diff --git a/Cargo.lock b/Cargo.lock
index 4bda438..bb696b8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -29,6 +29,19 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.2.15",
+ "once_cell",
+ "version_check",
+ "zerocopy 0.7.35",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -38,6 +51,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "anstream"
 version = "0.6.18"
@@ -79,19 +98,20 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.6"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
 dependencies = [
  "anstyle",
+ "once_cell",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.93"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775"
+checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
 
 [[package]]
 name = "arbitrary"
@@ -99,23 +119,6 @@ version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223"
 
-[[package]]
-name = "arrayvec"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
-
-[[package]]
-name = "async-lock"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff6e472cdea888a4bd64f342f09b3f50e1886d32afe8df3d663c01140b811b18"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "pin-project-lite",
-]
-
 [[package]]
 name = "async-stream"
 version = "0.3.6"
@@ -140,15 +143,21 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.83"
+version = "0.1.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
+checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "autocfg"
 version = "1.4.0"
@@ -157,18 +166,17 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "axum"
-version = "0.6.20"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
 dependencies = [
  "async-trait",
  "axum-core",
- "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
  "http-body",
- "hyper",
+ "http-body-util",
  "itoa",
  "matchit",
  "memchr",
@@ -178,24 +186,27 @@ dependencies = [
  "rustversion",
  "serde",
  "sync_wrapper",
- "tower",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
 ]
 
 [[package]]
 name = "axum-core"
-version = "0.3.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
 dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
  "mime",
+ "pin-project-lite",
  "rustversion",
+ "sync_wrapper",
  "tower-layer",
  "tower-service",
 ]
@@ -235,9 +246,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64ct"
-version = "1.6.0"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
 
 [[package]]
 name = "bcrypt-pbkdf"
@@ -252,30 +263,24 @@ dependencies = [
 
 [[package]]
 name = "bit-set"
-version = "0.5.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
  "bit-vec",
 ]
 
 [[package]]
 name = "bit-vec"
-version = "0.6.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "1.3.2"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "block-buffer"
@@ -286,15 +291,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-padding"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "blowfish"
 version = "0.9.1"
@@ -313,9 +309,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.9.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cfg-if"
@@ -325,9 +321,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "cipher"
@@ -337,14 +333,13 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common",
  "inout",
- "zeroize",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.21"
+version = "4.5.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb3b4b9e5a7c7514dfa52869339ee98b3156b0bfb4e8a77c4ff4babb64b1604f"
+checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -352,9 +347,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.21"
+version = "4.5.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b17a95aa67cc7b5ebd32aa5370189aa0d79069ef1c64ce893bd30fb24bff20ec"
+checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
 dependencies = [
  "anstream",
  "anstyle",
@@ -364,9 +359,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.18"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
+checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -376,9 +371,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afb84c814227b90d6895e01398aee0d8033c00e7466aca416fb6a8e0eb19d8a7"
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "colorchoice"
@@ -386,20 +381,11 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "console-api"
-version = "0.7.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a257c22cd7e487dd4a13d413beabc512c5052f0bc048db0da6a84c3d8a6142fd"
+checksum = "8030735ecb0d128428b64cd379809817e620a40e5001c54465b99ec5feec2857"
 dependencies = [
  "futures-core",
  "prost",
@@ -410,9 +396,9 @@ dependencies = [
 
 [[package]]
 name = "console-subscriber"
-version = "0.3.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c4cc54bae66f7d9188996404abdf7fdfa23034ef8e43478c8810828abad758"
+checksum = "6539aa9c6a4cd31f4b1c040f860a1eac9aa80e7df6b05d506a6e7179936d6a01"
 dependencies = [
  "console-api",
  "crossbeam-channel",
@@ -420,6 +406,7 @@ dependencies = [
  "futures-task",
  "hdrhistogram",
  "humantime",
+ "hyper-util",
  "prost",
  "prost-types",
  "serde",
@@ -441,9 +428,9 @@ checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
 ]
@@ -459,27 +446,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crypto-bigint"
@@ -488,7 +466,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
@@ -500,7 +478,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core",
  "typenum",
 ]
 
@@ -541,10 +518,17 @@ dependencies = [
 ]
 
 [[package]]
-name = "data-encoding"
-version = "2.6.0"
+name = "dashmap"
+version = "5.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
 
 [[package]]
 name = "der"
@@ -621,9 +605,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "elliptic-curve"
@@ -640,36 +624,18 @@ dependencies = [
  "hkdf",
  "pem-rfc7468",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "sec1",
  "serdect",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "endian-type"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
-
-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
@@ -691,40 +657,19 @@ dependencies = [
  "rustc_version",
 ]
 
-[[package]]
-name = "event-listener"
-version = "5.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
-dependencies = [
- "concurrent-queue",
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f214dc438f977e6d4e3500aaa277f5ad94ca83fbbd9b1a15713ce2344ccc5a1"
-dependencies = [
- "event-listener",
- "pin-project-lite",
-]
-
 [[package]]
 name = "fastrand"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "ff"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -736,9 +681,9 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "flate2"
-version = "1.0.35"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
+checksum = "11faaf5a5236997af9848be0bef4db95824b1d534ebc64d0f0c6cf3e67bd38dc"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -750,6 +695,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.1"
@@ -848,19 +799,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generator"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc6bd114ceda131d3b1d665eba35788690ad37f5916457286b32ab6fd3c438dd"
-dependencies = [
- "cfg-if",
- "libc",
- "log",
- "rustversion",
- "windows",
-]
-
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -880,7 +818,19 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
 ]
 
 [[package]]
@@ -896,23 +846,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
 [[package]]
 name = "h2"
-version = "0.3.26"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "5017294ff4bb30944501348f6f8e42e6ad28f42c8bbef7a74029aff064a4e3c2"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "futures-util",
  "http",
- "indexmap 2.6.0",
+ "indexmap 2.8.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -925,11 +875,22 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
 
 [[package]]
 name = "hdrhistogram"
@@ -950,12 +911,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hermit-abi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
-
 [[package]]
 name = "hex-literal"
 version = "0.3.4"
@@ -968,59 +923,6 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
 
-[[package]]
-name = "hexdump"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf31ab66ed8145a1c7427bd8e9b42a6131bd74ccf444f69b9e620c2e73ded832"
-dependencies = [
- "arrayvec",
-]
-
-[[package]]
-name = "hickory-client"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab9683b08d8f8957a857b0236455d80e1886eaa8c6178af556aa7871fb61b55"
-dependencies = [
- "cfg-if",
- "data-encoding",
- "futures-channel",
- "futures-util",
- "hickory-proto",
- "once_cell",
- "radix_trie",
- "rand",
- "thiserror 1.0.69",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "hickory-proto"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07698b8420e2f0d6447a436ba999ec85d8fbf2a398bbd737b82cac4a2e96e512"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna 0.4.0",
- "ipnet",
- "once_cell",
- "rand",
- "socket2",
- "thiserror 1.0.69",
- "tinyvec",
- "tokio",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "hkdf"
 version = "0.12.4"
@@ -1041,9 +943,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.12"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
 dependencies = [
  "bytes",
  "fnv",
@@ -1052,20 +954,32 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
  "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "httparse"
-version = "1.9.5"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
@@ -1075,9 +989,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
 
 [[package]]
 name = "hushd"
@@ -1087,7 +1001,6 @@ dependencies = [
  "base64 0.22.1",
  "bcrypt-pbkdf",
  "bytes",
- "cipher",
  "clap",
  "console-subscriber",
  "ctr",
@@ -1096,11 +1009,9 @@ dependencies = [
  "error-stack",
  "futures",
  "generic-array",
- "hexdump",
- "hickory-client",
- "hickory-proto",
- "itertools 0.13.0",
- "moka",
+ "getrandom 0.3.2",
+ "internment",
+ "itertools",
  "nix",
  "num-bigint-dig",
  "num-integer",
@@ -1110,18 +1021,20 @@ dependencies = [
  "p384",
  "p521",
  "proptest",
- "rand",
- "rand_chacha",
+ "proptest-derive",
+ "rand 0.9.0",
+ "rand_chacha 0.9.0",
  "rustix",
  "sec1",
  "serde",
  "tempfile",
- "thiserror 2.0.3",
+ "thiserror",
  "tokio",
  "toml",
  "tracing",
  "tracing-core",
  "tracing-subscriber",
+ "url",
  "whoami",
  "xdg",
  "zeroize",
@@ -1129,13 +1042,12 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "0.14.31"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
+checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "h2",
  "http",
@@ -1144,23 +1056,41 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-timeout"
-version = "0.4.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
  "hyper",
+ "hyper-util",
  "pin-project-lite",
  "tokio",
- "tokio-io-timeout",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df2dcfbe0677734ab2f3ffa7fa7bfd4706bfdc1ef393f2ee30184aed67e631b4"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1204,9 +1134,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locid_transform_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
 
 [[package]]
 name = "icu_normalizer"
@@ -1228,9 +1158,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
 
 [[package]]
 name = "icu_properties"
@@ -1249,9 +1179,9 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
 
 [[package]]
 name = "icu_provider"
@@ -1281,16 +1211,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "idna"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
 [[package]]
 name = "idna"
 version = "1.0.3"
@@ -1324,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.6.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+checksum = "3954d50fe15b02142bf25d3b8bdadb634ec3948f103d04ffe3031bc8fe9d7058"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
@@ -1334,19 +1254,24 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding",
  "generic-array",
 ]
 
 [[package]]
-name = "ipnet"
-version = "2.10.1"
+name = "internment"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddc24109865250148c2e0f3d25d4f0f479571723792d3802153c60922a4fb708"
+checksum = "636d4b0f6a39fd684effe2a73f5310df16a3fa7954c26d36833e98f44d1977a2"
+dependencies = [
+ "ahash",
+ "dashmap",
+ "hashbrown 0.15.2",
+ "once_cell",
+]
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -1356,27 +1281,18 @@ checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "itertools"
-version = "0.12.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itertools"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "lazy_static"
@@ -1389,9 +1305,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.166"
+version = "0.2.171"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ccc108bbc0b1331bd061864e7cd823c0cab660bbe6970e66e2c0614decde36"
+checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
 
 [[package]]
 name = "libm"
@@ -1401,15 +1317,15 @@ checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.14"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+checksum = "fe7db12097d22ec582439daf8618b8fdd1a7bef6270e9af3b1ebcd30893cf413"
 
 [[package]]
 name = "litemap"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
 
 [[package]]
 name = "lock_api"
@@ -1423,22 +1339,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
-
-[[package]]
-name = "loom"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
-dependencies = [
- "cfg-if",
- "generator",
- "scoped-tls",
- "tracing",
- "tracing-subscriber",
-]
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "matchers"
@@ -1475,63 +1378,31 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.0"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
+checksum = "8e3e04debbb59698c15bacbb6d93584a8c0ca9cc3213cb423d31f760d8843ce5"
 dependencies = [
  "adler2",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
- "hermit-abi",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "moka"
-version = "0.12.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9321642ca94a4282428e6ea4af8cc2ca4eac48ac7a6a4ea8f33f76d0ce70926"
-dependencies = [
- "async-lock",
- "crossbeam-channel",
- "crossbeam-epoch",
- "crossbeam-utils",
- "event-listener",
- "futures-util",
- "loom",
- "parking_lot",
- "portable-atomic",
- "rustc_version",
- "smallvec",
- "tagptr",
- "thiserror 1.0.69",
- "uuid",
-]
-
-[[package]]
-name = "nibble_vec"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
-dependencies = [
- "smallvec",
-]
-
 [[package]]
 name = "nix"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1570,7 +1441,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand",
+ "rand 0.8.5",
  "serde",
  "smallvec",
  "zeroize",
@@ -1603,7 +1474,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
- "libm",
 ]
 
 [[package]]
@@ -1629,18 +1499,18 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.5"
+version = "0.36.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.20.2"
+version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "overload"
@@ -1664,9 +1534,9 @@ dependencies = [
 
 [[package]]
 name = "p384"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
  "ecdsa",
  "elliptic-curve",
@@ -1687,17 +1557,11 @@ dependencies = [
  "elliptic-curve",
  "hex-literal 0.4.1",
  "primeorder",
- "rand_core",
+ "rand_core 0.6.4",
  "serdect",
  "sha2",
 ]
 
-[[package]]
-name = "parking"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
-
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -1747,18 +1611,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.7"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be57f64e946e500c8ee36ef6331845d40a93055567ec57e8fae13efd33759b95"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.7"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1767,9 +1631,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
 [[package]]
 name = "pin-utils"
@@ -1787,19 +1651,13 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
-
 [[package]]
 name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.8.24",
 ]
 
 [[package]]
@@ -1814,35 +1672,35 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.2.0"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecf48c7ca261d60b74ab1a7b20da18bede46776b2e55535cb958eb595c5fa7b"
+checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
 dependencies = [
  "toml_edit",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.92"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "proptest"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4c2511913b88df1637da85cc8d96ec8e43a3f8bb8ccb71ee1ac240d6f3df58d"
+checksum = "14cae93065090804185d3b75f0bf93b8eeda30c7a9b4a33d3bdb3988d6229e50"
 dependencies = [
  "bit-set",
  "bit-vec",
- "bitflags 2.6.0",
+ "bitflags",
  "lazy_static",
  "num-traits",
- "rand",
- "rand_chacha",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
  "rand_xorshift",
  "regex-syntax 0.8.5",
  "rusty-fork",
@@ -1851,10 +1709,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost"
-version = "0.12.6"
+name = "proptest-derive"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
+checksum = "4ee1c9ac207483d5e7db4940700de86a9aae46ef90c48b57f99fe7edb8345e49"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -1862,12 +1731,12 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.12.6"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
+checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.12.1",
+ "itertools",
  "proc-macro2",
  "quote",
  "syn",
@@ -1875,9 +1744,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.12.6"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9091c90b0a32608e984ff2fa4091273cbdd755d54935c51d520887f4a1dbd5b0"
+checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
 dependencies = [
  "prost",
 ]
@@ -1890,22 +1759,18 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.37"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
-name = "radix_trie"
-version = "0.2.1"
+name = "r-efi"
+version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
-dependencies = [
- "endian-type",
- "nibble_vec",
-]
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
 
 [[package]]
 name = "rand"
@@ -1914,8 +1779,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+ "zerocopy 0.8.24",
 ]
 
 [[package]]
@@ -1925,7 +1801,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
@@ -1934,7 +1820,16 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.2",
 ]
 
 [[package]]
@@ -1943,16 +1838,16 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.7"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags",
 ]
 
 [[package]]
@@ -2026,22 +1921,22 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.41"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6"
+checksum = "d97817398dd4bb2e6da002002db259209759911da105da92bec29ccb12cf58bf"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e819f2bc632f285be6d7cd36e25940d45b2391dd6d9b939e79de557f7014248"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
 
 [[package]]
 name = "rusty-fork"
@@ -2057,15 +1952,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
-
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "scopeguard"
@@ -2090,24 +1979,24 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2116,9 +2005,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.133"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -2181,7 +2070,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -2195,15 +2084,15 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
 
 [[package]]
 name = "socket2"
-version = "0.5.8"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -2245,9 +2134,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.89"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d46482f1c1c87acd84dea20c1bf5ebff4c757009ed6bf19cfd36fb10e92c4e"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2256,9 +2145,9 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
 
 [[package]]
 name = "synstructure"
@@ -2271,20 +2160,14 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "tagptr"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
-
 [[package]]
 name = "tempfile"
-version = "3.14.0"
+version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cce251fcbc87fac86a866eeb0d6c2d536fc16d06f184bb61aeae11aa4cee0c"
+checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
 dependencies = [
- "cfg-if",
  "fastrand",
+ "getrandom 0.3.2",
  "once_cell",
  "rustix",
  "windows-sys 0.59.0",
@@ -2292,38 +2175,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.69"
+version = "2.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
 dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c006c85c7651b3cf2ada4584faa36773bd07bac24acfb39f3c431b36d7e667aa"
-dependencies = [
- "thiserror-impl 2.0.3",
+ "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.69"
+version = "2.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f077553d607adc1caf65430528a576c757a71ed73944b66ebb58ef2bbd243568"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2350,26 +2213,11 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "tinyvec"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
-version = "1.41.1"
+version = "1.44.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33"
+checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2384,21 +2232,11 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "tokio-io-timeout"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b74022ada614a1b4834de765f9bb43877f910cc8ce4be40e89042c9223a8bf"
-dependencies = [
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "tokio-macros"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
+checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2407,9 +2245,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.16"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1"
+checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -2418,9 +2256,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.12"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61e7c3654c13bcd040d4a03abee2c75b1d14a37b423cf5a813ceae1cc903ec6a"
+checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2431,9 +2269,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.19"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -2452,11 +2290,11 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.22"
+version = "0.22.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
 dependencies = [
- "indexmap 2.6.0",
+ "indexmap 2.8.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -2465,26 +2303,29 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.11.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76c4eb7a4e9ef9d4763600161f12f5070b92a578e1b634db88a6887844c91a13"
+checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
  "async-stream",
  "async-trait",
  "axum",
- "base64 0.21.7",
+ "base64 0.22.1",
  "bytes",
  "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-timeout",
+ "hyper-util",
  "percent-encoding",
  "pin-project",
  "prost",
+ "socket2",
  "tokio",
  "tokio-stream",
- "tower",
+ "tower 0.4.13",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -2501,7 +2342,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand",
+ "rand 0.8.5",
  "slab",
  "tokio",
  "tokio-util",
@@ -2510,6 +2351,20 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -2567,9 +2422,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-serde"
-version = "0.1.3"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc6b213177105856957181934e4920de57730fc69bf42c37ee5bb664d406d9e1"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
 dependencies = [
  "serde",
  "tracing-core",
@@ -2577,9 +2432,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.18"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -2604,9 +2459,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
 name = "unarray"
@@ -2614,26 +2469,11 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
-[[package]]
-name = "unicode-bidi"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ab17db44d7388991a428b2ee655ce0c212e862eff1768a455c58f9aad6e7893"
-
 [[package]]
 name = "unicode-ident"
-version = "1.0.14"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
-dependencies = [
- "tinyvec",
-]
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "url"
@@ -2642,7 +2482,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
  "form_urlencoded",
- "idna 1.0.3",
+ "idna",
  "percent-encoding",
 ]
 
@@ -2664,20 +2504,11 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
-[[package]]
-name = "uuid"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b913a3b5fe84142e269d63cc62b64319ccaf89b748fc31fe025177f767a756c4"
-dependencies = [
- "getrandom",
-]
-
 [[package]]
 name = "valuable"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "version_check"
@@ -2687,9 +2518,9 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "wait-timeout"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
 dependencies = [
  "libc",
 ]
@@ -2709,6 +2540,15 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
+[[package]]
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
 [[package]]
 name = "wasite"
 version = "0.1.0"
@@ -2717,9 +2557,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "whoami"
-version = "1.5.2"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "372d5b87f58ec45c384ba03563b03544dc5fadc3983e434b286913f5b4a9bb6d"
+checksum = "6994d13118ab492c3c80c1f81928718159254c53c472bf9ce36f8dae4add02a7"
 dependencies = [
  "redox_syscall",
  "wasite",
@@ -2747,70 +2587,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
-[[package]]
-name = "windows"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
-dependencies = [
- "windows-core",
- "windows-targets",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-result",
- "windows-strings",
- "windows-targets",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
-dependencies = [
- "windows-result",
- "windows-targets",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -2895,13 +2671,22 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.20"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36c1fec1a2bb5866f07c25f68c26e565c4c200aebb96d7e55710c19d3e8ac49b"
+checksum = "0e97b544156e9bebe1a0ffbc03484fc1ffe3100cbce3ffb17eac35f7cdd7ab36"
 dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "write16"
 version = "1.0.0"
@@ -2950,8 +2735,16 @@ version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
- "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
+dependencies = [
+ "zerocopy-derive 0.8.24",
 ]
 
