How vmcchooky/safe-zone works
Safe Zone is a self-hosted DNS anti-phishing service: clients send DNS queries, the resolver obtains a risk verdict, and policy determines the DNS response. Operators separately manage analysis, policy, groups, reports and configuration through the API and dashboard. Threat feeds and lexical/domain signals inform verdicts; optional ML, AI and OSINT enrichment extend that decision process, while SQLite and Redis support durable state and caching. The graph follows the README and sampled entry points; wiring for unsampled internal handlers and enrichment is shown only where documented.
Main entry points: service.go Risk policy · resolver.go DNS policy · main.go Core API · handler.go Operator handlers
Components 24
DNS protection
- DNS resolver
cmd/dns-resolver/main.go - DNS router
internal/dns/server/router.go - DNS policy
internal/dns/resolver/resolver.go - DoH service
internal/dns/doh/server.go - Upstream DNS
internal/dns/doh/upstream.go
Verdict engine
- Domain analysis
internal/analysis/analysis.go - Risk policy
internal/risk/service.go - ML classifier
internal/analysis/ml_classifier.go - AI provider
internal/ai/provider.go
Operator control
- Core API
cmd/core-api/main.go - API router
internal/api/server/router.go - Operator handlers
internal/api/handlers/handler.go - Operator dashboard
ui/src/App.tsx - Dashboard API client
ui/src/lib/api.ts
State and intel
- Feed synchronization
internal/feed/sync.go - Threat feeds
internal/feed/admission.go - SQLite storage
internal/store/sqlite.go - Redis cache
internal/cache/redis.go
Automation
- Agent scheduler
internal/agent/engine.go - Agent tasks
internal/agent/feedsync.go - OSINT enrichment
internal/agent/osint.go
Other components
- DNS client
- DNS upstream
- Threat feed sources
Connections 25
- DNS client → DNS resolver: sends DNS query
- DNS resolver → DNS router: serves requests
- DNS router → DNS policy: dispatches query
- DNS policy → Risk policy: requests verdict
- Risk policy → Domain analysis: scores domain
- Domain analysis → ML classifier: classifies optionally
- Risk policy → AI provider: refines optionally
- DNS policy → DoH service: serves DoH
- DoH service → Upstream DNS: resolves allowed query
- Upstream DNS → DNS upstream: forwards query
- Core API → API router: starts API
- API router → Operator handlers: dispatches requests
- Operator dashboard → Dashboard API client: uses API client
- Dashboard API client → Core API: calls API
- Operator handlers → Risk policy: analyzes domains
- Operator handlers → SQLite storage: reads and writes
- Risk policy → Redis cache: caches verdicts
- Feed synchronization → Threat feed sources: fetches feeds
- Feed synchronization → Threat feeds: admits feed entries
- Risk policy → Threat feeds: matches feed entries
- Core API → Agent scheduler: starts scheduler
- Agent scheduler → Agent tasks: runs tasks
- Agent tasks → Feed synchronization: synchronizes feeds
- Agent tasks → OSINT enrichment: runs enrichment
- OSINT enrichment → Risk policy: provides evidence