feat(dns_query): add expected IP validation and metrics for domain hijacking detection

conf/input.dns_query/dns_query.toml

@@ -29,4 +29,12 @@ servers = []
 # port = 53
 
 ## Query timeout in seconds.
-# timeout = 2
+# timeout = 2
+
+## 监控域名劫持
+## record_type必须为A/AAA, expect_query_ips中必须包含对应的域名和IP列表(ip列表越全越好)
+## 对比响应中的IP与如下配置的IP，会生成两个新的指标 dns_query_status_change 与 dns_query_status_change_detail
+## 当diff 不为空的时候 dns_query_status_change 为1 ， diff 为空的时候 dns_query_status_change=0
+## dns_query_status_change_detail{ips="响应的IP列表", diff="响应IP列表-期望IP列表"} 
+## dns_query_status_change_detail 只有当dns_query_status_change为1 时才会有这个指标
+# expect_query_ips={"baidu.com"=["182.61.244.181","182.61.201.211"]}

inputs/dns_query/README.md

@@ -29,6 +29,10 @@ It is not necessary to enable this plugin on every machine. We recommend enablin
 
   ## Query timeout in seconds
   timeout = 5
+
+  ## Expected IP check for domain hijacking
+  ## record_type must be A/AAAA. Configure the expected IPs in expect_query_ips
+  # expect_query_ips={"baidu.com"=["182.61.244.181","182.61.201.211"]}
 ```
 
 If you need to query different record types (e.g., `A` records and `CNAME` records), you can configure multiple `[[instances]]` blocks.
@@ -38,8 +42,10 @@ If you need to query different record types (e.g., `A` records and `CNAME` recor
 - `dns_query_query_time_ms`: The latency/response time of the DNS resolution in milliseconds.
 - `dns_query_result_code`: The result code of the probe execution (0 means success, non-zero indicates an exception like timeout or connection failure).
 - `dns_query_rcode_value`: The standard DNS protocol response code (e.g., NOERROR, NXDOMAIN, SERVFAIL).
+- `dns_query_status_change`: When `expect_query_ips` is configured, this value is 1 if any expected IP is missing from the result, otherwise 0.
+- `dns_query_status_change_detail`: Reported only when there is a diff (value is 1). Includes a `diff` tag for missing IPs, and an `ips` tag for all returned IPs.
 
-All metrics include tags such as `server`, `domain`, and `record_type`, allowing for granular analysis per DNS server or domain.
+All metrics include tags such as `server`, `domain`, and `record_type`, allowing for granular analysis per DNS server or domain. Normal `dns_query` metrics will also include an `ips` tag with comma-separated IPs.
 
 ## Alerting Recommendations
 

inputs/dns_query/README_CN.md

@@ -29,6 +29,10 @@ DNS Query 采集插件用于对 DNS 服务器的响应质量进行持续监测
 
   ## DNS 查询的超时时间 (秒)
   timeout = 5
+
+  ## 监控域名劫持
+  ## record_type 必须为 A/AAAA，expect_query_ips 中需包含预期的 IP 列表
+  # expect_query_ips={"baidu.com"=["182.61.244.181","182.61.201.211"]}
 ```
 
 如果需要拨测不同类型的记录（如 `A` 记录和 `CNAME` 记录），可以配置多个 `[[instances]]` 块。
@@ -38,8 +42,10 @@ DNS Query 采集插件用于对 DNS 服务器的响应质量进行持续监测
 - `dns_query_query_time_ms`: DNS 解析延迟时间 (毫秒)
 - `dns_query_result_code`: 探测过程的结果码 (0 为成功，非 0 为异常，如超时、无法连接等)
 - `dns_query_rcode_value`: DNS 协议标准返回的响应码 (如 NOERROR, NXDOMAIN, SERVFAIL 等)
+- `dns_query_status_change`: 当配置了预期 IP 校验时，如果实际查询到的 IP 中缺失了预期 IP，则该值为 1，否则为 0。
+- `dns_query_status_change_detail`: 当开启 IP 校验且存在差异时才会上报此指标（值为 1）。带有 `diff` 标签记录缺失的 IP 列表，`ips` 标签记录所有实际返回的 IP 列表。
 
-所有指标都会带上 `server`, `domain`, `record_type` 等标签，方便按照特定 DNS 服务器或域名进行聚合分析。
+所有指标都会带上 `server`, `domain`, `record_type` 等标签，方便按照特定 DNS 服务器或域名进行聚合分析。基础监控指标中也会追加 `ips` 标签来记录实际解析得到的所有 IP。
 
 ## 告警建议