 [[package]]
@@ -2966,19 +2759,30 @@ dependencies = [
 ]
 
 [[package]]
-name = "zerofrom"
-version = "0.1.5"
+name = "zerocopy-derive"
+version = "0.8.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index 5a53d62..3894527 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,42 +15,41 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tarpaulin_include)'] }
 aes = { version = "0.8.4", features = ["zeroize"] }
 base64 = "0.22.1"
 bcrypt-pbkdf = "0.10.0"
-bytes = "1.6.0"
-cipher = { version = "0.4.4", features = ["alloc", "block-padding", "rand_core", "std", "zeroize"] }
-clap = { version = "4.5.7", features = ["derive"] }
-console-subscriber = "0.3.0"
+bytes = "1.10.1"
+clap = { version = "4.5.35", features = ["derive"] }
+console-subscriber = "0.4.1"
 ctr = "0.9.2"
 ed25519-dalek = "2.1.1"
 elliptic-curve = { version = "0.13.8", features = ["alloc", "digest", "ecdh", "pem", "pkcs8", "sec1", "serde", "std", "hash2curve", "voprf"] }
 error-stack = "0.5.0"
 futures = "0.3.31"
 generic-array = "0.14.7"
-hexdump = "0.1.2"
-hickory-client = { version = "0.24.1", features = ["mdns"] }
-hickory-proto = "0.24.1"
-itertools = "0.13.0"
-moka = { version = "0.12.10", features = ["future"] }
-nix = { version = "0.28.0", features = ["user"] }
+getrandom = "0.3.2"
+internment = { version = "0.8.6", features = ["arc"] }
+itertools = "0.14.0"
+nix = { version = "0.29.0", features = ["user"] }
 num-bigint-dig = { version = "0.8.4", features = ["arbitrary", "i128", "zeroize", "prime", "rand"] }
 num-integer = { version = "0.1.46", features = ["i128"] }
 num-traits = { version = "0.2.19", features = ["i128"] }
-num_enum = "0.7.2"
+num_enum = "0.7.3"
 p256 = { version = "0.13.2", features = ["ecdh", "ecdsa-core", "hash2curve", "serde", "test-vectors"] }
-p384 = { version = "0.13.0", features = ["ecdh", "ecdsa-core", "hash2curve", "serde", "test-vectors"] }
+p384 = { version = "0.13.1", features = ["ecdh", "ecdsa-core", "hash2curve", "serde", "test-vectors"] }
 p521 = { version = "0.13.3", features = ["ecdh", "ecdsa-core", "hash2curve", "serde", "test-vectors"] }
-proptest = "1.5.0"
-rand = "0.8.5"
-rand_chacha = "0.3.1"
-rustix = "0.38.41"
+proptest = "1.6.0"
+proptest-derive = "0.5.1"
+rand = "0.9.0"
+rand_chacha = "0.9.0"
+rustix = "1.0.5"
 sec1 = "0.7.3"
-serde = { version = "1.0.203", features = ["derive"] }
-tempfile = "3.12.0"
-thiserror = "2.0.3"
-tokio = { version = "1.38.0", features = ["full", "tracing"] }
-toml = "0.8.14"
-tracing = "0.1.40"
-tracing-core = "0.1.32"
-tracing-subscriber = { version = "0.3.18", features = ["env-filter", "tracing", "json"] }
-whoami = { version = "1.5.2", default-features = false }
+serde = { version = "1.0.219", features = ["derive"] }
+tempfile = "3.19.1"
+thiserror = "2.0.12"
+tokio = { version = "1.44.2", features = ["full", "tracing"] }
+toml = "0.8.20"
+tracing = "0.1.41"
+tracing-core = "0.1.33"
+tracing-subscriber = { version = "0.3.19", features = ["env-filter", "tracing", "json"] }
+url = "2.5.4"
+whoami = { version = "1.6.0", default-features = false }
 xdg = "2.5.2"
 zeroize = "1.8.1"
diff --git a/src/client.rs b/src/client.rs
index 180ad4f..4eda17a 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -159,7 +159,7 @@ async fn connect(
         "received server preamble"
     );
 
-    let stream = ssh::SshChannel::new(stream);
+    let stream = ssh::SshChannel::new(stream).expect("can build new SSH channel");
     let their_initial = stream
         .read()
         .await
diff --git a/src/config/resolver.rs b/src/config/resolver.rs
index 36b29d4..711a1a8 100644
--- a/src/config/resolver.rs
+++ b/src/config/resolver.rs
@@ -1,7 +1,9 @@
+use crate::network::resolver::name::Name;
 use proptest::arbitrary::Arbitrary;
 use proptest::strategy::{BoxedStrategy, Just, Strategy};
 use serde::{Deserialize, Serialize};
-use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6};
+use std::net::SocketAddr;
+use url::Url;
 
 #[derive(Debug, PartialEq, Deserialize, Serialize)]
 pub struct DnsConfig {
@@ -179,25 +181,80 @@ impl Arbitrary for BuiltinDnsOption {
 
 #[derive(Clone, Debug, PartialEq, Deserialize, Serialize)]
 pub struct NameServerConfig {
-    pub address: SocketAddr,
+    #[serde(serialize_with = "serialize_url", deserialize_with = "deserialize_url")]
+    pub address: Url,
     #[serde(default)]
     pub timeout_in_seconds: Option<u64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub bind_address: Option<SocketAddr>,
 }
 
+fn serialize_url<S: serde::Serializer>(url: &Url, serializer: S) -> Result<S::Ok, S::Error> {
+    serializer.collect_str(url)
+}
+
+fn deserialize_url<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<Url, D::Error> {
+    struct Visitor {}
+
+    impl<'de> serde::de::Visitor<'de> for Visitor {
+        type Value = Url;
+
+        fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+            write!(formatter, "a legal URL")
+        }
+
+        fn visit_str<E: serde::de::Error>(self, v: &str) -> Result<Self::Value, E> {
+            Url::parse(v).map_err(|e| E::custom(e))
+        }
+
+        fn visit_borrowed_str<E: serde::de::Error>(self, v: &'de str) -> Result<Self::Value, E> {
+            Url::parse(v).map_err(|e| E::custom(e))
+        }
+    }
+
+    deserializer.deserialize_str(Visitor {})
+}
+
 impl Arbitrary for NameServerConfig {
     type Parameters = ();
     type Strategy = BoxedStrategy<Self>;
 
     fn arbitrary_with((): Self::Parameters) -> Self::Strategy {
+        let scheme = proptest::prop_oneof![
+            Just("http".to_string()),
+            Just("https".to_string()),
+            Just("tcp".to_string()),
+            Just("udp".to_string()),
+        ];
+        let domain = Name::arbitrary();
+        let port = proptest::option::of(u16::arbitrary());
+        let user = proptest::option::of(proptest::string::string_regex("[A-Za-z]{1,30}").unwrap());
+        let password =
+            proptest::option::of(proptest::string::string_regex(":[A-Za-z]{1,30}").unwrap());
+        let path =
+            proptest::option::of(proptest::string::string_regex("/[A-Za-z/]{1,30}").unwrap());
+
+        let uri_strategy = (scheme, domain, user, password, port, path).prop_map(
+            |(scheme, domain, user, password, port, path)| {
+                let userpass_prefix = match (user, password) {
+                    (None, None) => String::new(),
+                    (Some(u), None) => format!("{u}@"),
+                    (None, Some(p)) => format!(":{p}@"),
+                    (Some(u), Some(p)) => format!("{u}:{p}@"),
+                };
+                let path = path.unwrap_or_default();
+                let port = port.map(|x| format!(":{x}")).unwrap_or_default();
+                let uri_str = format!("{scheme}://{userpass_prefix}{domain}{port}{path}");
+                Url::parse(&uri_str).unwrap()
+            },
+        );
+
         (
-            SocketAddr::arbitrary(),
+            uri_strategy,
             proptest::option::of(u64::arbitrary()),
             proptest::option::of(SocketAddr::arbitrary()),
         )
-            .prop_map(|(mut address, mut timeout_in_seconds, mut bind_address)| {
-                clear_flow_and_scope_info(&mut address);
+            .prop_map(|(address, mut timeout_in_seconds, mut bind_address)| {
                 if let Some(bind_address) = bind_address.as_mut() {
                     clear_flow_and_scope_info(bind_address);
                 }
@@ -242,81 +299,56 @@ impl DnsConfig {
             None => {}
             Some(BuiltinDnsOption::Cloudflare) => {
                 results.push(NameServerConfig {
-                    address: SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::new(1, 1, 1, 1), 53)),
+                    address: Url::parse("udp://1.1.1.1:53").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::new(1, 0, 0, 1), 53)),
+                    address: Url::parse("udp://1.0.0.1").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V6(SocketAddrV6::new(
-                        Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1111),
-                        53,
-                        0,
-                        0,
-                    )),
+                    address: Url::parse("udp://2606:4700:4700::1111").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V6(SocketAddrV6::new(
-                        Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1001),
-                        53,
-                        0,
-                        0,
-                    )),
+                    address: Url::parse("udp://2606:4700:4700::1001:53").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
             }
             Some(BuiltinDnsOption::Google) => {
                 results.push(NameServerConfig {
-                    address: SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::new(8, 8, 8, 8), 53)),
+                    address: Url::parse("udp://8.8.8.8:53").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::new(8, 8, 4, 4), 53)),
+                    address: Url::parse("udp://8.8.4.4").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V6(SocketAddrV6::new(
-                        Ipv6Addr::new(0x2001, 0x4860, 0x4860, 0, 0, 0, 0, 0x8888),
-                        53,
-                        0,
-                        0,
-                    )),
+                    address: Url::parse("udp://2001:4860:4860::8888:53").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V6(SocketAddrV6::new(
-                        Ipv6Addr::new(0x2001, 0x4860, 0x4860, 0, 0, 0, 0, 0x8844),
-                        53,
-                        0,
-                        0,
-                    )),
+                    address: Url::parse("udp://2001:4860:4860::8844").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
             }
             Some(BuiltinDnsOption::Quad9) => {
                 results.push(NameServerConfig {
-                    address: SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::new(9, 9, 9, 9), 53)),
+                    address: Url::parse("udp://9.9.9.9:53").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
                 results.push(NameServerConfig {
-                    address: SocketAddr::V6(SocketAddrV6::new(
-                        Ipv6Addr::new(0x2620, 0, 0, 0, 0, 0, 0xfe, 0xfe),
-                        53,
-                        0,
-                        0,
-                    )),
+                    address: Url::parse("udp://2620::00fe:00f3").unwrap(),
                     timeout_in_seconds: None,
                     bind_address: None,
                 });
diff --git a/src/network/host.rs b/src/network/host.rs
index d0e5c91..64d4909 100644
--- a/src/network/host.rs
+++ b/src/network/host.rs
@@ -1,7 +1,7 @@
+use crate::network::resolver::name::Name;
 use crate::network::resolver::{ResolveError, Resolver};
 use error_stack::{report, ResultExt};
 use futures::stream::{FuturesUnordered, StreamExt};
-use hickory_client::rr::Name;
 use std::collections::HashSet;
 use std::fmt;
 use std::net::{AddrParseError, IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
@@ -63,7 +63,7 @@ impl FromStr for Host {
             }
         }
 
-        if let Ok(name) = Name::from_utf8(s) {
+        if let Ok(name) = Name::from_str(s) {
             return Ok(Host::Hostname(name));
         }
 
@@ -76,11 +76,8 @@ impl FromStr for Host {
 
 #[derive(Debug, Error)]
 pub enum ConnectionError {
-    #[error("Failed to resolve host: {error}")]
-    ResolveError {
-        #[from]
-        error: ResolveError,
-    },
+    #[error("Connection error: failed to resolve host")]
+    ResolveError,
     #[error("No valid IP addresses found")]
     NoAddresses,
     #[error("Error connecting to host: {error}")]
@@ -98,7 +95,10 @@ impl Host {
     /// are no relevant records for us to use for IPv4 or IPv6 connections. There
     /// is also no guarantee that the host will have both IPv4 and IPv6 addresses,
     /// so you may only see one or the other.
-    pub async fn resolve(&self, resolver: &mut Resolver) -> Result<HashSet<IpAddr>, ResolveError> {
+    pub async fn resolve(
+        &self,
+        resolver: &mut Resolver,
+    ) -> error_stack::Result<HashSet<IpAddr>, ResolveError> {
         match self {
             Host::IPv4(addr) => Ok(HashSet::from([IpAddr::V4(*addr)])),
             Host::IPv6(addr) => Ok(HashSet::from([IpAddr::V6(*addr)])),
@@ -121,7 +121,7 @@ impl Host {
         let addresses = self
             .resolve(resolver)
             .await
-            .map_err(ConnectionError::from)
+            .change_context(ConnectionError::ResolveError)
             .attach_printable_lazy(|| format!("target address {}", self))?;
 
         let mut connectors = FuturesUnordered::new();
diff --git a/src/network/resolver.rs b/src/network/resolver.rs
index 67302e8..0a89242 100644
--- a/src/network/resolver.rs
+++ b/src/network/resolver.rs
@@ -1,39 +1,27 @@
+pub mod name;
+mod protocol;
+mod resolution_table;
+
 use crate::config::resolver::{DnsConfig, NameServerConfig};
-use error_stack::report;
-use futures::future::select;
-use futures::stream::{SelectAll, StreamExt};
-use hickory_client::rr::Name;
-use hickory_proto::error::ProtoError;
-use hickory_proto::op::message::Message;
-use hickory_proto::op::query::Query;
-use hickory_proto::rr::record_data::RData;
-use hickory_proto::rr::resource::Record;
-use hickory_proto::rr::RecordType;
-use hickory_proto::udp::UdpClientStream;
-use hickory_proto::xfer::dns_request::DnsRequest;
-use hickory_proto::xfer::{DnsRequestSender, DnsResponseStream};
+use crate::network::resolver::name::Name;
+use crate::network::resolver::resolution_table::ResolutionTable;
+use error_stack::{report, ResultExt};
 use std::collections::{HashMap, HashSet};
-use std::net::{IpAddr, SocketAddr};
-#[cfg(test)]
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::str::FromStr;
 use std::sync::Arc;
 use thiserror::Error;
-use tokio::net::UdpSocket;
-use tokio::sync::{oneshot, Mutex};
+use tokio::net::{TcpSocket, UdpSocket};
+use tokio::sync::Mutex;
 use tokio::task::JoinSet;
-use tokio::time::{timeout_at, Duration, Instant};
+use tokio::time::{Duration, Instant};
 
 #[derive(Debug, Error)]
 pub enum ResolverConfigError {
-    #[error("Bad local domain name '{name}' provided: '{error}'")]
-    BadDomainName { name: String, error: ProtoError },
-    #[error("Bad domain name for search '{name}' provided: '{error}'")]
-    BadSearchName { name: String, error: ProtoError },
-    #[error("Couldn't set up client for server at '{address}': '{error}'")]
-    FailedToCreateDnsClient {
-        address: SocketAddr,
-        error: ProtoError,
-    },
+    #[error("Bad local domain name provided")]
+    BadDomainName,
+    #[error("Couldn't create a DNS client for the given address, port, and protocol.")]
+    FailedToCreateDnsClient,
     #[error("No DNS servers found to search, and mDNS not enabled")]
     NoHosts,
 }
@@ -44,8 +32,8 @@ pub enum ResolveError {
     NoServersAvailable,
     #[error("No responses found for query")]
     NoResponses,
-    #[error("Error reading response: {error}")]
-    ResponseError { error: ProtoError },
+    #[error("Error reading response from server")]
+    ResponseError,
 }
 
 pub struct Resolver {
@@ -53,11 +41,13 @@ pub struct Resolver {
     max_time_to_wait_for_initial: Duration,
     time_to_wait_after_first: Duration,
     time_to_wait_for_lingering: Duration,
-    state: Arc<Mutex<ResolverState>>,
+    connections: Arc<Mutex<Vec<(NameServerConfig, protocol::Client)>>>,
+    table: Arc<Mutex<ResolutionTable>>,
+    tasks: JoinSet<()>,
 }
 
 pub struct ResolverState {
-    client_connections: Vec<(NameServerConfig, UdpClientStream<UdpSocket>)>,
+    client_connections: Vec<(NameServerConfig, protocol::Client)>,
     cache: HashMap<Name, Vec<DnsResolution>>,
 }
 
@@ -70,40 +60,151 @@ impl Resolver {
     /// Create a new DNS resolution engine for use by some part of the system.
     pub async fn new(config: &DnsConfig) -> error_stack::Result<Self, ResolverConfigError> {
         let mut search_domains = Vec::new();
+        let mut tasks = JoinSet::new();
 
         if let Some(local) = config.local_domain.as_ref() {
-            search_domains.push(Name::from_utf8(local).map_err(|e| {
-                report!(ResolverConfigError::BadDomainName {
-                    name: local.clone(),
-                    error: e,
-                })
-            })?);
+            let name = Name::from_str(local)
+                .change_context(ResolverConfigError::BadDomainName)
+                .attach_printable("Trying to add local domain.")
+                .attach_printable_lazy(|| "Offending non-name: '{local}'")?;
+
+            search_domains.push(name);
         }
 
-        for local_domain in config.search_domains.iter() {
-            search_domains.push(Name::from_utf8(local_domain).map_err(|e| {
-                report!(ResolverConfigError::BadSearchName {
-                    name: local_domain.clone(),
-                    error: e,
-                })
-            })?);
+        for search_domain in config.search_domains.iter() {
+            let name = Name::from_str(search_domain)
+                .change_context(ResolverConfigError::BadDomainName)
+                .attach_printable("Trying to add search domain.")
+                .attach_printable_lazy(|| "Offending non-name: '{search_domain}'")?;
+
+            search_domains.push(name);
         }
 
         let mut client_connections = Vec::new();
 
-        for name_server_config in config.name_servers() {
-            let stream = UdpClientStream::with_bind_addr_and_timeout(
-                name_server_config.address,
-                name_server_config.bind_address,
-                Duration::from_secs(name_server_config.timeout_in_seconds.unwrap_or(3)),
-            )
-            .await
-            .map_err(|error| ResolverConfigError::FailedToCreateDnsClient {
-                address: name_server_config.address,
-                error,
-            })?;
+        for target in config.name_servers.iter() {
+            let port = target.address.port().unwrap_or(53);
+            let Some(address) = target.address.host() else {
+                return Err(report!(ResolverConfigError::FailedToCreateDnsClient))
+                    .attach_printable("No address to connect to?")
+                    .attach_printable_lazy(|| format!("Target address was {}", target.address));
+            };
 
