MMOSHCODEapp
The pit Sign in

the moshpit namespace

One setting. .anything resolves.

These names live outside the traditional DNS root, so a normal browser has nowhere to look them up. These resolvers know where. Point a laptop, a phone or a whole router at one and .eggs, .moshpit, .yeah resolve like any other name — while .com, .org and the rest of the internet keep working exactly as before, forwarded on to 8.8.8.8 and 1.1.1.1. If the DNS settings on the machine are not yours to change, TronBrowser resolves the same namespace without touching them.

Ways to connect

Pick by how much of the machine you want to change. Most people want the first one.

  1. Just your browser — two minutes, no admin rights. Turn on DNS over HTTPS with this registry as the provider. Chrome / Edge / Brave: Settings → Privacy and security → Security → Use secure DNS → With: Custom. Firefox: Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom. Paste https://dns.moshcode.sh/dns-query. Moshpit names now open in that browser; every other site resolves as before.
  2. https:// without the warning — trust the Moshpit Root CA (SHA-256 4A:57:66:EC:8C:1F:10:F8:75:C9:89:65:FB:E8:DC:36:1A:32:C7:2B:C3:95:95:16:EA:7B:81:61:00:1E:15:57). Easiest: moshcode dns ca --user-only (browser store, no prompt) or moshcode dns ca (every store). By hand: Firefox → Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, tick trust this CA to identify websites; Chrome and Edge use the system store — macOS Keychain Access → System → import, then Always Trust; Windows: open the file → Install Certificate → Local Machine → Trusted Root Certification Authorities. Its promise to sign only Moshpit names is a policy, not a technical limit, so trust it only if you trust this registry.
  3. Change nothing at all — TronBrowser resolves the namespace itself over ordinary HTTPS, with no setting to touch.
  4. The whole machine, or the whole network — moshcode dns enable sets up a local resolver, routing and the root in one step (it asks for sudo; it never runs on its own). Or point the machine's or router's DNS at a resolver below, so curl, git and every app see the names too.

The addresses

Not published yet. The resolver is built and tested, but no public instance is announced here — and this page will not invent an address for you to paste into your network settings. Run your own below; it serves every name in the namespace, not just yours.

Set it

  1. macOS — System Settings → Network → your connection → Details → DNS, add it with +, drag it to the top, Save. Or: networksetup -setdnsservers Wi-Fi <resolver address>
  2. Windows — Settings → Network & Internet → your adapter → DNS server assignment → Edit → Manual, IPv4 on, preferred server.
  3. Linux — resolvectl dns <interface> <resolver address>, or a nameserver line in /etc/resolv.conf.
  4. Router — hand it out over DHCP and every device on the network gets the namespace. This is the setup it is really for.
  5. A locked-down machine where DNS is not yours to change — the browser route in Ways to connect, or TronBrowser.

Or change nothing: TronBrowser

TronBrowser resolves these names itself. Before every navigation it asks this registry, over ordinary HTTPS, who holds the name you typed. Nothing in your network settings changes, nothing needs admin rights, and it works on a machine where DNS is somebody else's to configure. 

curl -fsSL https://tronbrowser.dev/install.sh | sh   # macOS, Linux — Windows: the releases page
tron http://scrambled.eggs                          # or type it in the address bar
  1. Nothing to configure for a new ending. .eggs, .moshpit, .yeah resolve out of the box — the legacy root has never heard of them, so there is nothing to conflict with.
  2. Contested names are a setting. Settings → Name resolution → When a name exists in both. Clearnet wins is the default and never redirects a domain that already works; Moshpit wins lets a registered name override the clearnet one. It is the same decision the resolvers make with MOSHPIT_RESOLVE_MODE, taken per browser instead of per network.
  3. Claim from the address bar. mosh.eggs opens the Pit for .eggs. mosh.anything is reserved, so nobody can register that label and impersonate the page you register on.
  4. Your own pit — Settings → Name resolution → Registry (advanced). Point it at the registry you run and it is looked up exactly like this one.
  5. Needs 3.8.8 or newer. Older builds sent a claimed-but-unpointed name to a URL that has never existed, so parking 404'd. tron upgrade — and a stale address left in settings by one of those builds is discarded on the way, rather than outliving the fix.

It fixes the browser, not the machine: curl, git and everything else still go through DNS. On a machine you control, run both.

Check it worked

dig +short anything.moshpit     # an address, not an error
dig +short example.com          # the ordinary internet, still fine
nslookup anything.moshpit       # the Windows spelling

A TXT lookup on any Moshpit name reports which registry and gateway answered — the fastest way to tell a resolver problem from a site problem.

On the browser route there is nothing to dig: resolution never touches DNS. Open mosh.eggs — if the Pit loads, the browser is talking to this registry.

What still breaks

https:// on a Moshpit name will warn on the resolver route until you opt in. No public certificate authority will issue for scrambled.eggs, because none of them recognise a namespace that does not descend from the ICANN root. Plain http:// works, and so does this site. The answer is a root you opt into — Ways to connect, step two.

TronBrowser sidesteps it rather than solving it: it rewrites the navigation to this registry's own https:// host, so the certificate is one the browser already trusts. The address bar shows where it landed, not what you typed — an honest trade, and the reason the two routes are documented separately.

Clearnet lookups are forwarded to Google and Cloudflare, which is what a forwarder does. Run your own and point it wherever you like if that trade is wrong for you.

Run your own

No dependencies, no database, reads this registry over ordinary HTTPS. Nothing about it privileges ours — a private pit points at a different registry, a household one runs on whatever is already on the shelf. 

git clone https://github.com/moshcoder/moshcoding
cd moshcoding && bun run dns    # port 5354, no privileges needed

dig @127.0.0.1 -p 5354 +short anything.moshpit

Setup, deployment and the operating notes: docs/moshpit-dns.md. Claim a name first over on the namespace tab.