous resolver, which behaves like the [c-ares](https://c-ares.org/) library it replaced. It reads `/etc/resolv.conf` directly, so it does not consult NSS modules such as `systemd-resolved`. This backend is the default for `Bun.dns.lookup()` on Linux.
 - `"system"`: the platform's own resolver (the non-blocking system API on macOS, `getaddrinfo` on a thread pool everywhere else). This backend is the default on macOS, Windows, and Android.
 - `"getaddrinfo"` (alias `"libc"`): the POSIX `getaddrinfo(3)` function on a thread pool.
 
@@ -35,7 +35,7 @@ import { dns } from "bun";
 const [{ address }] = await dns.lookup("example.com", { backend: "system" });
 ```
 
-`node:dns.lookup()` always uses the `"system"` backend to match Node.js, whose `dns.lookup()` is documented as calling `getaddrinfo(3)`. The `node:dns.resolve*()` functions use c-ares, as they do in Node.js.
+`node:dns.lookup()` always uses the `"system"` backend to match Node.js, whose `dns.lookup()` is documented as calling `getaddrinfo(3)`. The `node:dns.resolve*()` functions send DNS queries themselves with the resolver behind the `"c-ares"` backend. Node.js uses c-ares for them.
 
 ## DNS caching in Bun
 

packages/bun-types/bun.d.ts

@@ -2549,7 +2549,7 @@ declare module "bun" {
      * ## DNS resolver client
      *
      * Bun supports three DNS resolvers:
-     * - `c-ares` - Uses the c-ares library to perform DNS resolution. This is the default on Linux.
+     * - `c-ares` - Bun's own asynchronous resolver. It keeps the name of the c-ares library, which it replaced and whose behavior it follows. This is the default on Linux.
      * - `system` - Uses the system's non-blocking DNS resolver API if available, falls back to `getaddrinfo`. This is the default on macOS and the same as `getaddrinfo` on Linux.
      * - `getaddrinfo` - Uses the POSIX standard `getaddrinfo` function. Causes performance issues under concurrent loads.
      *
@@ -2578,8 +2578,7 @@ declare module "bun" {
          * The DNS resolver implementation to use
          *
          * Defaults to `"c-ares"` on Linux and `"system"` on macOS. This default
-         * may change in a future version of Bun if c-ares is not reliable
-         * enough.
+         * may change in a future version of Bun.
          *
          * On macOS, `system` uses the builtin macOS [non-blocking DNS
          * resolution
@@ -2604,8 +2603,7 @@ declare module "bun" {
          * `"system"` uses the same API underneath (except non-blocking).
          *
          * On Windows, libuv's non-blocking DNS resolver is used by default, and
-         * when specifying backends "system", "libc", or "getaddrinfo". The c-ares
-         * backend isn't supported on Windows.
+         * when specifying backends "system", "libc", or "getaddrinfo".
          */
         backend?: "libc" | "c-ares" | "system" | "getaddrinfo";
       },

scripts/build/bun.ts

@@ -109,6 +109,7 @@ function systemLibs(cfg: Config): string[] {
       "userenv.lib",
       "dbghelp.lib",
       "crypt32.lib",
+      "iphlpapi.lib", // libuv, and the DNS servers of the adapters
       "wsock32.lib", // ws2_32 + wsock32 — wsock32 has TransmitFile (sendfile equiv)
       "ws2_32.lib",
       "delayimp.lib", // required for /delayload: in release

scripts/build/deps/README.md

@@ -146,7 +146,6 @@ export const mydep: Dependency = {
 - **mimalloc.ts** — direct build, single unity TU compiled as C++
 - **tinycc.ts** — direct build with a build-time codegen tool
 - **zlib.ts** — direct build with per-source SIMD `-m` flags + `.h.in` substitution
-- **cares.ts** — direct build with hand-written per-target config.h
 - **boringssl.ts** — direct build with NASM assembly (win-x64) and a large gen/ manifest; `forbidUndefined` (with libuv.ts) keeps a dep that bun points at mimalloc from calling libc's allocator behind its back
 - **sqlite.ts** — direct build, in-tree source (lives in `src/`, not `vendor/`)
 - **libuv.ts** — `enabled: cfg => cfg.windows` for a platform-only dep