-            client_connections.push((name_server_config, stream));
+            let address = match address {
+                url::Host::Ipv4(addr) => IpAddr::V4(addr),
+                url::Host::Ipv6(addr) => IpAddr::V6(addr),
+                url::Host::Domain(name) => {
+                    return Err(report!(ResolverConfigError::FailedToCreateDnsClient))
+                        .attach_printable("Cannot use domain names to identify domain servers")
+                        .attach_printable_lazy(|| format!("Target address was {name}"));
+                }
+            };
+            let target_addr = SocketAddr::new(address, port);
+
+            match target.address.scheme() {
+                "tcp" => {
+                    let socket = if target_addr.is_ipv4() {
+                        TcpSocket::new_v4()
+                    } else {
+                        TcpSocket::new_v6()
+                    };
+
+                    let socket = socket
+                        .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                        .attach_printable("Could not create a socket")
+                        .attach_printable_lazy(|| {
+                            format!("For target DNS server {}", target.address)
+                        })?;
+
+                    if let Some(bind_address) = target.bind_address {
+                        socket
+                            .bind(bind_address)
+                            .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                            .attach_printable("Could not bind local address for socket.")
+                            .attach_printable_lazy(|| {
+                                format!("Binding to TCP address {}", bind_address)
+                            })
+                            .attach_printable_lazy(|| {
+                                format!("For target DNS server {}", target.address)
+                            })?;
+                    }
+
+                    let stream = socket
+                        .connect(target_addr)
+                        .await
+                        .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                        .attach_printable_lazy(|| {
+                            format!("Connecting to target {}", target_addr)
+                        })?;
+                    let client = protocol::Client::from_tcp(stream, &mut tasks)
+                        .await
+                        .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                        .attach_printable_lazy(|| {
+                            format!("Connecting to target {}", target_addr)
+                        })?;
+
+                    client_connections.push((target.clone(), client));
+                }
+
+                "udp" => {
+                    let port = target.address.port().unwrap_or(53);
+                    let Some(address) = target.address.host() else {
+                        tracing::warn!(address = %target.address, "proposed domain server has no host");
+                        continue;
+                    };
+                    let address = match address {
+                        url::Host::Ipv4(addr) => IpAddr::V4(addr),
+                        url::Host::Ipv6(addr) => IpAddr::V6(addr),
+                        url::Host::Domain(name) => {
+                            tracing::warn!(
+                                address = %target.address,
+                                hostname = name,
+                                "currently, we can't use hostnames for domain servers"
+                            );
+                            continue;
+                        }
+                    };
+
+                    let sock_addr = SocketAddr::new(address, port);
+                    let bind_address = target.bind_address.unwrap_or_else(|| {
+                        if sock_addr.is_ipv4() {
+                            SocketAddr::new(IpAddr::V4(Ipv4Addr::new(0, 0, 0, 0)), 0)
+                        } else {
+                            SocketAddr::new(IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0)), 0)
+                        }
+                    });
+
+                    let udp_socket = UdpSocket::bind(bind_address)
+                        .await
+                        .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                        .attach_printable("Generating UDP socket")
+                        .attach_printable_lazy(|| format!("binding to address {bind_address}"))
+                        .attach_printable_lazy(|| format!("targeting {}", target.address))?;
+
+                    udp_socket
+                        .connect(target_addr)
+                        .await
+                        .change_context(ResolverConfigError::FailedToCreateDnsClient)
+                        .attach_printable("Connecting UDP socket")
+                        .attach_printable_lazy(|| format!("binding to address {bind_address}"))
+                        .attach_printable_lazy(|| format!("targeting {}", target.address))?;
+
+                    let client = protocol::Client::from_udp(udp_socket, &mut tasks).await;
+
+                    client_connections.push((target.clone(), client));
+                }
+
+                "unix" => unimplemented!(),
+                "unixd" => unimplemented!(),
+
+                "http" => unimplemented!(),
+                "https" => unimplemented!(),
+
+                _ => {
+                    tracing::warn!(address = %target.address, "Unknown scheme for building DNS connections");
+                    continue;
+                }
+            }
         }
 
         Ok(Resolver {
@@ -112,321 +213,35 @@ impl Resolver {
             max_time_to_wait_for_initial: Duration::from_millis(150),
             time_to_wait_after_first: Duration::from_millis(50),
             time_to_wait_for_lingering: Duration::from_secs(2),
-            state: Arc::new(Mutex::new(ResolverState {
-                client_connections,
-                cache: HashMap::new(),
-            })),
+            connections: Arc::new(Mutex::new(client_connections)),
+            table: Arc::new(Mutex::new(ResolutionTable::new())),
+            tasks,
         })
     }
 
-    /// Look up the address of the given name, returning either a set of results
-    /// we've received in a reasonable amount of time, or an error.
-    pub async fn lookup(&self, name: &Name) -> Result<HashSet<IpAddr>, ResolveError> {
-        let names = self.expand_name(name);
-
-        let cached_values = self.cached_lookup(&names).await;
-        if !cached_values.is_empty() {
-            return Ok(cached_values);
-        }
-
-        let mut response_stream = self.create_response_stream(&names).await;
-        if response_stream.is_empty() {
-            return Err(ResolveError::NoServersAvailable);
-        }
-
-        let get_first_by = Instant::now() + self.max_time_to_wait_for_initial;
-        let got_responses =
-            get_responses_by(&self.state, get_first_by, name, &mut response_stream).await?;
-
-        if got_responses {
-            let get_rest_by = Instant::now() + self.time_to_wait_after_first;
-            let _ = get_responses_by(&self.state, get_rest_by, name, &mut response_stream).await;
-        }
-
-        let lingering_deadline = Instant::now() + self.time_to_wait_for_lingering;
-        let state_copy = self.state.clone();
-        let name_copy = name.clone();
-        tokio::task::spawn(async move {
-            let _ = get_responses_by(
-                &state_copy,
-                lingering_deadline,
-                &name_copy,
-                &mut response_stream,
-            )
-            .await;
-        });
-
-        let after_search_lookup = self.cached_lookup(&names).await;
-        if after_search_lookup.is_empty() {
-            Err(ResolveError::NoResponses)
-        } else {
-            Ok(after_search_lookup)
-        }
-    }
-
-    /// Look up any cached IP address we might have for the given names.
-    ///
-    /// As a side effect, this function will clean out any expired entries in the
-    /// cache.
-    async fn cached_lookup(&self, names: &[Name]) -> HashSet<IpAddr> {
-        let mut retval = HashSet::new();
-        let mut state = self.state.lock().await;
-
-        for name in names {
-            if let Some(mut existing) = state.cache.remove(name) {
-                let now = Instant::now();
-
-                existing.retain(|item| {
-                    let keeper = item.expires_at > now;
-
-                    if keeper {
-                        retval.insert(item.address);
-                    }
-
-                    keeper
-                });
-
-                if !existing.is_empty() {
-                    state.cache.insert(name.clone(), existing);
-                }
-            }
-        }
-
-        retval
-    }
-
-    /// Reach out to all of our current connections, and start the process of getting
-    /// responses.
-    ///
-    /// If the clients are shut down, we'll try to create new connections to them, or
-    /// remove them from our connection list if we can't. If there are no connections,
-    /// the `SelectAll` will be empty, and callers are advised to check for this
-    /// condition and inform the user that they're out of useful DNS servers.
-    async fn create_response_stream(&self, names: &[Name]) -> SelectAll<DnsResponseStream> {
-        let mut state = self.state.lock().await;
-        let connections = std::mem::take(&mut state.client_connections);
-        let mut response_stream = futures::stream::SelectAll::new();
-
-        for (config, mut client) in connections.into_iter() {
-            if client.is_shutdown() {
-                let stream = UdpClientStream::with_bind_addr_and_timeout(
-                    config.address,
-                    config.bind_address,
-                    Duration::from_secs(config.timeout_in_seconds.unwrap_or(3)),
-                )
-                .await;
-
-                match stream {
-                    Ok(stream) => client = stream,
-                    Err(_) => continue,
-                }
-            }
-
-            let mut message = Message::new();
-
-            for name in names.iter() {
-                message.add_query(Query::query(name.clone(), RecordType::A));
-                message.add_query(Query::query(name.clone(), RecordType::AAAA));
-            }
-            message.set_recursion_desired(true);
-
-            let request = DnsRequest::new(message, Default::default());
-            response_stream.push(client.send_message(request));
-            state.client_connections.push((config, client));
-        }
-
-        response_stream
-    }
-
-    /// Expand the given input name into the complete set of names that we should search for.
-    fn expand_name(&self, name: &Name) -> Vec<Name> {
-        let mut names = vec![name.clone()];
-
-        for search_domain in self.search_domains.iter() {
-            if let Ok(combined) = name.clone().append_name(search_domain) {
-                names.push(combined);
-            }
-        }
-
-        names
-    }
-
-    /// Run a cleaner task on this Resolver object.
-    ///
-    /// The task will run in the given JoinSet, set it can be easily killed, tracked, waited
-    /// for as desired. Every `period` interval, it will grab the state lock and clean out
-    /// any entries that are timed out. Ideally, you shouldn't set this too frequently, so
-    /// that this process doesn't interfere with other tasks trying to use the resolver.
-    ///
-    /// This task will only weakly hang on to the resolver state, so that if the Resolver
-    /// object is dropped it will quietly stop running. It will also stop running if it sees
-    /// a message on the kill signal, if one is provided, or if one is provided and the other
-    /// end drops the sender. (So if you don't want a kill signal, send `None`, or you might
-    /// accidentally kill your GC task too early.)
-    pub async fn run_resolver_gc(
-        &self,
-        task_set: &mut JoinSet<Result<(), ()>>,
-        mut kill_signal: Option<oneshot::Receiver<()>>,
-        interval: Duration,
-    ) {
-        let weak_locked_state = Arc::downgrade(&self.state);
-
-        task_set.spawn(async move {
-            loop {
-                tokio::time::sleep(interval).await;
-
-                let Some(locked_state) = weak_locked_state.upgrade() else {
-                    break Ok(());
-                };
-
-                let mut state = if let Some(kill_signal) = kill_signal.as_mut() {
-                    let locker = locked_state.lock();
-
-                    futures::pin_mut!(locker);
-                    match select(locker, kill_signal).await {
-                        futures::future::Either::Left((state, _)) => state,
-                        futures::future::Either::Right((_, _)) => break Ok(()),
-                    }
-                } else {
-                    locked_state.lock().await
-                };
-
-                let now = Instant::now();
-                state.cache.retain(|_, value| {
-                    value.retain(|resolution| resolution.expires_at < now);
-                    !value.is_empty()
-                });
-
-                drop(state);
-            }
-        });
-    }
-
-    /// Inject a mapping into the resolver, with the given TTL.
-    ///
-    /// This is largely used for testing purposes, but could be used if there are static
-    /// addresses you want to always resolve in a particular way. For that use case, you
-    /// probably want to add absurdly-long TTLs for those names.
-    pub async fn inject_resolution(&self, name: Name, address: IpAddr, ttl: Duration) {
-        let resolution = DnsResolution {
-            address,
-            expires_at: Instant::now() + ttl,
-        };
-
-        let mut state = self.state.lock().await;
-        match state.cache.entry(name) {
-            std::collections::hash_map::Entry::Vacant(vac) => {
-                vac.insert(vec![resolution]);
-            }
-            std::collections::hash_map::Entry::Occupied(mut occ) => {
-                occ.get_mut().push(resolution);
-            }
-        }
-        drop(state);
+    pub async fn lookup(&self, _name: &Name) -> error_stack::Result<HashSet<IpAddr>, ResolveError> {
+        unimplemented!()
     }
 }
 
-/// Get all the responses into cache that occur before the given timestamp.
-///
-/// Returns an error if all we get are errors while trying to read from these servers,
-/// otherwise returns Ok(true) if we received some interesting responses, or Ok(false)
-/// if we didn't. Note that receiving good responses wins out over receiving errors, so
-/// if we receive 2 good responses and 3 errors, this function will return Ok(true).
-async fn get_responses_by(
-    state: &Arc<Mutex<ResolverState>>,
-    deadline: Instant,
-    name: &Name,
-    stream: &mut SelectAll<DnsResponseStream>,
-) -> Result<bool, ResolveError> {
-    let mut received_error = None;
-    let mut got_something = false;
+//#[tokio::test]
+//async fn fetch_cached() {
+//    let resolver = Resolver::new(&DnsConfig::empty()).await.unwrap();
+//    let name = Name::from_utf8("name.foo").unwrap();
+//    let addr = IpAddr::from_str("1.2.4.5").unwrap();
+//
+//    resolver
+//        .inject_resolution(name.clone(), addr.clone(), Duration::from_secs(100000))
+//        .await;
+//    let read = resolver.lookup(&name).await.unwrap();
+//    assert!(read.contains(&addr));
+//}
 
