pakopress.dev — SDK fallback via DNS TXT (DoH)

ID5 init — first-party calls

Loader log

Resolved fallback

What this tests

The fallback CDN is not shipped in the page — it lives in DNS. On onerror the loader reads a TXT record over DoH and decodes a base64 URL, so the alternate CDN can be rotated by editing one DNS record, with no page change. The lookup hits public resolvers over HTTPS, not id5-sync.com, so request blocking on that domain does not catch it. It queries three resolvers in parallel and takes the first answer, with cache: 'no-store', so one resolver's stale negative cache can't stall the fallback.

// 1. primary <script> onerror → resolve the alternate CDN from DNS (first resolver to answer wins)
Promise.all(RESOLVERS.map(dohQuery)).then(results => {
  var hit = results.find(r => r.txt);
  var url = atob(hit.txt);   // base64 → full SDK URL
  appendScript(url);
});
// dohQuery: fetch(r.url, { headers: r.headers, cache: 'no-store' }) → first TXT answer

DNS record to publish

Add a TXT record on eu-2-id5-sync.com whose value is the base64 of the alternate SDK URL. Current value points at jsDelivr, SDK 1.0.99:

Requests made by this page

blue = DoH lookups (Cloudflare / Google / AliDNS) · amber = primary (cdn.id5-sync.com) · indigo = fallback SDK (resolved CDN) · green = first-party ID5 calls (edge.pakopress.dev)