Automatically resolve DNS-records and save the IPs

[bitfim]

When adding a new entry in you Password DB, most of the time I enter DNS based URL. Thats also the way I organize the bookmarks of my browser. And I think 99% of the users do the same.

But in case of emergency, like attacks against your IT infrastructure, any kind of DNS problems or network connectivity issues, you will have problems to reach you service over you browser bookmark or the DNS based URL in your keepass DB.

In this cases, you will ask your IPAM to find out the IP-Address because the IP is allways the address of last resort. But the same reasons why your DNS is not working might be the reason why you cant reach you IPAM-system. And in case of old school Excel-based IPAM management, it might be already encrypted or the IPAM record in simply not up to date.

So, here is my feature request:

It would be nice if KeepassXC would have a feature, which automatically resolves DNS-based addresses and saves the IP-address in addition to the DNS.

And here are some more detailed ideas:

The resolved IPs should be stored in a historized way. Because DNS records IPs change some times back and forth and it would be usefull to see not only one IP, but every IP from the past.

This feature should be available as a global feature where you can trigger it for every entry in the database. This would be usefull for grown databases. Every time this global feature is activated, it adds the current IP.

It should also be possible to use an automatic function which can be activated for every single password entry. Like: Update the IP every time you use this entry. Or every time you double click the URL in keepassxc. This would keep the IP records in your database up to date.

[droidmonkey]

An outage that only takes out DNS services is totally unlikely. Even in that case, just switch to a different DNS provider. 1.1.1.1 is a great example. This request doesn't make sense and is rather infeasible/unnecessary on many levels, unfortunately.

[bitfim]

As a Service Provider, we host our own DNS servers for the company and our customers.

In bigger environments you dont just simply switch your DNS server to quad 8. Because DNS connections to external DNS servers from any client is blocked or filtered. And if you would, these server would not know all the records of our mycompany.internal domain records, which are not available on public DNS servers.

An outage that takes out central systems in your environment is very likely today in case of ransomeware attacks or maybe a failed update of your network components. You simply have other things to do than switch DNS servers or find the correct IP for your systems you try to reach. And my feature request would be helpful in such emergency cases.

[droidmonkey]

Using ip addresses instead of hostname/dns will result in either the web server failing to resolve the correct site and/or https failures as certs are invariably issued against dns not ip. If you want to keep a catalog of dns results, I recommend a dedicated tool for that, not a password manager.

[bitfim]

Its better to have the possibility to access your service via a self signed certificate or via IP than not knowing the current / last IP. But HTTP is not the only protocol you would like to use in such a scenario. And not all protocols need a DNS bound certificate. Think about all remote management protocols (SSH, RDP, etc.).

I see the password manager as a perfect location for this, because you have all informations in one place to access your systems. It still works if companies network or external services are down. It can be like a part of an emergency handbook. And if the password manager would support such a feature, it would be self maintaining, because IPs of you system allways automatically update when you access the server in your daily business.