-    loop {
-        match timeout_at(deadline, stream.next()).await {
-            Err(_) => return received_error.unwrap_or(Ok(got_something)),
-
-            Ok(None) if got_something => return Ok(got_something),
-            Ok(None) => return received_error.unwrap_or(Ok(false)),
-
-            Ok(Some(Err(error))) => {
-                if received_error.is_none() {
-                    received_error = Some(Err(ResolveError::ResponseError { error }));
-                }
-            }
-            Ok(Some(Ok(response))) => {
-                for answer in response.into_message().take_answers() {
-                    got_something |= handle_response(state, name, answer).await;
-                }
-            }
-        }
-    }
-}
-
-/// Handle an individual response from a server.
-///
-/// Returns true if we got an answer from the server, and updates the internal cache.
-/// This function will never return an error, although there may be some odd processing
-/// situations that could lead it to printing warnings to the logs.
-async fn handle_response(state: &Arc<Mutex<ResolverState>>, query: &Name, record: Record) -> bool {
-    let ttl = record.ttl();
-
-    let Some(rdata) = record.into_data() else {
-        tracing::error!("for some reason, couldn't process incoming message");
-        return false;
-    };
-
-    let address: IpAddr = match rdata {
-        RData::A(arec) => arec.0.into(),
-        RData::AAAA(arec) => arec.0.into(),
-
-        _ => {
-            tracing::warn!(record_type = %rdata.record_type(), "skipping unknown / unexpected record type");
-            return false;
-        }
-    };
-
-    let now = Instant::now();
-    let expires_at = now + Duration::from_secs(ttl as u64);
-    let resolution = DnsResolution {
-        address,
-        expires_at,
-    };
-
-    let mut state = state.lock().await;
-    match state.cache.entry(query.clone()) {
-        std::collections::hash_map::Entry::Vacant(vec) => {
-            vec.insert(vec![resolution]);
-        }
-
-        std::collections::hash_map::Entry::Occupied(mut occ) => {
-            let vec = occ.get_mut();
-            vec.retain(|x| x.expires_at > now);
-            vec.push(resolution);
-        }
-    }
-    drop(state);
-
-    true
-}
-
-#[tokio::test]
-async fn fetch_cached() {
-    let resolver = Resolver::new(&DnsConfig::empty()).await.unwrap();
-    let name = Name::from_utf8("name.foo").unwrap();
-    let addr = IpAddr::from_str("1.2.4.5").unwrap();
-
-    resolver
-        .inject_resolution(name.clone(), addr.clone(), Duration::from_secs(100000))
-        .await;
-    let read = resolver.lookup(&name).await.unwrap();
-    assert!(read.contains(&addr));
-}
-
-#[tokio::test]
-async fn uhsure() {
-    let resolver = Resolver::new(&DnsConfig::default()).await.unwrap();
-    let name = Name::from_ascii("uhsure.com").unwrap();
-    let result = resolver.lookup(&name).await.unwrap();
-    println!("result = {:?}", result);
-    assert!(!result.is_empty());
-}
+//#[tokio::test]
+//async fn uhsure() {
+//    let resolver = Resolver::new(&DnsConfig::default()).await.unwrap();
+//    let name = Name::from_ascii("uhsure.com").unwrap();
+//    let result = resolver.lookup(&name).await.unwrap();
+//    println!("result = {:?}", result);
+//    assert!(!result.is_empty());
+//}
diff --git a/src/network/resolver/name.rs b/src/network/resolver/name.rs
new file mode 100644
index 0000000..9ade8ad
--- /dev/null
+++ b/src/network/resolver/name.rs
@@ -0,0 +1,505 @@
+use bytes::{Buf, BufMut};
+use error_stack::{report, ResultExt};
+use internment::ArcIntern;
+use proptest::arbitrary::Arbitrary;
+use proptest::char::CharStrategy;
+use proptest::strategy::{BoxedStrategy, Strategy};
+use std::borrow::Cow;
+use std::fmt;
+use std::hash::Hash;
+use std::ops::{Range, RangeInclusive};
+use std::str::FromStr;
+
+use thiserror::Error;
+
+#[derive(Clone, Hash, PartialEq, Eq)]
+pub struct Name {
+    labels: Vec<Label>,
+}
+
+impl fmt::Debug for Name {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut first_section = true;
+
+        for &Label(ref label) in self.labels.iter() {
+            if first_section {
+                first_section = false;
+                write!(f, "{}", label.as_str())?;
+            } else {
+                write!(f, ".{}", label.as_str())?;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl fmt::Display for Name {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        <Self as fmt::Debug>::fmt(self, f)
+    }
+}
+
+#[derive(Clone, Hash, Eq)]
+pub struct Label(ArcIntern<String>);
+
+impl fmt::Debug for Label {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.as_str().fmt(f)
+    }
+}
+
+impl fmt::Display for Label {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.as_str().fmt(f)
+    }
+}
+
+impl PartialEq for Label {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.eq_ignore_ascii_case(other.0.as_str())
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum NameParseError {
+    #[error("Provided name '{name}' is too long ({observed_length} bytes); maximum length of a DNS name is 255 octets.")]
+    NameTooLong {
+        name: String,
+        observed_length: usize,
+    },
+
+    #[error("Provided name '{name}' contains illegal character '{illegal_character}'.")]
+    NonAsciiCharacter {
+        name: String,
+        illegal_character: char,
+    },
+
+    #[error("Provided name '{name}' contains an empty section/label, which isn't allowed.")]
+    EmptyLabel { name: String },
+
+    #[error("Provided name '{name}' contains a label ('{label}') that is too long ({observed_length} letters, which is more than 63).")]
+    LabelTooLong {
+        observed_length: usize,
+        name: String,
+        label: String,
+    },
+
+    #[error("Provided name '{name}' contains a label ('{label}') that begins with an illegal character; it must be a letter.")]
+    LabelStartsWrong { name: String, label: String },
+
+    #[error("Provided name '{name}' contains a label ('{label}') that ends with an illegal character; it must be a letter or number.")]
+    LabelEndsWrong { name: String, label: String },
+
+    #[error("Provided name '{name}' contains a label ('{label}') that contains a non-letter, non-number, and non-dash.")]
+    IllegalInternalCharacter { name: String, label: String },
+}
+
+impl FromStr for Name {
+    type Err = NameParseError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let observed_length = value.as_bytes().len();
+
+        if observed_length > 255 {
+            return Err(NameParseError::NameTooLong {
+                name: value.to_string(),
+                observed_length,
+            });
+        }
+
+        for char in value.chars() {
+            if !(char.is_ascii_alphanumeric() || char == '.' || char == '-') {
+                return Err(NameParseError::NonAsciiCharacter {
+                    name: value.to_string(),
+                    illegal_character: char,
+                });
+            }
+        }
+
+        let mut labels = vec![];
+
+        for label_str in value.split('.') {
+            if label_str.is_empty() {
+                return Err(NameParseError::EmptyLabel {
+                    name: value.to_string(),
+                });
+            }
+
+            if label_str.len() > 63 {
+                return Err(NameParseError::LabelTooLong {
+                    name: value.to_string(),
+                    label: label_str.to_string(),
+                    observed_length: label_str.len(),
+                });
+            }
+
+            let letter = |x| ('a'..='z').contains(&x) || ('A'..='Z').contains(&x);
+            let letter_or_num = |x| letter(x) || ('0'..='9').contains(&x);
+            let letter_num_dash = |x| letter_or_num(x) || (x == '-');
+
+            if !label_str.starts_with(letter) {
+                return Err(NameParseError::LabelStartsWrong {
+                    name: value.to_string(),
+                    label: label_str.to_string(),
+                });
+            }
+
+            if !label_str.ends_with(letter_or_num) {
+                return Err(NameParseError::LabelEndsWrong {
+                    name: value.to_string(),
+                    label: label_str.to_string(),
+                });
+            }
+
+            if label_str.contains(|x| !letter_num_dash(x)) {
+                return Err(NameParseError::IllegalInternalCharacter {
+                    name: value.to_string(),
+                    label: label_str.to_string(),
+                });
+            }
+
+            // RFC 1035 says that all domain names are case-insensitive. We
+            // arbitrarily normalize to lowercase here, because it shouldn't
+            // matter to anyone.
+            labels.push(Label(ArcIntern::new(label_str.to_string())));
+        }
+
+        Ok(Name { labels })
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum NameReadError {
+    #[error("Could not read name field out of an empty buffer.")]
+    EmptyBuffer,
+
+    #[error("Buffer truncated before we could read the last label")]
+    TruncatedBuffer,
+
+    #[error("Provided label value too long; must be 63 octets or less.")]
+    LabelTooLong,
+
+    #[error("Label truncated while reading. Broken stream?")]
+    LabelTruncated,
+
+    #[error("Label starts with an illegal character (must be [A-Za-z])")]
+    WrongFirstByte,
+
+    #[error("Label ends with an illegal character (must be [A-Za-z0-9]")]
+    WrongLastByte,
+
+    #[error("Label contains an illegal character (must be [A-Za-z0-9] or a dash)")]
+    WrongInnerByte,
+}
+
+impl Name {
+    /// Read a name frm a record, or return an error describing what went wrong.
+    ///
+    /// This function will advance the read pointer on the record. If the result is
+    /// an error, the read pointer is not guaranteed to be in a good place, so you
+    /// may need to manage that externally if you want to implement some sort of
+    /// "try" functionality.
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Name, NameReadError> {
+        let mut labels = Vec::new();
+        let name_so_far = |labels: Vec<Label>| {
+            let mut result = String::new();
+
+            for Label(label) in labels.into_iter() {
+                if result.is_empty() {
+                    result.push_str(label.as_str());
+                } else {
+                    result.push('.');
+                    result.push_str(label.as_str());
+                }
+            }
+
+            result
+        };
+
+        loop {
+            if !buffer.has_remaining() && labels.is_empty() {
+                return Err(report!(NameReadError::EmptyBuffer));
+            }
+
+            if !buffer.has_remaining() {
+                return Err(report!(NameReadError::TruncatedBuffer))
+                    .attach_printable_lazy(|| format!("name thus far: '{}'", name_so_far(labels)));
+            }
+
+            let label_octet_length = buffer.get_u8() as usize;
+            if label_octet_length == 0 {
+                break;
+            }
+
+            if label_octet_length > 63 {
+                return Err(report!(NameReadError::LabelTooLong)).attach_printable_lazy(|| {
+                    format!(
+                        "label length too big; max is supposed to be 63, saw {label_octet_length}"
+                    )
+                });
+            }
+
+            if !buffer.remaining() < label_octet_length {
+                let remaining = buffer.copy_to_bytes(buffer.remaining());
+                let partial = String::from_utf8_lossy(&remaining).to_string();
+
+                return Err(report!(NameReadError::LabelTruncated))
+                    .attach_printable_lazy(|| format!("name thus far: '{}'", name_so_far(labels)))
+                    .attach_printable_lazy(|| {
+                        format!(
+                            "expected {} octets, but only found {}",
+                            label_octet_length,
+                            buffer.remaining()
+                        )
+                    })
+                    .attach_printable_lazy(|| format!("partial read: '{partial}'"));
+            }
+
+            let label_bytes = buffer.copy_to_bytes(label_octet_length);
+            let Some(first_byte) = label_bytes.first() else {
+                panic!(
+                    "INTERNAL ERROR: Should have at least one byte, we checked this previously."
+                );
+            };
+            let Some(last_byte) = label_bytes.last() else {
+                panic!(
+                    "INTERNAL ERROR: Should have at least one byte, we checked this previously."
+                );
+            };
+
+            let letter = |x| (b'a'..=b'z').contains(&x) || (b'A'..=b'Z').contains(&x);
+            let letter_or_num = |x| letter(x) || (b'0'..=b'9').contains(&x);
+            let letter_num_dash = |x| letter_or_num(x) || (x == b'-');
+
+            if !letter(*first_byte) {
+                return Err(report!(NameReadError::WrongFirstByte))
+                    .attach_printable_lazy(|| format!("name thus far: '{}'", name_so_far(labels)))
+                    .attach_printable_lazy(|| {
+                        format!("bad label: '{}'", String::from_utf8_lossy(&label_bytes))
+                    });
+            }
+
+            if !letter_or_num(*last_byte) {
+                return Err(report!(NameReadError::WrongLastByte))
+                    .attach_printable_lazy(|| format!("name thus far: '{}'", name_so_far(labels)))
+                    .attach_printable_lazy(|| {
+                        format!("bad label: '{}'", String::from_utf8_lossy(&label_bytes))
+                    });
+            }
+
+            if label_bytes.iter().any(|x| !letter_num_dash(*x)) {
+                return Err(report!(NameReadError::WrongInnerByte))
+                    .attach_printable_lazy(|| format!("name thus far: '{}'", name_so_far(labels)))
+                    .attach_printable_lazy(|| {
+                        format!("bad label: '{}'", String::from_utf8_lossy(&label_bytes))
+                    });
+            }
+
+            let label = label_bytes.into_iter().map(|x| x as char).collect();
+            labels.push(Label(ArcIntern::new(label)));
+        }
+
+        Ok(Name { labels })
+    }
+
+    /// Write a name out to the given buffer.
+    ///
+    /// This will try as hard as it can to write the value to the given buffer. If an
+    /// error occurs, you may end up with partially-written data, so if you're worried
+    /// about that you should be careful to mark where you started in the output buffer.
+    pub fn write<B: BufMut>(&self, buffer: &mut B) -> error_stack::Result<(), NameWriteError> {
+        for &Label(ref label) in self.labels.iter() {
+            let bytes = label.as_bytes();
+
+            if buffer.remaining_mut() < (bytes.len() + 1) {
+                return Err(report!(NameWriteError::NoRoomForLabel))
+                    .attach_printable_lazy(|| format!("Writing name {self}"))
+                    .attach_printable_lazy(|| format!("For label {label}"));
+            }
+
+            if bytes.is_empty() || bytes.len() > 63 {
+                return Err(report!(NameWriteError::IllegalLabel))
+                    .attach_printable_lazy(|| format!("Writing name {self}"))
+                    .attach_printable_lazy(|| format!("For label {label}"));
+            }
+
+            buffer.put_u8(bytes.len() as u8);
+            buffer.put_slice(bytes);
+        }
+
+        if !buffer.has_remaining_mut() {
+            return Err(report!(NameWriteError::NoRoomForNull))
+                .attach_printable_lazy(|| format!("Writing name {self}"));
+        }
+        buffer.put_u8(0);
+
+        Ok(())
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum NameWriteError {
+    #[error("Not enough room to write label in name")]
+    NoRoomForLabel,
+
+    #[error("Ran out of room writing the terminating NULL for the name")]
+    NoRoomForNull,
+
+    #[error("Internal error: Illegal label (this shouldn't happen)")]
+    IllegalLabel,
+}
+
+#[derive(Debug)]
+pub struct ArbitraryDomainNameSpecifications {
+    total_length_range: Range<usize>,
+    label_length_range: Range<usize>,
+    number_labels: Range<usize>,
+}
+
+impl Default for ArbitraryDomainNameSpecifications {
+    fn default() -> Self {
+        ArbitraryDomainNameSpecifications {
+            total_length_range: 5..256,
+            label_length_range: 1..64,
+            number_labels: 2..5,
+        }
+    }
+}
+
+impl Arbitrary for Name {
+    type Parameters = ArbitraryDomainNameSpecifications;
+    type Strategy = BoxedStrategy<Name>;
+
+    fn arbitrary_with(spec: Self::Parameters) -> Self::Strategy {
+        (spec.number_labels.clone(), spec.total_length_range.clone())
+            .prop_flat_map(move |(mut labels, mut total_length)| {
+             // we need to make sure that our total length and our label count are,
+             // at the very minimum, compatible. If they're not, we'll need to adjust
+             // them.
+             //
+             // in general, we prefer to update our number of labels, if we can, but
+             // only to the extent that the labels count is at least the minimum of
+             // our input specification. if we try to go below that, we increase total
+             // length as required. If we're forced into a place where we need to take
+             // the label length below it's minimum and/or the total_length over its
+             // maximum, we just give up and panic.
+             //
+             // Note that the minimum length of n labels is (n * label_minimum) + n - 1.
+             // Consider, for example, a label_minimum of 1 and a label length of 3.
+             // A minimum string is "a.b.c", which is (3 * 1) + 3 - 1 = 5 characters
+             // long.
+             //
+             // This loop does the first part, lowering the number of labels until we
+             // either get below the total length or reach the minimum number of labels.
+             while (labels * spec.label_length_range.start) + (labels - 1) > total_length {
+                 if labels == spec.number_labels.start {
+                     break;
+                 } else {
+                     labels -= 1;
+                 }
+             }
+
+             // At this point, if it's not right, we just set it to be right.
+             if (labels * spec.total_length_range.start) + (labels - 1) > total_length {
+                 total_length = (labels * spec.total_length_range.start) + (labels - 1);
+             }
+
+             // And if this takes us over our limit, just panic.
+             if total_length >= spec.total_length_range.end {
+                 panic!("Unresolvable generation condition; couldn't resolve label count {} with total_length {}, with specification {:?}", labels, total_length, spec);
+             }
+
+             proptest::collection::vec(Label::arbitrary_with(spec.label_length_range.clone()), labels)
+                 .prop_map(|labels| Name{ labels })
+        }).boxed()
+    }
+}
+
+impl Arbitrary for Label {
+    type Parameters = Range<usize>;
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary() -> Self::Strategy {
+        Self::arbitrary_with(1..64)
+    }
+
+    fn arbitrary_with(args: Self::Parameters) -> Self::Strategy {
+        args.prop_flat_map(|length| {
+            let first = char_selector(&['a'..='z', 'A'..='Z']);
+            let middle = char_selector(&['a'..='z', 'A'..='Z', '-'..='-', '0'..='9']);
+            let last = char_selector(&['a'..='z', 'A'..='Z', '0'..='9']);
+
+            match length {
+                0 => panic!("Should not be able to generate a label of length 0"),
+                1 => first.prop_map(|x| x.into()).boxed(),
+                2 => (first, last).prop_map(|(a, b)| format!("{a}{b}")).boxed(),
+                _ => (first, proptest::collection::vec(middle, length - 2), last)
+                    .prop_map(move |(first, middle, last)| {
+                        let mut result = String::with_capacity(length);
+                        result.push(first);
+                        for c in middle.iter() {
+                            result.push(*c);
+                        }
+                        result.push(last);
+                        result
+                    })
+                    .boxed(),
+            }
+        })
+        .prop_map(|x| Label(ArcIntern::new(x)))
+        .boxed()
+    }
+}
+
+fn char_selector<'a>(ranges: &'a [RangeInclusive<char>]) -> CharStrategy<'a> {
+    CharStrategy::new(
+        Cow::Borrowed(&[]),
+        Cow::Borrowed(&[]),
+        Cow::Borrowed(ranges),
+    )
+}
+
+proptest::proptest! {
+    #[test]
+    fn any_random_names_parses(name: Name) {
+        let name_str = name.to_string();
+        let new_name = Name::from_str(&name_str).expect("can re-parse name");
+        assert_eq!(name, new_name);
+    }
+
+    #[test]
+    fn any_random_name_roundtrips(name: Name) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(512);
+        name.write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_name = Name::read(&mut read_buffer).expect("can read name");
+        assert_eq!(name, new_name);
+    }
+}
+
+#[test]
+fn illegal_names_generate_errors() {
+    assert!(Name::from_str("").is_err());
+    assert!(Name::from_str(".").is_err());
+    assert!(Name::from_str(".com").is_err());
+    assert!(Name::from_str("com.").is_err());
+    assert!(Name::from_str("9.com").is_err());
+    assert!(Name::from_str("foo-.com").is_err());
+    assert!(Name::from_str("-foo.com").is_err());
+    assert!(Name::from_str(".foo.com").is_err());
+    assert!(Name::from_str("fo*o.com").is_err());
+    assert!(Name::from_str(
+        "foo.abcdefghiabcdefghiabcdefghiabcdefghiabcdefghiabcdefghijjjjjjabcdefghij.com"
+    )
+    .is_err());
+    assert!(Name::from_str("abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij.abcdefghij").is_err());
+}
+
+#[test]
+fn names_ignore_case() {
+    assert_eq!(
+        Name::from_str("UHSURE.COM").unwrap(),
+        Name::from_str("uhsure.com").unwrap()
+    );
+}
diff --git a/src/network/resolver/protocol.rs b/src/network/resolver/protocol.rs
new file mode 100644
index 0000000..147f5bf
--- /dev/null
+++ b/src/network/resolver/protocol.rs
@@ -0,0 +1,9 @@
+mod client;
+mod header;
+pub mod question;
+mod request;
+mod resource_record;
+mod response;
+mod server;
+
+pub use client::Client;
diff --git a/src/network/resolver/protocol/client.rs b/src/network/resolver/protocol/client.rs
new file mode 100644
index 0000000..7bb320e
--- /dev/null
+++ b/src/network/resolver/protocol/client.rs
@@ -0,0 +1,273 @@
+use crate::network::resolver::protocol::header::Header;
+use crate::network::resolver::protocol::question::Question;
+use bytes::{Bytes, BytesMut};
+use error_stack::ResultExt;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use thiserror::Error;
+use tokio::io::{AsyncReadExt, WriteHalf};
+use tokio::net::{TcpStream, UdpSocket, UnixDatagram, UnixStream};
+use tokio::sync::RwLock;
+use tokio::task::JoinSet;
+
+type Callback = fn() -> ();
+
+pub struct Client {
+    callback: Arc<RwLock<Callback>>,
+    channel: DnsChannel,
+}
+
+pub enum DnsChannel {
+    Tcp(WriteHalf<TcpStream>),
+    Udp(Arc<UdpSocket>),
+    UnixData(Arc<UnixDatagram>),
+    Unix(WriteHalf<UnixStream>),
+}
+
+fn empty_callback() {}
+
+#[derive(Debug, thiserror::Error)]
+pub enum SendError {}
+
+#[derive(Clone, Debug)]
+enum GeneralAddr {
+    Network(SocketAddr),
+    Unix(std::os::unix::net::SocketAddr),
+}
+
+impl From<SocketAddr> for GeneralAddr {
+    fn from(value: SocketAddr) -> Self {
+        GeneralAddr::Network(value)
+    }
+}
+
+impl From<tokio::net::unix::SocketAddr> for GeneralAddr {
+    fn from(value: tokio::net::unix::SocketAddr) -> Self {
+        GeneralAddr::Unix(value.into())
+    }
+}
+
+#[derive(Debug, Error)]
+enum ServerProcessorError {
+    #[error("Could not read message header from server.")]
+    CouldNotReadHeader,
+}
+
+async fn process_server_response(
+    callback: &Arc<RwLock<Callback>>,
+    mut bytes: Bytes,
+    source: GeneralAddr,
+) -> error_stack::Result<(), ServerProcessorError> {
+    unimplemented!()    
+}
+
+async fn run_response_processing_loop(
+    server: String,
+    maximum_consecurive_errors: u64,
+    callback: Arc<RwLock<Callback>>,
+    mut fetcher: impl AsyncFnMut() -> Result<(Bytes, GeneralAddr), std::io::Error>,
+) {
+    let mut consecutive_errors = 0;
+
+    loop {
+        match fetcher().await {
+            Ok((bytes, source)) => {
+                if let Err(e) = process_server_response(&callback, bytes, source).await {
+                    consecutive_errors += 1;
+                    tracing::warn!(
+                        server,
+                        error = %e,
+                        maximum_consecurive_errors,
+                        consecutive_errors,
+                        "error processing DNS server response"
+                    );
+                } else {
+                    consecutive_errors = 0;
+                }
+            }
+
+            Err(e) => {
+                consecutive_errors += 1;
+                tracing::warn!(
+                    server,
+                    error = %e,
+                    maximum_consecurive_errors,
+                    consecutive_errors,
+                    "failed to read response from DNS server"
+                );
+
+                if consecutive_errors >= maximum_consecurive_errors {
+                    break;
+                }
+            }
+        };
+    }
+
+    tracing::error!(
+        server,
+        "quitting DNS response processing loop due to too many consecutive errors"
+    );
+}
+
+impl Client {
+    /// Create a new DNS client from the given, targeted UnixDatagram socket.
+    ///
+    /// By "targeted", we mean that this socket should've had `connect` called on
+    /// it, so that the client can just send datagrams to the server without having
+    /// to know where to send them. It is unspecified what will happen to DNS clients
+    /// if you do not call `connect` beforehand.
+    pub async fn from_unix_datagram(socket: UnixDatagram, group: &mut JoinSet<()>) -> Self {
+        let callback = Arc::new(RwLock::new(empty_callback as Callback));
+        let socket = Arc::new(socket);
+
+        let reader_socket = socket.clone();
+        let reader_callback = callback.clone();
+        let server_addr = socket.local_addr()
+            .ok()
+            .map(|x| x.as_pathname().map(|x| x.display().to_string()))
+            .flatten()
+            .unwrap_or_else(|| "<unknown>".into());
+        let server = format!("unixd://{}", server_addr);
+
+        group.spawn(async move {
+            let fetcher = async move || {
+                let mut buffer = BytesMut::with_capacity(16384);
+
+                match reader_socket.recv_buf_from(&mut buffer).await {
+                    Err(x) => Err(x),
+                    Ok((size, from)) => {
+                        unsafe {
+                            buffer.set_len(size);
+                        };
+                        Ok((buffer.freeze(), from.into()))
+                    }
+                }
+            };
+
+            run_response_processing_loop(server, 5, reader_callback, fetcher).await;
+        });
+
+        Client {
+            callback,
+            channel: DnsChannel::UnixData(socket),
+        }
+    }
+
+    pub async fn from_unix_stream(
+        socket: UnixStream,
+        group: &mut JoinSet<()>,
+    ) -> std::io::Result<Self> {
+        let callback = Arc::new(RwLock::new(empty_callback as Callback));
+        let server_addr = socket.local_addr()
+            .ok()
+            .map(|x| x.as_pathname().map(|x| x.display().to_string()))
+            .flatten()
+            .unwrap_or_else(|| "<unknown>".into());
+        let server = format!("unix://{}", server_addr);
+        let other_side = GeneralAddr::Unix(socket.peer_addr()?.into());
+        let (mut reader, writer) = tokio::io::split(socket);
+
+        let reader_callback = callback.clone();
+        group.spawn(async move {
+            let fetcher = async move || {
+                let size = reader.read_u16().await?;
+
+                let mut buffer = vec![0u8; size as usize];
+                reader.read_exact(&mut buffer).await?;
+
+                Ok((Bytes::from(buffer), other_side.clone()))
+            };
+
+            run_response_processing_loop(server, 5, reader_callback, fetcher).await;
+        });
+
+        Ok(Client {
+            callback,
+            channel: DnsChannel::Unix(writer),
+        })
+    }
+
+    pub async fn from_udp(socket: UdpSocket, group: &mut JoinSet<()>) -> Self {
+        let callback = Arc::new(RwLock::new(empty_callback as Callback));
+        let socket = Arc::new(socket);
+
+        let reader_callback = callback.clone();
+        let reader_socket = socket.clone();
+        let server_addr = socket.local_addr()
+            .ok()
+            .map(|x| x.to_string())
+            .unwrap_or_else(|| "<unknown>".into());
+        let server = format!("udp://{}", server_addr);
+
+        group.spawn(async move {
+            let fetcher = async move || {
+                let mut buffer = BytesMut::with_capacity(16384);
+
+                match reader_socket.recv_buf_from(&mut buffer).await {
+                    Err(x) => Err(x),
+                    Ok((size, from)) => {
+                        unsafe {
+                            buffer.set_len(size);
+                        };
+                        Ok((buffer.freeze(), from.into()))
+                    }
+                }
+            };
+
+            run_response_processing_loop(server, 5, reader_callback, fetcher).await;
+        });
+
+        Client {
+            callback,
+            channel: DnsChannel::Udp(socket),
+        }
+    }
+
+    pub async fn from_tcp(socket: TcpStream, group: &mut JoinSet<()>) -> std::io::Result<Self> {
+        let callback = Arc::new(RwLock::new(empty_callback as Callback));
+        let other_side = GeneralAddr::Network(socket.peer_addr()?);
+        let server_addr = socket.local_addr()
+            .ok()
+            .map(|x| x.to_string())
+            .unwrap_or_else(|| "<unknown>".into());
+        let server = format!("tcp://{}", server_addr);
+        let (mut reader, writer) = tokio::io::split(socket);
+
+        let reader_callback = callback.clone();
+        group.spawn(async move {
+            let fetcher = async move || {
+                let size = reader.read_u16().await?;
+
+                let mut buffer = vec![0u8; size as usize];
+                reader.read_exact(&mut buffer).await?;
+
+                Ok((Bytes::from(buffer), other_side.clone()))
+            };
+
+            run_response_processing_loop(server, 5, reader_callback, fetcher).await;
+        });
+
+        Ok(Client {
+            callback,
+            channel: DnsChannel::Tcp(writer),
+        })
+    }
+
+    /// Send a set of questions to the upstream server.
+    ///
+    /// Any response(s) that is/are sent will be handled as part of the callback
+    /// scheme. This function will thus only return an error if there's a problem
+    /// sending the question to the server.
+    pub async fn send_questions(_questions: Vec<Question>) -> error_stack::Result<(), SendError> {
+        Ok(())
+    }
+
+    /// Set the callback handler for when we receive responses from the server.
+    ///
+    /// This function may take awhile to execute, depending on how busy we are
+    /// taking responses, as it takes write ownership of a read-write lock that's
+    /// almost always written.
+    pub async fn set_callback(&self, callback: Callback) {
+        *self.callback.write().await = callback;
+    }
+}
diff --git a/src/network/resolver/protocol/header.rs b/src/network/resolver/protocol/header.rs
new file mode 100644
index 0000000..1ec5565
--- /dev/null
+++ b/src/network/resolver/protocol/header.rs
@@ -0,0 +1,225 @@
+use bytes::{Buf, BufMut};
+use error_stack::{report, ResultExt};
+use num_enum::{FromPrimitive, IntoPrimitive};
+use proptest::arbitrary::Arbitrary;
+use proptest::strategy::{BoxedStrategy, Just, Strategy};
+use std::fmt;
+use thiserror::Error;
+
+#[derive(Clone, Debug, PartialEq, proptest_derive::Arbitrary)]
+pub struct Header {
+    pub message_id: u16,
+    pub is_response: bool,
+    pub opcode: OpCode,
+    pub authoritative_answer: bool,
+    pub message_truncated: bool,
+    pub recursion_desired: bool,
+    pub recursion_available: bool,
+    pub response_code: ResponseCode,
+    pub question_count: u16,
+    pub answer_count: u16,
+    pub name_server_count: u16,
+    pub additional_record_count: u16,
+}
+
+#[derive(FromPrimitive, IntoPrimitive, PartialEq, PartialOrd, Eq, Ord, Debug, Copy, Clone)]
+#[repr(u8)]
+pub enum OpCode {
+    StandardQuery = 0,
+    InverseQuery = 1,
+    ServiceStatusRequest = 2,
+    #[num_enum(catch_all)]
+    Other(u8),
+}
+
+impl Arbitrary for OpCode {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_: Self::Parameters) -> Self::Strategy {
+        // while the type is 8 bits in rust, it's 4 bits in the protocol,
+        // and dealing with the run-off is messy. so this only generates
+        // valid-sized values here. it also biases toward the legit values.
+        // both things might want to be reconsidered in the future.
+        proptest::prop_oneof![
+            Just(OpCode::StandardQuery),
+            Just(OpCode::InverseQuery),
+            Just(OpCode::ServiceStatusRequest),
+            (3u8..=15).prop_map(OpCode::Other),
+        ]
+        .boxed()
+    }
+}
+
+#[derive(FromPrimitive, IntoPrimitive, PartialEq, PartialOrd, Eq, Ord, Debug, Copy, Clone)]
+#[repr(u8)]
+pub enum ResponseCode {
+    NoErrorConditions = 0,
+    FormatError = 1,
+    ServerFailure = 2,
+    NameError = 3,
+    NotImplemented = 4,
+    Refused = 5,
+    #[num_enum(catch_all)]
+    Other(u8),
+}
+
+impl fmt::Display for ResponseCode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            ResponseCode::NoErrorConditions => write!(f, "No errors"),
+            ResponseCode::FormatError => write!(f, "Illegal format"),
+            ResponseCode::ServerFailure => write!(f, "Server failure"),
+            ResponseCode::NameError => write!(f, "Name error"),
+            ResponseCode::NotImplemented => write!(f, "Not implemented"),
+            ResponseCode::Refused => write!(f, "Refused"),
+            ResponseCode::Other(x) => write!(f, "unknown error {x}"),
+        }
+    }
+}
+
+impl Arbitrary for ResponseCode {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_: Self::Parameters) -> Self::Strategy {
+        // while the type is 8 bits in rust, it's 4 bits in the protocol,
+        // and dealing with the run-off is messy. so this only generates
+        // valid-sized values here. it also biases toward the legit values.
+        // both things might want to be reconsidered in the future.
+        proptest::prop_oneof![
+            Just(ResponseCode::NoErrorConditions),
+            Just(ResponseCode::FormatError),
+            Just(ResponseCode::ServerFailure),
+            Just(ResponseCode::NameError),
+            Just(ResponseCode::NotImplemented),
+            Just(ResponseCode::Refused),
+            (6u8..=15).prop_map(ResponseCode::Other),
+        ]
+        .boxed()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum HeaderReadError {
+    #[error("Buffer not large enough to have a DNS message header in it.")]
+    BufferTooSmall,
+
+    #[error("Invalid data in zero-filled space.")]
+    NonZeroInZeroes,
+}
+
+#[derive(Debug, Error)]
+pub enum HeaderWriteError {
+    #[error("Buffer not large enough to write header.")]
+    BufferTooSmall,
+}
+
+impl Header {
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Self, HeaderReadError> {
+        if buffer.remaining() < 12
+        /* 6 16-bit fields = 6 * 2 = 1 */
+        {
+            return Err(report!(HeaderReadError::BufferTooSmall)).attach_printable_lazy(|| {
+                format!(
+                    "Need at least {} bytes, but only had {}",
+                    6 * 12,
+                    buffer.remaining()
+                )
+            });
+        }
+
+        let message_id = buffer.get_u16();
+        let flags = buffer.get_u16();
+        let question_count = buffer.get_u16();
+        let answer_count = buffer.get_u16();
+        let name_server_count = buffer.get_u16();
+        let additional_record_count = buffer.get_u16();
+
+        let is_response = (0x8000 & flags) != 0;
+        let opcode = OpCode::from(((flags >> 11) & 0xF) as u8);
+        let authoritative_answer = (0x0400 & flags) != 0;
+        let message_truncated = (0x0200 & flags) != 0;
+        let recursion_desired = (0x0100 & flags) != 0;
+        let recursion_available = (0x0080 & flags) != 0;
+        let zeroes = 0x0070 & flags;
+        let response_code = ResponseCode::from((flags & 0x000F) as u8);
+
+        if zeroes != 0 {
+            return Err(report!(HeaderReadError::NonZeroInZeroes))
+                .attach_printable_lazy(|| format!("Saw {:#x} instead.", zeroes >> 4));
+        }
+
+        Ok(Header {
+            message_id,
+            is_response,
+            opcode,
+            authoritative_answer,
+            message_truncated,
+            recursion_desired,
+            recursion_available,
+            response_code,
+            question_count,
+            answer_count,
+            name_server_count,
+            additional_record_count,
+        })
+    }
+
+    pub fn write<B: BufMut>(self, buffer: &mut B) -> error_stack::Result<(), HeaderWriteError> {
+        if buffer.remaining_mut() < 12
+        /* 6 16-bit fields = 6 * 2 = 1 */
+        {
+            return Err(report!(HeaderWriteError::BufferTooSmall)).attach_printable_lazy(|| {
+                format!(
+                    "Need at least {} to write DNS header, only have {}",
+                    6 * 12,
+                    buffer.remaining_mut()
+                )
+            });
+        }
+
+        let mut flags: u16 = 0;
+
+        if self.is_response {
+            flags |= 0x8000;
+        }
+        let opcode: u8 = self.opcode.into();
+        flags |= (opcode as u16) << 11;
+        if self.authoritative_answer {
+            flags |= 0x0400;
+        }
+        if self.message_truncated {
+            flags |= 0x0200;
+        }
+        if self.recursion_desired {
+            flags |= 0x0100;
+        }
+        if self.recursion_available {
+            flags |= 0x0080;
+        }
+        let response_code: u8 = self.response_code.into();
+        flags |= response_code as u16;
+
+        buffer.put_u16(self.message_id);
+        buffer.put_u16(flags);
+        buffer.put_u16(self.question_count);
+        buffer.put_u16(self.answer_count);
+        buffer.put_u16(self.name_server_count);
+        buffer.put_u16(self.additional_record_count);
+
+        Ok(())
+    }
+}
+
+proptest::proptest! {
+    #[test]
+    fn headers_roundtrip(header: Header) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(128 * 1024);
+        let safe_header = header.clone();
+        header.write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_header = Header::read(&mut read_buffer).expect("can read name");
+        assert_eq!(safe_header, new_header);
+    }
+}
diff --git a/src/network/resolver/protocol/question.rs b/src/network/resolver/protocol/question.rs
new file mode 100644
index 0000000..675b305
--- /dev/null
+++ b/src/network/resolver/protocol/question.rs
@@ -0,0 +1,91 @@
+use crate::network::resolver::name::Name;
+use crate::network::resolver::protocol::resource_record::raw::{RecordClass, RecordType};
+use bytes::{Buf, BufMut, TryGetError};
+use error_stack::{report, ResultExt};
+use std::fmt;
+use thiserror::Error;
+
+#[derive(Clone, Debug, PartialEq, proptest_derive::Arbitrary)]
+pub struct Question {
+    name: Name,
+    record_type: RecordType,
+    record_class: RecordClass,
+}
+
+impl fmt::Display for Question {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "<Q:{}@{}.{}>", self.name, self.record_type, self.record_class)
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum QuestionReadError {
+    #[error("Could not read name for question.")]
+    CouldNotReadName,
+
+    #[error("Could not read the record type for the question: {0}")]
+    CouldNotReadType(TryGetError),
+
+    #[error("Could not read the record class for the question.")]
+    CouldNotReadClass(TryGetError),
+}
+
+#[derive(Debug, Error)]
+pub enum QuestionWriteError {
+    #[error("Could not write name for the question.")]
+    CouldNotWriteName,
+
+    #[error("Buffer not large enough to write question type and class.")]
+    BufferTooSmall,
+}
+
+impl Question {
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Self, QuestionReadError> {
+        let name = Name::read(buffer).change_context(QuestionReadError::CouldNotReadName)?;
+        let record_type_u16 = buffer
+            .try_get_u16()
+            .map_err(|e| report!(QuestionReadError::CouldNotReadType(e)))
+            .attach_printable_lazy(|| format!("question was about '{name}'"))?;
+        let record_class_u16 = buffer
+            .try_get_u16()
+            .map_err(|e| report!(QuestionReadError::CouldNotReadClass(e)))
+            .attach_printable_lazy(|| format!("question was about '{name}'"))?;
+
+        let record_type = RecordType::from(record_type_u16);
+        let record_class = RecordClass::from(record_class_u16);
+
+        Ok(Question {
+            name,
+            record_type,
+            record_class,
+        })
+    }
+
+    pub fn write<B: BufMut>(&self, buffer: &mut B) -> error_stack::Result<(), QuestionWriteError> {
+        self.name
+            .write(buffer)
+            .change_context(QuestionWriteError::CouldNotWriteName)
+            .attach_printable_lazy(|| format!("Question was about '{}'", self.name))?;
+
+        if buffer.remaining_mut() < 4 {
+            return Err(report!(QuestionWriteError::BufferTooSmall))
+                .attach_printable_lazy(|| format!("Question was about '{}'", self.name));
+        }
+
+        buffer.put_u16(self.record_type.into());
+        buffer.put_u16(self.record_class.into());
+
+        Ok(())
+    }
+}
+
+proptest::proptest! {
+    #[test]
+    fn questions_roundtrip(question: Question) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(128 * 1024);
+        question.write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_question = Question::read(&mut read_buffer).expect("can read name");
+        assert_eq!(question, new_question);
+    }
+}
diff --git a/src/network/resolver/protocol/request.rs b/src/network/resolver/protocol/request.rs
new file mode 100644
index 0000000..bf848ae
--- /dev/null
+++ b/src/network/resolver/protocol/request.rs
@@ -0,0 +1,156 @@
+use bytes::{Buf, BufMut};
+use error_stack::{report, ResultExt};
+use crate::network::resolver::protocol::header::{Header, OpCode, ResponseCode};
+use crate::network::resolver::protocol::question::Question;
+use crate::network::resolver::protocol::resource_record::ResourceRecord;
+
+#[derive(Clone, Debug, PartialEq, proptest_derive::Arbitrary)]
+pub struct Request {
+    source_message_id: u16,
+    opcode: OpCode,
+    recursion_desired: bool,
+    questions: Vec<Question>,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum RequestReadError {
+    #[error("Error reading request header.")]
+    Header,
+    #[error("Message isn't a request.")]
+    NotRequest,
+    #[error("Illegal message.")]
+    IllegalMessage,
+    #[error("Error reading request question.")]
+    Question,
+    #[error("Error reading request answers (?!)")]
+    Answer,
+    #[error("Error reading requst name servers.")]
+    NameServers,
+    #[error("Reading request additional records.")]
+    AdditionalRecords,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum RequestWriteError {
+    #[error("Error writing request header.")]
+    Header,
+    #[error("Error writing request question.")]
+    Question,
+    #[error("Request had too many questions.")]
+    TooManyQuestions,
+}
+
+impl Request {
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Self, RequestReadError> {
+        let header = Header::read(buffer)
+            .change_context(RequestReadError::Header)?;
+
+        if header.is_response {
+            return Err(report!(RequestReadError::NotRequest))
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+
+        if header.authoritative_answer {
+            return Err(report!(RequestReadError::IllegalMessage))
+                .attach_printable("Request messages are not allowed to set the 'authoritative answer' bit.")
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+       
+        if header.response_code != ResponseCode::NoErrorConditions {
+            return Err(report!(RequestReadError::IllegalMessage))
+                .attach_printable("Request messages are not allowed to set the response code.")
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+
+        if header.answer_count != 0 {
+            return Err(report!(RequestReadError::IllegalMessage))
+                .attach_printable("Request messages are not allowed to include answers.")
+                .attach_printable_lazy(|| format!("{} answers declared", header.answer_count))
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+
+        if header.name_server_count != 0 {
+            return Err(report!(RequestReadError::IllegalMessage))
+                .attach_printable("Request messages are not allowed to include name servers.")
+                .attach_printable_lazy(|| format!("{} name servers declared", header.name_server_count))
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+
+        if header.additional_record_count != 0 {
+            return Err(report!(RequestReadError::IllegalMessage))
+                .attach_printable("Request messages are not allowed to include additional records.")
+                .attach_printable_lazy(|| format!("{} aditional records declared", header.additional_record_count))
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id));
+        }
+
+
+        let mut questions = vec![];
+
+        for i in 0..header.question_count {
+            let question = Question::read(buffer)
+                .change_context(RequestReadError::Question)
+                .attach_printable_lazy(|| format!("for question #{} of {}", i+1, header.question_count))
+                .attach_printable_lazy(|| format!("message id is {}", header.message_id))?;
+
+            questions.push(question);
+        }
+
+
+        Ok(Request {
+            source_message_id: header.message_id,
+            opcode: header.opcode,
+            recursion_desired: header.recursion_desired,
+            questions,
+        })
+    }
+
+    pub fn write<B: BufMut>(self, buffer: &mut B) -> error_stack::Result<(), RequestWriteError> {
+        let question_count = self.questions.len();
+
+        if question_count > (u16::MAX as usize) {
+            return Err(report!(RequestWriteError::TooManyQuestions))
+                .attach_printable(format!("message_id is {}", self.source_message_id));
+        }
+
+        let header = Header {
+            message_id: self.source_message_id,
+            is_response: false,
+            opcode: self.opcode,
+            authoritative_answer: false,
+            message_truncated: false,
+            recursion_desired: self.recursion_desired,
+            recursion_available: false,
+            response_code: ResponseCode::NoErrorConditions,
+            question_count: question_count as u16,
+            answer_count: 0,
+            name_server_count: 0,
+            additional_record_count: 0,
+        };
+
+        header.write(buffer)
+            .change_context(RequestWriteError::Header)
+            .attach_printable_lazy(|| format!("message ID is {}", self.source_message_id))?;
+
+        for (index, question) in self.questions.into_iter().enumerate() {
+            question.write(buffer)
+                .change_context(RequestWriteError::Question)
+                .attach_printable_lazy(|| format!("message ID is {}", self.source_message_id))
+                .attach_printable_lazy(|| format!("question #{} of {}", index+1, question_count))
+                .attach_printable_lazy(|| format!("{}", question))?;
+        }
+
+        Ok(())
+    }
+}
+
+proptest::proptest! {
+    #[test]
+    fn request_roundtrip(request: Request) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(128 * 1024);
+        let safe_request = request.clone();
+        request.write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_request = Request::read(&mut read_buffer).expect("can read name");
+        assert_eq!(safe_request, new_request);
+    }
+}
diff --git a/src/network/resolver/protocol/resource_record.rs b/src/network/resolver/protocol/resource_record.rs
new file mode 100644
index 0000000..6722c0b
--- /dev/null
+++ b/src/network/resolver/protocol/resource_record.rs
@@ -0,0 +1,1273 @@
+pub mod raw;
+
+use crate::network::resolver::name::Name;
+use crate::network::resolver::protocol::resource_record::raw::RawResourceRecord;
+use bytes::{Buf, BufMut, Bytes, BytesMut};
+use error_stack::{report, ResultExt};
+use proptest::arbitrary::Arbitrary;
+use proptest::strategy::{BoxedStrategy, Strategy};
+use std::net::{Ipv4Addr, Ipv6Addr};
+use std::time::Duration;
+use thiserror::Error;
+use url::Url;
+
+#[derive(Debug, Error)]
+pub enum BadRecordTypeTranslation {
+    #[error("Mismatched record types.")]
+    MismatchedTypes,
+
+    #[error("Unknown record class.")]
+    UnknownRecordClass,
+
+    #[error("Wrong size data section.")]
+    WrongSizeData,
+
+    #[error("Couldn't parse internal data.")]
+    InternalDataProblem,
+
+    #[error("Couldn't write recrod data.")]
+    CouldNotWriteData,
+
+    #[error("Unknown record type.")]
+    UnknownRecordType,
+
+    #[error("Unsupported record type.")]
+    UnsupportedRecordType,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum ResourceRecord {
+    A(A),
+    AAAA(AAAA),
+    HINFO(HINFO),
+    PTR(PTR),
+    NS(NS),
+    CNAME(CNAME),
+    SOA(SOA),
+    URI(URI),
+    NULL(NULL),
+    TXT(TXT),
+}
+
+impl Arbitrary for ResourceRecord {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        proptest::prop_oneof![
+            A::arbitrary().prop_map(ResourceRecord::A),
+            AAAA::arbitrary().prop_map(ResourceRecord::AAAA),
+            HINFO::arbitrary().prop_map(ResourceRecord::HINFO),
+            PTR::arbitrary().prop_map(ResourceRecord::PTR),
+            NS::arbitrary().prop_map(ResourceRecord::NS),
+            CNAME::arbitrary().prop_map(ResourceRecord::CNAME),
+            SOA::arbitrary().prop_map(ResourceRecord::SOA),
+            URI::arbitrary().prop_map(ResourceRecord::URI),
+            NULL::arbitrary().prop_map(ResourceRecord::NULL),
+            TXT::arbitrary().prop_map(ResourceRecord::TXT),
+        ]
+        .boxed()
+    }
+}
+
+impl TryFrom<ResourceRecord> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: ResourceRecord) -> Result<Self, Self::Error> {
+        match value {
+            ResourceRecord::A(x) => Ok(x.into()),
+            ResourceRecord::AAAA(x) => Ok(x.into()),
+            ResourceRecord::HINFO(x) => x.try_into(),
+            ResourceRecord::PTR(x) => x.try_into(),
+            ResourceRecord::NS(x) => x.try_into(),
+            ResourceRecord::CNAME(x) => x.try_into(),
+            ResourceRecord::SOA(x) => x.try_into(),
+            ResourceRecord::URI(x) => x.try_into(),
+            ResourceRecord::NULL(x) => x.try_into(),
+            ResourceRecord::TXT(x) => x.try_into(),
+        }
+    }
+}
+
+impl TryFrom<RawResourceRecord> for ResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: RawResourceRecord) -> Result<Self, Self::Error> {
+        match value.record_type {
+            raw::RecordType::A => Ok(ResourceRecord::A(A::try_from(value)?)),
+            raw::RecordType::AAAA => Ok(ResourceRecord::AAAA(AAAA::try_from(value)?)),
+            raw::RecordType::NS => Ok(ResourceRecord::NS(NS::try_from(value)?)),
+            raw::RecordType::MD => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MD types are not currently supported"),
+            raw::RecordType::MF => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MD types are not currently supported"),
+            raw::RecordType::CNAME => Ok(ResourceRecord::CNAME(CNAME::try_from(value)?)),
+            raw::RecordType::SOA => Ok(ResourceRecord::SOA(SOA::try_from(value)?)),
+            raw::RecordType::MB => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MB types are not currently supported"),
+            raw::RecordType::MG => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MG types are not currently supported"),
+            raw::RecordType::MR => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MR types are not currently supported"),
+            raw::RecordType::NULL => Ok(ResourceRecord::NULL(NULL::try_from(value)?)),
+            raw::RecordType::WKS => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MINFO types are not currently supported"),
+            raw::RecordType::PTR => Ok(ResourceRecord::PTR(PTR::try_from(value)?)),
+            raw::RecordType::HINFO => Ok(ResourceRecord::HINFO(HINFO::try_from(value)?)),
+            raw::RecordType::MINFO => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MINFO types are not currently supported"),
+            raw::RecordType::MX => Err(report!(BadRecordTypeTranslation::UnsupportedRecordType))
+                .attach_printable("DNS MX types are not currently supported"),
+            raw::RecordType::TXT => Ok(ResourceRecord::TXT(TXT::try_from(value)?)),
+            raw::RecordType::URI => Ok(ResourceRecord::URI(URI::try_from(value)?)),
+            raw::RecordType::Other(unknown) => {
+                Err(report!(BadRecordTypeTranslation::UnknownRecordType))
+                    .attach_printable_lazy(|| format!("Unknown record type value {unknown}"))
+            }
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ReadError {
+    #[error("Failed to read raw resource record data from input stream.")]
+    BufferReadError,
+    #[error("Failed to understand the record pulled from the input stream.")]
+    DontUnderstand,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum WriteError {
+    #[error("Failed to write raw resource record data into the output stream.")]
+    BufferWriteError,
+    #[error("Failed to understand the record we're trying to write to the output stream.")]
+    DontUnderstand,
+}
+
+impl ResourceRecord {
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<ResourceRecord, ReadError> {
+        let base = RawResourceRecord::read(buffer)
+            .change_context(ReadError::BufferReadError)?;
+
+        let result = ResourceRecord::try_from(base)
+            .change_context(ReadError::DontUnderstand)?;
+
+        Ok(result)
+    }
+
+    pub fn write<B: BufMut>(self, buffer: &mut B) -> error_stack::Result<(), WriteError> {
+        let base = RawResourceRecord::try_from(self)
+            .change_context(WriteError::DontUnderstand)?;
+
+        base.write(buffer).change_context(WriteError::BufferWriteError)
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// DNS A records, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct A {
+    name: Name,
+    ttl: Duration,
+    address: Ipv4Addr,
+}
+
+impl From<A> for RawResourceRecord {
+    fn from(value: A) -> Self {
+        let data = Bytes::from(value.address.octets().to_vec());
+
+        RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::A,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data,
+        }
+    }
+}
+
+impl Arbitrary for A {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (Name::arbitrary(), u32::arbitrary(), Ipv4Addr::arbitrary())
+            .prop_map(|(name, ttl_secs, address)| A {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                address,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for A {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::A {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an A record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        if value.data.len() != 4 {
+            return Err(report!(BadRecordTypeTranslation::WrongSizeData))
+                .attach_printable("Expecting 4 bytes, the length of an IPv4 address")
+                .attach_printable_lazy(|| format!("Found {} bytes", value.data.len()));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+
+        let Some(&[a, b, c, d]) = value.data.get(0..4) else {
+            panic!("INTERNAL ERROR: Checked that the length was 4, but getting 4 bytes errors?");
+        };
+
+        let address = Ipv4Addr::new(a, b, c, d);
+
+        Ok(A {
+            name: value.name,
+            ttl,
+            address,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// DNS AAAA records, from RFC 3596
+#[derive(Clone, Debug, PartialEq)]
+pub struct AAAA {
+    name: Name,
+    ttl: Duration,
+    address: Ipv6Addr,
+}
+
+impl From<AAAA> for RawResourceRecord {
+    fn from(value: AAAA) -> Self {
+        let data = Bytes::from(value.address.octets().to_vec());
+
+        RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::AAAA,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data,
+        }
+    }
+}
+
+impl Arbitrary for AAAA {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (Name::arbitrary(), u32::arbitrary(), Ipv6Addr::arbitrary())
+            .prop_map(|(name, ttl_secs, address)| AAAA {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                address,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for AAAA {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::AAAA {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an AAAA record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        if value.data.len() != 16 {
+            return Err(report!(BadRecordTypeTranslation::WrongSizeData))
+                .attach_printable("Expecting 16 bytes, the length of an IPv6 address")
+                .attach_printable_lazy(|| format!("Found {} bytes", value.data.len()));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+
+        let a = value.data.get_u16();
+        let b = value.data.get_u16();
+        let c = value.data.get_u16();
+        let d = value.data.get_u16();
+        let e = value.data.get_u16();
+        let f = value.data.get_u16();
+        let g = value.data.get_u16();
+        let h = value.data.get_u16();
+        let address = Ipv6Addr::new(a, b, c, d, e, f, g, h);
+
+        Ok(AAAA {
+            name: value.name,
+            ttl,
+            address,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A DNS CNAME record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct CNAME {
+    name: Name,
+    ttl: Duration,
+    hostname: Name,
+}
+
+impl TryFrom<CNAME> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: CNAME) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+        value
+            .hostname
+            .write(&mut buffer)
+            .change_context(BadRecordTypeTranslation::CouldNotWriteData)?;
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::CNAME,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for CNAME {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (Name::arbitrary(), u32::arbitrary(), Name::arbitrary())
+            .prop_map(|(name, ttl_secs, hostname)| CNAME {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                hostname,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for CNAME {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::CNAME {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an CNAME record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let hostname = Name::read(&mut value.data)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read name out of CNAME record")?;
+
+        Ok(CNAME {
+            name: value.name,
+            ttl,
+            hostname,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A DNS HINFO record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct HINFO {
+    name: Name,
+    ttl: Duration,
+    cpu: String,
+    os: String,
+}
+
+impl TryFrom<HINFO> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: HINFO) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+
+        let cpu_bytes = value.cpu.as_bytes();
+        let os_bytes = value.os.as_bytes();
+        let required_size = cpu_bytes.len() + os_bytes.len() + 2;
+
+        if buffer.remaining_mut() < required_size {
+            let remaining = buffer.remaining_mut();
+
+            return Err(report!(BadRecordTypeTranslation::CouldNotWriteData))
+                .attach_printable_lazy(|| {
+                    format!("needed to be able to write {required_size} bytes, but couldn't.")
+                })
+                .attach_printable_lazy(|| {
+                    format!("only {remaining} bytes available to write HINFO data")
+                });
+        }
+
+        buffer.put_slice(cpu_bytes);
+        buffer.put_u8(0);
+        buffer.put_slice(os_bytes);
+        buffer.put_u8(0);
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::HINFO,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for HINFO {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        let cpuval = proptest::string::string_regex("[A-Za-z0-9-]{0,64}")
+            .expect("Can generate string generator");
+        let osval = proptest::string::string_regex("[A-Za-z0-9-]{0,64}")
+            .expect("Can generate string generator");
+
+        (Name::arbitrary(), u32::arbitrary(), cpuval, osval)
+            .prop_map(|(name, ttl_secs, cpu, os)| HINFO {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                cpu,
+                os,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for HINFO {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::HINFO {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an HINFO record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let cpu = read_out_string("cpu", &mut value.data)
+            .attach_printable_lazy(|| format!("for HINFO record"))?;
+        let os = read_out_string("os", &mut value.data)
+            .attach_printable_lazy(|| format!("for HINFO record"))?;
+
+        Ok(HINFO {
+            name: value.name,
+            ttl,
+            cpu,
+            os,
+        })
+    }
+}
+
+fn read_out_string<B: Buf>(
+    field: &str,
+    buffer: &mut B,
+) -> error_stack::Result<String, BadRecordTypeTranslation> {
+    let mut outbytes = Vec::new();
+
+    loop {
+        let byte = buffer
+            .try_get_u8()
+            .map_err(|err| report!(err))
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable_lazy(|| format!("Ran out of bytes reading {field}"))?;
+
+        if byte == 0 {
+            break;
+        }
+
+        outbytes.push(byte);
+    }
+
+    String::from_utf8(outbytes)
+        .map_err(|e| report!(e))
+        .change_context(BadRecordTypeTranslation::InternalDataProblem)
+        .attach_printable_lazy(|| format!("failed to turn bytes into a string for field {field}"))
+}
+
+// --------------------------------------------------------------------------
+
+/// A DNS NS (name server) record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct NS {
+    name: Name,
+    ttl: Duration,
+    hostname: Name,
+}
+
+impl TryFrom<NS> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: NS) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+        value
+            .hostname
+            .write(&mut buffer)
+            .change_context(BadRecordTypeTranslation::CouldNotWriteData)?;
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::NS,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for NS {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (Name::arbitrary(), u32::arbitrary(), Name::arbitrary())
+            .prop_map(|(name, ttl_secs, hostname)| NS {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                hostname,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for NS {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::NS {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an NS record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let hostname = Name::read(&mut value.data)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read name out of NS record")?;
+
+        Ok(NS {
+            name: value.name,
+            ttl,
+            hostname,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A DNS NULL record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct NULL {
+    name: Name,
+    ttl: Duration,
+    data: Bytes,
+}
+
+impl TryFrom<NULL> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: NULL) -> Result<Self, Self::Error> {
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::NULL,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: value.data,
+        })
+    }
+}
+
+impl Arbitrary for NULL {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (
+            Name::arbitrary(),
+            u32::arbitrary(),
+            proptest::collection::vec(u8::arbitrary(), 0..65535),
+        )
+            .prop_map(|(name, ttl_secs, data_vec)| NULL {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                data: data_vec.into(),
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for NULL {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::NULL {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an NULL record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+
+        Ok(NULL {
+            name: value.name,
+            ttl,
+            data: value.data,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A DPTR PTR record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct PTR {
+    name: Name,
+    ttl: Duration,
+    domain: Name,
+}
+
+impl TryFrom<PTR> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: PTR) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+        value
+            .domain
+            .write(&mut buffer)
+            .change_context(BadRecordTypeTranslation::CouldNotWriteData)?;
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::PTR,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for PTR {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (Name::arbitrary(), u32::arbitrary(), Name::arbitrary())
+            .prop_map(|(name, ttl_secs, domain)| PTR {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                domain,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for PTR {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::PTR {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an PTR record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let domain = Name::read(&mut value.data)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read name out of PTR record")?;
+
+        Ok(PTR {
+            name: value.name,
+            ttl,
+            domain,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A SOA (Source Of Authority?) record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct SOA {
+    name: Name,
+    ttl: Duration,
+    data_source: Name,
+    responsible_party: Name,
+    serial: u32,
+    refresh: u32,
+    retry: u32,
+    expire: u32,
+    minimum_ttl: u32,
+}
+
+impl TryFrom<SOA> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: SOA) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+
+        value
+            .data_source
+            .write(&mut buffer)
+            .change_context(BadRecordTypeTranslation::CouldNotWriteData)
+            .attach_printable("writing data source field of SOA entry")
+            .attach_printable_lazy(|| format!("field value is '{}'", value.data_source))?;
+        value
+            .responsible_party
+            .write(&mut buffer)
+            .change_context(BadRecordTypeTranslation::CouldNotWriteData)
+            .attach_printable("writing responsible party field of SOA entry")
+            .attach_printable_lazy(|| format!("field value is '{}'", value.responsible_party))?;
+
+        if buffer.remaining_mut() < (5 * 4) {
+            let remaining = buffer.remaining_mut();
+            let message = || {
+                if remaining < (1 * 4) {
+                    format!("Could not write serial number.")
+                } else if remaining < (2 * 4) {
+                    format!("Could not write refresh rate.")
+                } else if remaining < (3 * 4) {
+                    format!("Could not write retry interval.")
+                } else if remaining < (4 * 4) {
+                    format!("Could not write expiry time.")
+                } else {
+                    format!("Could not write minimum TTL.")
+                }
+            };
+
+            return Err(report!(BadRecordTypeTranslation::CouldNotWriteData))
+                .attach_printable_lazy(message)
+                .attach_printable("writing SOA record data");
+        }
+
+        buffer.put_u32(value.serial);
+        buffer.put_u32(value.refresh);
+        buffer.put_u32(value.retry);
+        buffer.put_u32(value.expire);
+        buffer.put_u32(value.minimum_ttl);
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::SOA,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for SOA {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (
+            Name::arbitrary(),
+            u32::arbitrary(),
+            Name::arbitrary(),
+            Name::arbitrary(),
+            u32::arbitrary(),
+            u32::arbitrary(),
+            u32::arbitrary(),
+            u32::arbitrary(),
+            u32::arbitrary(),
+        )
+            .prop_map(
+                |(
+                    name,
+                    ttl_secs,
+                    data_source,
+                    responsible_party,
+                    serial,
+                    refresh,
+                    retry,
+                    expire,
+                    minimum_ttl,
+                )| SOA {
+                    name,
+                    ttl: Duration::from_secs(ttl_secs as u64),
+                    data_source,
+                    responsible_party,
+                    serial,
+                    refresh,
+                    retry,
+                    expire,
+                    minimum_ttl,
+                },
+            )
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for SOA {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::SOA {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an SOA record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let data_source = Name::read(&mut value.data)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read data source out of SOA record")?;
+        let responsible_party = Name::read(&mut value.data)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read responsible party out of SOA record")?;
+
+        let serial = value
+            .data
+            .try_get_u32()
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read serial number out of SOA record")?;
+        let refresh = value
+            .data
+            .try_get_u32()
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read refresh rate out of SOA record")?;
+        let retry = value
+            .data
+            .try_get_u32()
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read retry interval out of SOA record")?;
+        let expire = value
+            .data
+            .try_get_u32()
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read expire time out of SOA record")?;
+        let minimum_ttl = value
+            .data
+            .try_get_u32()
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Couldn't read minimum ttl out of SOA record")?;
+
+        Ok(SOA {
+            name: value.name,
+            ttl,
+            data_source,
+            responsible_party,
+            serial,
+            refresh,
+            retry,
+            expire,
+            minimum_ttl,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A TXT record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct TXT {
+    name: Name,
+    ttl: Duration,
+    data: Vec<String>,
+}
+
+impl TryFrom<TXT> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: TXT) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+
+        for string in value.data.into_iter() {
+            let bytes = string.as_bytes();
+            let required = bytes.len() + 1;
+            let available = buffer.remaining_mut();
+
+            if available < required {
+                return Err(report!(BadRecordTypeTranslation::CouldNotWriteData))
+                    .attach_printable_lazy(|| format!("writing string '{string}'"))
+                    .attach_printable_lazy(|| {
+                        format!("needed to write {required} bytes, only could write {available}")
+                    });
+            }
+
+            buffer.put_slice(bytes);
+            buffer.put_u8(0);
+        }
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::TXT,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for TXT {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        let arb_string = proptest::string::string_regex("[A-Za-z0-9:space:]{0,512}")
+            .expect("can generate string generator");
+        let strings = proptest::collection::vec(arb_string, 0..128);
+
+        (Name::arbitrary(), u32::arbitrary(), strings)
+            .prop_map(|(name, ttl_secs, data)| TXT {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                data,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for TXT {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::TXT {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an TXT record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let mut data = Vec::new();
+
+        while value.data.has_remaining() {
+            let next = read_out_string("TXT record item", &mut value.data)?;
+
+            data.push(next);
+        }
+
+        Ok(TXT {
+            name: value.name,
+            ttl,
+            data,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+/// A URI record, from RFC 1035
+#[derive(Clone, Debug, PartialEq)]
+pub struct URI {
+    name: Name,
+    ttl: Duration,
+    priority: u16,
+    weight: u16,
+    uri: Url,
+}
+
+impl TryFrom<URI> for RawResourceRecord {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(value: URI) -> Result<Self, Self::Error> {
+        let mut buffer = BytesMut::new();
+
+        if buffer.remaining_mut() < 4 {
+            return Err(report!(BadRecordTypeTranslation::CouldNotWriteData))
+                .attach_printable("Not enough space to write priority and weight")
+                .attach_printable_lazy(|| format!("Writing URI record with {}", value.uri));
+        }
+        buffer.put_u16(value.priority);
+        buffer.put_u16(value.weight);
+
+        let uri_str = value.uri.to_string();
+        if buffer.remaining_mut() < (uri_str.as_bytes().len() + 1) {
+            return Err(report!(BadRecordTypeTranslation::CouldNotWriteData))
+                .attach_printable("Not enough space to write URI")
+                .attach_printable_lazy(|| format!("Writing URI record with {}", value.uri));
+        }
+        buffer.put_slice(uri_str.as_bytes());
+        buffer.put_u8(0);
+
+        Ok(RawResourceRecord {
+            name: value.name.clone(),
+            record_type: raw::RecordType::URI,
+            record_class: raw::RecordClass::IN,
+            ttl: value.ttl.as_secs().try_into().unwrap_or(u32::MAX),
+            data: buffer.freeze(),
+        })
+    }
+}
+
+impl Arbitrary for URI {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        let scheme = proptest::string::string_regex("[A-Za-z]{1,10}").unwrap();
+        let domain = Name::arbitrary();
+        let user = proptest::option::of(proptest::string::string_regex("[A-Za-z]{1,30}").unwrap());
+        let password =
+            proptest::option::of(proptest::string::string_regex(":[A-Za-z]{1,30}").unwrap());
+        let path =
+            proptest::option::of(proptest::string::string_regex("/[A-Za-z/]{1,30}").unwrap());
+        let uri_strategy = (scheme, domain, user, password, path).prop_map(
+            |(scheme, domain, user, password, path)| {
+                let userpass_prefix = match (user, password) {
+                    (None, None) => String::new(),
+                    (Some(u), None) => format!("{u}@"),
+                    (None, Some(p)) => format!(":{p}@"),
+                    (Some(u), Some(p)) => format!("{u}:{p}@"),
+                };
+                let path = path.unwrap_or_default();
+                let uri_str = format!("{scheme}://{userpass_prefix}{domain}{path}");
+                Url::parse(&uri_str).unwrap()
+            },
+        );
+
+        (
+            Name::arbitrary(),
+            u32::arbitrary(),
+            u16::arbitrary(),
+            u16::arbitrary(),
+            uri_strategy,
+        )
+            .prop_map(|(name, ttl_secs, priority, weight, uri)| URI {
+                name,
+                ttl: Duration::from_secs(ttl_secs as u64),
+                priority,
+                weight,
+                uri,
+            })
+            .boxed()
+    }
+}
+
+impl TryFrom<RawResourceRecord> for URI {
+    type Error = error_stack::Report<BadRecordTypeTranslation>;
+
+    fn try_from(mut value: RawResourceRecord) -> Result<Self, Self::Error> {
+        if value.record_type != raw::RecordType::URI {
+            return Err(report!(BadRecordTypeTranslation::MismatchedTypes)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Tried to create an URI record from a {} record",
+                        value.record_type
+                    )
+                },
+            );
+        }
+
+        if value.record_class != raw::RecordClass::IN {
+            return Err(report!(BadRecordTypeTranslation::UnknownRecordClass))
+                .attach_printable("Don't know how to deal with non-Internet records")
+                .attach_printable_lazy(|| format!("Found record type {}", value.record_class));
+        }
+
+        let ttl = Duration::from_secs(value.ttl as u64);
+        let priority = value
+            .data
+            .try_get_u16()
+            .change_context(BadRecordTypeTranslation::WrongSizeData)
+            .attach_printable("Could not read priority from URI record")?;
+        let weight = value
+            .data
+            .try_get_u16()
+            .change_context(BadRecordTypeTranslation::WrongSizeData)
+            .attach_printable("Could not read weight from URI record")?;
+
+        let uri_str = String::from_utf8(value.data.to_vec())
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable("Reading URI field from URI record.")?;
+        let uri = Url::parse(&uri_str)
+            .change_context(BadRecordTypeTranslation::InternalDataProblem)
+            .attach_printable_lazy(|| {
+                format!("Trying to interpret '{uri_str}' as a URI in a URI record")
+            })?;
+
+        Ok(URI {
+            name: value.name,
+            ttl,
+            priority,
+            weight,
+            uri,
+        })
+    }
+}
+
+// --------------------------------------------------------------------------
+
+proptest::proptest! {
+    #[test]
+    fn a_roundtrip(a: A) {
+        let raw = RawResourceRecord::from(a.clone());
+        let back = A::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(a, back);
+    }
+
+    #[test]
+    fn aaaa_roundtrip(aaaa: AAAA) {
+        let raw = RawResourceRecord::from(aaaa.clone());
+        let back = AAAA::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(aaaa, back);
+    }
+
+    #[test]
+    fn cname_roundtrip(cname: CNAME) {
+        let raw = RawResourceRecord::try_from(cname.clone()).expect("can write record");
+        let back = CNAME::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(cname, back);
+    }
+
+    #[test]
+    fn hinfo_roundtrip(hinfo: HINFO) {
+        let raw = RawResourceRecord::try_from(hinfo.clone()).expect("can write record");
+        let back = HINFO::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(hinfo, back);
+    }
+
+    #[test]
+    fn ns_roundtrip(ns: NS) {
+        let raw = RawResourceRecord::try_from(ns.clone()).expect("can write record");
+        let back = NS::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(ns, back);
+    }
+
+    #[test]
+    fn null_roundtrip(null: NULL) {
+        let raw = RawResourceRecord::try_from(null.clone()).expect("can write record");
+        let back = NULL::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(null, back);
+    }
+
+    #[test]
+    fn ptr_roundtrip(ptr: PTR) {
+        let raw = RawResourceRecord::try_from(ptr.clone()).expect("can write record");
+        let back = PTR::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(ptr, back);
+    }
+
+    #[test]
+    fn soa_roundtrip(soa: SOA) {
+        let raw = RawResourceRecord::try_from(soa.clone()).expect("can write record");
+        let back = SOA::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(soa, back);
+    }
+
+    #[test]
+    fn txt_roundtrip(text: TXT) {
+        let raw = RawResourceRecord::try_from(text.clone()).expect("can write record");
+        let back = TXT::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(text, back);
+    }
+
+    #[test]
+    fn uri_roundtrip(uri: URI) {
+        let raw = RawResourceRecord::try_from(uri.clone()).expect("can write record");
+        let back = URI::try_from(raw).expect("can reparse record");
+        proptest::prop_assert_eq!(uri, back);
+    }
+}
diff --git a/src/network/resolver/protocol/resource_record/raw.rs b/src/network/resolver/protocol/resource_record/raw.rs
new file mode 100644
index 0000000..56fdaa1
--- /dev/null
+++ b/src/network/resolver/protocol/resource_record/raw.rs
@@ -0,0 +1,304 @@
+use crate::network::resolver::name::Name;
+use bytes::{Buf, BufMut, Bytes};
+use error_stack::{report, ResultExt};
+use num_enum::{FromPrimitive, IntoPrimitive};
+use proptest::arbitrary::Arbitrary;
+use proptest::strategy::{BoxedStrategy, Just, Strategy};
+use std::fmt;
+use thiserror::Error;
+
+#[derive(Debug, PartialEq)]
+pub struct RawResourceRecord {
+    pub name: Name,
+    pub record_type: RecordType,
+    pub record_class: RecordClass,
+    pub ttl: u32,
+    pub data: Bytes,
+}
+
+impl Arbitrary for RawResourceRecord {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        (
+            Name::arbitrary(),
+            RecordType::arbitrary(),
+            RecordClass::arbitrary(),
+            u32::arbitrary(),
+            proptest::collection::vec(u8::arbitrary(), 0..65535),
+        )
+            .prop_map(
+                |(name, record_type, record_class, ttl, data)| RawResourceRecord {
+                    name,
+                    record_type,
+                    record_class,
+                    ttl,
+                    data: data.into(),
+                },
+            )
+            .boxed()
+    }
+}
+
+#[derive(FromPrimitive, IntoPrimitive, PartialEq, PartialOrd, Eq, Ord, Debug, Copy, Clone)]
+#[repr(u16)]
+pub enum RecordType {
+    A = 1,
+    AAAA = 28,
+    NS = 2,
+    MD = 3,
+    MF = 4,
+    CNAME = 5,
+    SOA = 6,
+    MB = 7,
+    MG = 8,
+    MR = 9,
+    NULL = 10,
+    WKS = 11,
+    PTR = 12,
+    HINFO = 13,
+    MINFO = 14,
+    MX = 15,
+    TXT = 16,
+    URI = 256,
+    #[num_enum(catch_all)]
+    Other(u16),
+}
+
+impl fmt::Display for RecordType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            RecordType::A => write!(f, "A"),
+            RecordType::AAAA => write!(f, "AAAA"),
+            RecordType::NS => write!(f, "NS"),
+            RecordType::MD => write!(f, "MD"),
+            RecordType::MF => write!(f, "MF"),
+            RecordType::CNAME => write!(f, "CNAME"),
+            RecordType::SOA => write!(f, "SOA"),
+            RecordType::MB => write!(f, "MB"),
+            RecordType::MG => write!(f, "MG"),
+            RecordType::MR => write!(f, "MR"),
+            RecordType::NULL => write!(f, "NULL"),
+            RecordType::WKS => write!(f, "WKS"),
+            RecordType::PTR => write!(f, "PTR"),
+            RecordType::HINFO => write!(f, "HINFO"),
+            RecordType::MINFO => write!(f, "MINFO"),
+            RecordType::MX => write!(f, "MX"),
+            RecordType::TXT => write!(f, "TXT"),
+            RecordType::URI => write!(f, "URI"),
+            RecordType::Other(x) => write!(f, "UNKNOWN<{x}>"),
+        }
+    }
+}
+
+impl Arbitrary for RecordType {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        // this is intentionally biased towards the legit values
+        proptest::prop_oneof![
+            Just(RecordType::A),
+            Just(RecordType::AAAA),
+            Just(RecordType::NS),
+            Just(RecordType::MD),
+            Just(RecordType::MF),
+            Just(RecordType::CNAME),
+            Just(RecordType::SOA),
+            Just(RecordType::MB),
+            Just(RecordType::MG),
+            Just(RecordType::MR),
+            Just(RecordType::NULL),
+            Just(RecordType::WKS),
+            Just(RecordType::PTR),
+            Just(RecordType::HINFO),
+            Just(RecordType::MINFO),
+            Just(RecordType::MX),
+            Just(RecordType::TXT),
+            proptest::prop_oneof![
+                (17u16..28).prop_map(|x| RecordType::Other(x)),
+                (29u16..256).prop_map(|x| RecordType::Other(x)),
+                (257u16..=65535).prop_map(|x| RecordType::Other(x)),
+                Just(RecordType::Other(0)),
+            ],
+        ]
+        .boxed()
+    }
+}
+
+#[derive(FromPrimitive, IntoPrimitive, PartialEq, PartialOrd, Eq, Ord, Debug, Copy, Clone)]
+#[repr(u16)]
+pub enum RecordClass {
+    IN = 1,
+    CS = 2,
+    CH = 3,
+    HS = 4,
+    #[num_enum(catch_all)]
+    Other(u16),
+}
+
+impl fmt::Display for RecordClass {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            RecordClass::IN => write!(f, "IN"),
+            RecordClass::CS => write!(f, "CS"),
+            RecordClass::CH => write!(f, "CH"),
+            RecordClass::HS => write!(f, "HS"),
+            RecordClass::Other(x) => write!(f, "UNKNOWN<{x}>"),
+        }
+    }
+}
+
+impl Arbitrary for RecordClass {
+    type Parameters = ();
+    type Strategy = BoxedStrategy<Self>;
+
+    fn arbitrary_with(_args: Self::Parameters) -> Self::Strategy {
+        // this is intentionally biased towards the legit values
+        proptest::prop_oneof![
+            Just(RecordClass::IN),
+            Just(RecordClass::CS),
+            Just(RecordClass::CH),
+            Just(RecordClass::HS),
+            (5u16..=65535).prop_map(|x| RecordClass::Other(x)),
+            Just(RecordClass::Other(0)),
+        ]
+        .boxed()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ResourceRecordReadError {
+    #[error("Failed to read initial record name.")]
+    InitialRecord,
+
+    #[error("Resource record truncated; couldn't find its type field.")]
+    NoTypeField,
+
+    #[error("Resource record truncated; couldn't find its class field.")]
+    NoClassField,
+
+    #[error("Resource record truncated; couldn't find its TTL field.")]
+    NoTtl,
+
+    #[error("Resource record truncated; couldn't find its data length.")]
+    NoDataLength,
+
+    #[error("Resource record truncated; couldn't read its entire data field.")]
+    DataTruncated,
+}
+
+#[derive(Debug, Error)]
+pub enum ResourceRecordWriteError {
+    #[error("Could not write name to the output record.")]
+    CouldNotWriteName,
+
+    #[error("Could not write resource record type and class to output record.")]
+    CouldNotWriteTypeClass,
+
+    #[error("Could not write TTL to output record.")]
+    CountNotWriteTtl,
+
+    #[error("Could not write resource record data length to output record.")]
+    CountNotWriteDataLength,
+
+    #[error("Could not write resource record data to output record.")]
+    CountNotWriteData,
+
+    #[error("Input data was too large to write to output stream.")]
+    InputDataTooLarge,
+}
+
+impl RawResourceRecord {
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Self, ResourceRecordReadError> {
+        let name = Name::read(buffer).change_context(ResourceRecordReadError::InitialRecord)?;
+
+        let record_type = buffer
+            .try_get_u16()
+            .map_err(|_| report!(ResourceRecordReadError::NoTypeField))?
+            .into();
+        let record_class = buffer
+            .try_get_u16()
+            .map_err(|_| report!(ResourceRecordReadError::NoClassField))?
+            .into();
+        let ttl = buffer
+            .try_get_u32()
+            .map_err(|_| report!(ResourceRecordReadError::NoTtl))?;
+        let rdata_length = buffer
+            .try_get_u16()
+            .map_err(|_| report!(ResourceRecordReadError::NoDataLength))?;
+
+        if buffer.remaining() < (rdata_length as usize) {
+            return Err(report!(ResourceRecordReadError::DataTruncated)).attach_printable_lazy(
+                || {
+                    format!(
+                        "Expected {rdata_length} bytes, but only saw {}",
+                        buffer.remaining()
+                    )
+                },
+            );
+        }
+        let data = buffer.copy_to_bytes(rdata_length as usize);
+
+        Ok(RawResourceRecord {
+            name,
+            record_type,
+            record_class,
+            ttl,
+            data,
+        })
+    }
+
+    pub fn write<B: BufMut>(
+        &self,
+        buffer: &mut B,
+    ) -> error_stack::Result<(), ResourceRecordWriteError> {
+        self.name
+            .write(buffer)
+            .change_context(ResourceRecordWriteError::CouldNotWriteName)?;
+
+        if buffer.remaining_mut() < 4 {
+            return Err(report!(ResourceRecordWriteError::CouldNotWriteTypeClass));
+        }
+        buffer.put_u16(self.record_type.into());
+        buffer.put_u16(self.record_class.into());
+
+        if buffer.remaining_mut() < 4 {
+            return Err(report!(ResourceRecordWriteError::CountNotWriteTtl));
+        }
+        buffer.put_u32(self.ttl);
+
+        if buffer.remaining_mut() < 2 {
+            return Err(report!(ResourceRecordWriteError::CountNotWriteDataLength));
+        }
+        if self.data.len() > (u16::MAX as usize) {
+            return Err(report!(ResourceRecordWriteError::InputDataTooLarge))
+                .attach_printable_lazy(|| {
+                    format!(
+                        "Incoming data was {} bytes, needs to be < 2^16",
+                        self.data.len()
+                    )
+                });
+        }
+        buffer.put_u16(self.data.len() as u16);
+
+        if buffer.remaining_mut() < self.data.len() {
+            return Err(report!(ResourceRecordWriteError::CountNotWriteData));
+        }
+        buffer.put_slice(&self.data);
+
+        Ok(())
+    }
+}
+
+proptest::proptest! {
+    #[test]
+    fn any_random_record_roundtrips(record: RawResourceRecord) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(128 * 1024);
+        record.write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_record = RawResourceRecord::read(&mut read_buffer).expect("can read name");
+        assert_eq!(record, new_record);
+    }
+}
diff --git a/src/network/resolver/protocol/response.rs b/src/network/resolver/protocol/response.rs
new file mode 100644
index 0000000..e584344
--- /dev/null
+++ b/src/network/resolver/protocol/response.rs
@@ -0,0 +1,258 @@
+use bytes::{Buf, BufMut};
+use error_stack::ResultExt;
+use crate::network::resolver::protocol::header::{Header, ResponseCode};
+use crate::network::resolver::protocol::question::Question;
+use crate::network::resolver::protocol::resource_record::ResourceRecord;
+
+#[derive(Clone, Debug, PartialEq, proptest_derive::Arbitrary)]
+pub enum Response {
+    Valid {
+        source_message_id: u16,
+        authoritative: bool,
+        truncated: bool,
+        answers: Vec<ResourceRecord>,
+        name_servers: Vec<ResourceRecord>,
+        additional_records: Vec<ResourceRecord>,
+    },
+    FormatError {
+        source_message_id: u16,
+    },
+    ServerFailure {
+        source_message_id: u16,
+    },
+    NameError {
+        source_message_id: u16,
+    },
+    NotImplemented {
+        source_message_id: u16,
+    },
+    Refused {
+        source_message_id: u16,
+    },
+    UnknownError {
+        #[proptest(strategy="6u8..=15")]
+        error_code: u8,
+        source_message_id: u16,
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ResponseReadError {
+    #[error("Could not read response header.")]
+    HeaderReadError,
+    #[error("Could not read question included in response.")]
+    QuestionReadError,
+    #[error("Could not read resource record included as an answer.")]
+    AnswerReadError,
+    #[error("Could not read name server record included in response.")]
+    NameServerReadError,
+    #[error("Could not read supplemental record included in response.")]
+    AdditionalInfoReadError,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ResponseWriteError {
+    #[error("Could not write response header.")]
+    Header,
+    #[error("Could not write answer.")]
+    Answer,
+    #[error("Could not write name server.")]
+    NameServer,
+    #[error("Could not write additional record.")]
+    AdditionalRecord,
+}
+
+impl Response {
+    pub fn message_id(&self) -> u16 {
+        match self {
+            Response::Valid { source_message_id, .. } => *source_message_id,
+            Response::FormatError { source_message_id } => *source_message_id,
+            Response::ServerFailure { source_message_id } => *source_message_id,
+            Response::NameError { source_message_id } => *source_message_id,
+            Response::NotImplemented { source_message_id } => *source_message_id,
+            Response::Refused { source_message_id } => *source_message_id,
+            Response::UnknownError { source_message_id, .. } => *source_message_id,
+         }
+    }
+
+    pub fn read<B: Buf>(buffer: &mut B) -> error_stack::Result<Response, ResponseReadError> {
+        let header = Header::read(buffer)
+            .change_context(ResponseReadError::HeaderReadError)?;
+
+        // check for errors, and short-cut out if we find any
+        match header.response_code {
+            ResponseCode::NoErrorConditions => {}
+
+            ResponseCode::FormatError => return Ok(Response::FormatError {
+                source_message_id: header.message_id,
+            }),
+
+            ResponseCode::ServerFailure => return Ok(Response::ServerFailure {
+                source_message_id: header.message_id,
+            }),
+
+            ResponseCode::NameError => return Ok(Response::NameError {
+                source_message_id: header.message_id,
+            }),
+
+            ResponseCode::NotImplemented => return Ok(Response::NotImplemented {
+                source_message_id: header.message_id,
+            }),
+
+            ResponseCode::Refused => return Ok(Response::Refused {
+                source_message_id: header.message_id,
+            }),
+
+            ResponseCode::Other(error_code) => return Ok(Response::UnknownError {
+                error_code,
+                source_message_id: header.message_id,
+            }),
+        }
+       
+        // it seems weird to get questions in a response, but we need to parse
+        // them out if they exist.
+        for _ in 0..header.question_count {
+            let question = Question::read(buffer)
+                .change_context(ResponseReadError::QuestionReadError)?; 
+
+            tracing::warn!(
+                %question,
+                "got question during server response."
+            );
+        }
+
+        let mut answers = vec![];
+        for idx in 0..header.answer_count {
+            let answer = ResourceRecord::read(buffer)
+                .change_context(ResponseReadError::AnswerReadError)
+                .attach_printable_lazy(|| format!("In answer {} of {}", idx + 1, header.answer_count))?;
+
+            answers.push(answer);
+        }
+
+        let mut name_servers = vec![];
+        for idx in 0..header.name_server_count {
+            let name_server = ResourceRecord::read(buffer)
+                .change_context(ResponseReadError::NameServerReadError)
+                .attach_printable_lazy(|| format!("In answer {} of {}", idx + 1, header.name_server_count))?;
+
+            name_servers.push(name_server);
+        }
+
+        let mut additional_records = vec![];
+        for idx in 0..header.additional_record_count {
+            let extra = ResourceRecord::read(buffer)
+                .change_context(ResponseReadError::AnswerReadError)
+                .attach_printable_lazy(|| format!("In answer {} of {}", idx + 1, header.additional_record_count))?;
+
+            additional_records.push(extra);
+        }
+
+        Ok(Response::Valid {
+            source_message_id: header.message_id,
+            authoritative: header.authoritative_answer,
+            truncated: header.message_truncated,
+            answers,
+            name_servers,
+            additional_records,
+        })
+    }
+
+    fn write_error<B: BufMut>(source_message_id: u16, error_code: ResponseCode, buffer: &mut B) -> error_stack::Result<(), ResponseWriteError> {
+        let header = Header {
+            message_id: source_message_id,
+            is_response: true,
+            opcode: super::header::OpCode::StandardQuery,
+            authoritative_answer: false,
+            message_truncated: false,
+            recursion_desired: false,
+            recursion_available: false,
+            response_code: error_code,
+            question_count: 0,
+            answer_count: 0,
+            name_server_count: 0,
+            additional_record_count: 0,
+        };
+
+        header
+            .write(buffer)
+            .change_context(ResponseWriteError::Header)
+            .attach_printable_lazy(|| format!("responding to message {source_message_id} with error code {error_code}"))
+    }
+
+    pub fn write<B: BufMut>(self, buffer: &mut B) -> error_stack::Result<(), ResponseWriteError> {
+        let (source_message_id, authoritative, truncated, answers, name_servers, additional_records) = match self {
+            Response::FormatError { source_message_id } => return Self::write_error(source_message_id, ResponseCode::FormatError, buffer),
+
+            Response::ServerFailure { source_message_id } => return Self::write_error(source_message_id, ResponseCode::ServerFailure, buffer),
+
+            Response::NameError { source_message_id } => return Self::write_error(source_message_id, ResponseCode::NameError, buffer),
+
+            Response::NotImplemented { source_message_id } => return Self::write_error(source_message_id, ResponseCode::NotImplemented, buffer),
+
+            Response::Refused { source_message_id } => return Self::write_error(source_message_id, ResponseCode::Refused, buffer),
+
+            Response::UnknownError { error_code, source_message_id } => return Self::write_error(source_message_id, ResponseCode::Other(error_code), buffer),
+
+            Response::Valid { source_message_id, authoritative, truncated, answers, name_servers, additional_records } => {
+                (source_message_id, authoritative, truncated, answers, name_servers, additional_records)
+            }
+        };
+
+        let header = Header {
+            message_id: source_message_id,
+            is_response: true,
+            opcode: super::header::OpCode::StandardQuery,
+            authoritative_answer: authoritative,
+            message_truncated: truncated,
+            recursion_desired: false,
+            recursion_available: false,
+            response_code: ResponseCode::NoErrorConditions,
+            question_count: 0,
+            answer_count: answers.len() as u16,
+            name_server_count: name_servers.len() as u16,
+            additional_record_count: additional_records.len() as u16,
+        };
+
+        header.write(buffer)
+            .change_context(ResponseWriteError::Header)
+            .attach_printable_lazy(|| format!("Writing clean response to {source_message_id}"))?;
+
+        let answer_count = answers.len();
+        for (item, answer) in answers.into_iter().enumerate() {
+            answer.write(buffer)
+                .change_context(ResponseWriteError::Answer)
+                .attach_printable_lazy(|| format!("Writing clean response to {source_message_id}"))
+                .attach_printable_lazy(|| format!("Writing answer {} of {}", item+1, answer_count))?;
+        }
+
+        let ns_count = name_servers.len();
+         for (item, answer) in name_servers.into_iter().enumerate() {
+            answer.write(buffer)
+                .change_context(ResponseWriteError::NameServer)
+                .attach_printable_lazy(|| format!("Writing clean response to {source_message_id}"))
+                .attach_printable_lazy(|| format!("Writing name server {} of {}", item+1, ns_count))?;
+        }
+
+         let ar_count = additional_records.len();
+         for (item, answer) in additional_records.into_iter().enumerate() {
+            answer.write(buffer)
+                .change_context(ResponseWriteError::AdditionalRecord)
+                .attach_printable_lazy(|| format!("Writing clean response to {source_message_id}"))
+                .attach_printable_lazy(|| format!("Writing additional record {} of {}", item+1, ar_count))?;
+        }
+
+        Ok(())
+    }
+}
+
+proptest::proptest! {
+    #[test]
+    fn any_random_response_roundtrips(record: Response) {
+        let mut write_buffer = bytes::BytesMut::with_capacity(128 * 1024);
+        record.clone().write(&mut write_buffer).expect("can write name");
+        let mut read_buffer = write_buffer.freeze();
+        let new_record = Response::read(&mut read_buffer).expect("can read name");
+        assert_eq!(record, new_record);
+    }
+}
diff --git a/src/network/resolver/protocol/server.rs b/src/network/resolver/protocol/server.rs
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/src/network/resolver/protocol/server.rs
@@ -0,0 +1 @@
+
diff --git a/src/network/resolver/resolution_table.rs b/src/network/resolver/resolution_table.rs
new file mode 100644
index 0000000..1e7e99b
--- /dev/null
+++ b/src/network/resolver/resolution_table.rs
@@ -0,0 +1,176 @@
+use crate::network::resolver::name::Name;
+use std::collections::hash_map::Entry;
+use std::collections::{HashMap, HashSet};
+use std::net::IpAddr;
+use tokio::time::{Duration, Instant};
+
+pub struct ResolutionTable {
+    inner: HashMap<Name, Vec<Resolution>>,
+}
+
+struct Resolution {
+    result: IpAddr,
+    expiration: Instant,
+}
+
+impl Default for ResolutionTable {
+    fn default() -> Self {
+        ResolutionTable::new()
+    }
+}
+
+impl ResolutionTable {
+    /// Generate a new, empty resolution table to use in a new DNS implementation,
+    /// or shared by a bunch of them.
+    pub fn new() -> Self {
+        ResolutionTable {
+            inner: HashMap::new(),
+        }
+    }
+
+    /// Clean the table of expired entries.
+    pub fn garbage_collect(&mut self) {
+        let now = Instant::now();
+
+        self.inner.retain(|_, items| {
+            items.retain(|x| x.expiration > now);
+            !items.is_empty()
+        });
+    }
+
+    /// Add a new entry to the resolution table, with a TTL on it.
+    pub fn add_entry(&mut self, name: Name, maps_to: IpAddr, ttl: Duration) {
+        let now = Instant::now();
+
+        let new_entry = Resolution {
+            result: maps_to,
+            expiration: now + ttl,
+        };
+
+        match self.inner.entry(name) {
+            Entry::Vacant(vac) => {
+                vac.insert(vec![new_entry]);
+            }
+
+            Entry::Occupied(mut occ) => {
+                occ.get_mut().push(new_entry);
+            }
+        }
+    }
+
+    /// Look up an entry in the resolution map. This will only return
+    /// unexpired items.
+    pub fn lookup(&mut self, name: &Name) -> HashSet<IpAddr> {
+        let mut result = HashSet::new();
+        let now = Instant::now();
+
+        if let Some(entry) = self.inner.get_mut(name) {
+            entry.retain(|x| {
+                let retain = x.expiration > now;
+
+                if retain {
+                    result.insert(x.result);
+                }
+
+                retain
+            });
+        }
+
+        result
+    }
+}
+
+#[cfg(test)]
+use std::net::{Ipv4Addr, Ipv6Addr};
+#[cfg(test)]
+use std::str::FromStr;
+
+#[test]
+fn empty_set_gets_fail() {
+    let mut empty = ResolutionTable::default();
+    assert!(empty.lookup(&Name::from_str("foo").unwrap()).is_empty());
+    assert!(empty.lookup(&Name::from_str("bar").unwrap()).is_empty());
+}
+
+#[test]
+fn basic_lookups() {
+    let mut table = ResolutionTable::new();
+    let foo = Name::from_str("foo").unwrap();
+    let bar = Name::from_str("bar").unwrap();
+    let baz = Name::from_str("baz").unwrap();
+    let localhost = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1));
+    let other = IpAddr::V6(Ipv6Addr::from_str("2001:18e8:2:e::11e").unwrap());
+    let long_time = Duration::from_secs(10000000000);
+
+    table.add_entry(foo.clone(), localhost, long_time);
+    table.add_entry(bar.clone(), localhost, long_time);
+    table.add_entry(bar.clone(), other, long_time);
+
+    assert_eq!(1, table.lookup(&foo).len());
+    assert_eq!(2, table.lookup(&bar).len());
+    assert!(table.lookup(&baz).is_empty());
+    assert!(table.lookup(&foo).contains(&localhost));
+    assert!(!table.lookup(&foo).contains(&other));
+    assert!(table.lookup(&bar).contains(&localhost));
+    assert!(table.lookup(&bar).contains(&other));
+}
+
+#[test]
+fn lookup_cleans_up() {
+    let mut table = ResolutionTable::new();
+    let foo = Name::from_str("foo").unwrap();
+    let localhost = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1));
+    let other = IpAddr::V6(Ipv6Addr::from_str("2001:18e8:2:e::11e").unwrap());
+    let short_time = Duration::from_millis(100);
+    let long_time = Duration::from_secs(10000000000);
+
+    table.add_entry(foo.clone(), localhost, long_time);
+    table.add_entry(foo.clone(), other, short_time);
+    let wait_until = Instant::now() + (2 * short_time);
+    while Instant::now() < wait_until {
+        std::thread::sleep(short_time);
+    }
+
+    assert_eq!(1, table.lookup(&foo).len());
+    assert!(table.lookup(&foo).contains(&localhost));
+    assert!(!table.lookup(&foo).contains(&other));
+}
+
+#[test]
+fn garbage_collection_works() {
+    let mut table = ResolutionTable::new();
+    let foo = Name::from_str("foo").unwrap();
+    let localhost = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1));
+    let other = IpAddr::V6(Ipv6Addr::from_str("2001:18e8:2:e::11e").unwrap());
+    let short_time = Duration::from_millis(100);
+    let long_time = Duration::from_secs(10000000000);
+
+    table.add_entry(foo.clone(), localhost, long_time);
+    table.add_entry(foo.clone(), other, short_time);
+    let wait_until = Instant::now() + (2 * short_time);
+    while Instant::now() < wait_until {
+        std::thread::sleep(short_time);
+    }
+    table.garbage_collect();
+
+    assert_eq!(1, table.inner.get(&foo).unwrap().len());
+}
+
+#[test]
+fn garbage_collection_clears_empties() {
+    let mut table = ResolutionTable::new();
+    let foo = Name::from_str("foo").unwrap();
+    table.inner.insert(foo.clone(), vec![]);
+    table.garbage_collect();
+    assert!(table.inner.is_empty());
+
+    let localhost = IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1));
+    let short_time = Duration::from_millis(100);
+    table.add_entry(foo.clone(), localhost, short_time);
+    let wait_until = Instant::now() + (2 * short_time);
+    while Instant::now() < wait_until {
+        std::thread::sleep(short_time);
+    }
+    table.garbage_collect();
+    assert!(table.inner.is_empty());
+}
diff --git a/src/operational_error.rs b/src/operational_error.rs
index e9626b7..297354e 100644
--- a/src/operational_error.rs
+++ b/src/operational_error.rs
@@ -37,8 +37,6 @@ pub enum OperationalError {
     ChannelFailure,
     #[error("Error in initial handshake: {0}")]
     KeyxProcessingError(#[from] SshKeyExchangeProcessingError),
-    #[error("Call into random number generator failed: {0}")]
-    RngFailure(#[from] rand::Error),
     #[error("Invalid port number '{port_string}': {error}")]
     InvalidPort {
         port_string: String,
diff --git a/src/ssh/channel.rs b/src/ssh/channel.rs
index 62fcce4..74a8efd 100644
--- a/src/ssh/channel.rs
+++ b/src/ssh/channel.rs
@@ -44,10 +44,10 @@ where
     /// write operations are cancel- and concurrency-safe. They take ownership
     /// of the underlying stream once established, where "established" means
     /// that we have read and written the initial SSH banners.
-    pub fn new(stream: Stream) -> SshChannel<Stream> {
+    pub fn new(stream: Stream) -> Result<SshChannel<Stream>, getrandom::Error> {
         let (read_half, write_half) = tokio::io::split(stream);
 
-        SshChannel {
+        Ok(SshChannel {
             read_side: Mutex::new(ReadSide {
                 stream: read_half,
                 buffer: BytesMut::with_capacity(MAX_BUFFER_SIZE),
@@ -55,12 +55,12 @@ where
             write_side: Mutex::new(WriteSide {
                 stream: write_half,
                 buffer: BytesMut::with_capacity(MAX_BUFFER_SIZE),
-                rng: ChaCha20Rng::from_entropy(),
+                rng: ChaCha20Rng::try_from_os_rng()?,
             }),
             mac_length: 0,
             cipher_block_size: 8,
             channel_is_closed: false,
-        }
+        })
     }
 
     /// Read an SshPacket from the wire.
@@ -155,7 +155,7 @@ where
         encoded_packet.put(packet.buffer);
 
         for _ in 0..rounded_padding {
-            encoded_packet.put_u8(rng.gen());
+            encoded_packet.put_u8(rng.random());
         }
 
         Some(encoded_packet.freeze())
@@ -247,8 +247,8 @@ proptest::proptest! {
     fn can_read_back_anything(packet in SshPacket::arbitrary()) {
         let result = tokio::runtime::Runtime::new().unwrap().block_on(async {
             let (left, right) = tokio::io::duplex(8192);
-            let leftssh = SshChannel::new(left);
-            let rightssh = SshChannel::new(right);
+            let leftssh = SshChannel::new(left).unwrap();
+            let rightssh = SshChannel::new(right).unwrap();
             let packet_copy = packet.clone();
 
             tokio::task::spawn(async move {
@@ -264,8 +264,8 @@ proptest::proptest! {
     fn sequences_send_correctly_serial(sequence in proptest::collection::vec(SendData::arbitrary(), 0..100)) {
         tokio::runtime::Runtime::new().unwrap().block_on(async {
             let (left, right) = tokio::io::duplex(8192);
-            let leftssh = SshChannel::new(left);
-            let rightssh = SshChannel::new(right);
+            let leftssh = SshChannel::new(left).unwrap();
+            let rightssh = SshChannel::new(right).unwrap();
 
             let sequence_left = sequence.clone();
             let sequence_right = sequence;
@@ -335,9 +335,9 @@ proptest::proptest! {
 
         tokio::runtime::Runtime::new().unwrap().block_on(async {
             let (left, right) = tokio::io::duplex(8192);
-            let leftsshw = Arc::new(SshChannel::new(left));
+            let leftsshw = Arc::new(SshChannel::new(left).unwrap());
             let leftsshr = leftsshw.clone();
-            let rightsshw = Arc::new(SshChannel::new(right));
+            let rightsshw = Arc::new(SshChannel::new(right).unwrap());
             let rightsshr = rightsshw.clone();
 
             let sequence_left_write = sequence.clone();
diff --git a/src/ssh/packets/key_exchange.rs b/src/ssh/packets/key_exchange.rs
index 981cb70..fb41b4b 100644
--- a/src/ssh/packets/key_exchange.rs
+++ b/src/ssh/packets/key_exchange.rs
@@ -134,7 +134,7 @@ impl SshKeyExchange {
     /// seed the message with a random cookie, but is otherwise deterministic.
     /// It will fail only in the case that the underlying random number
     /// generator fails, and return exactly that error.
-    pub fn new<R>(rng: &mut R, value: ClientConnectionOpts) -> Result<Self, rand::Error>
+    pub fn new<R>(rng: &mut R, value: ClientConnectionOpts) -> Result<Self, ()>
     where
         R: CryptoRng + Rng,
     {
@@ -185,7 +185,7 @@ impl SshKeyExchange {
             first_kex_packet_follows: value.predict.is_some(),
         };
 
-        rng.try_fill(&mut result.cookie)?;
+        rng.fill(&mut result.cookie);
 
         Ok(result)
     }