I have a requirement that I believe may be impossible and wanted to confirm this with experts in this community.
A client wants us to configure a DNS server to resolve certain domains to an IP address of a server under our control (poisoned DNS). The server associated with this poisoned record should forward / redirect all non-http traffic to the actual IP address associated with the canonical DNS record. However, for all port 80 (http) traffic, it should intercept the request and proxy it, possibly modifying the response.
Is the above approach feasible? If not, are there other ways this problem can be approached short of requiring specialized gateway hardware?
Ideally the system will minimize bandwidth usage & latency for non-http traffic without requiring anything besides DNS or firewall configuration. I realize we can forward all http traffic at the firewall level, but the client wants to avoid http requests to CDNs or media heavy sites as well as minimize deployment effort across disparate network configurations.
Update Forwarding port 80 traffic isn't enough for us as we want to minimize latency for certain domains (such as those associated with CDNs or partner sites).
Update OpenDNS has something called blocked page proxy but that merely displays an authentication form. It doesn't actually proxy the request to a server under our control.
Misc Notes This could in theory be possible if we had a large block of public IP addresses that could intelligently route based on the sender's IP to the proper destination, but the engineering effort required there to keep the DNS request and subsequent requests to that same domain in sync would be immense. Not to mention we would be limited from a concurrency perspective. This is probably similar to how OpenDNS does their DNS+Proxying, but they only seem to do it for google.com. This needs to work for an arbitrary set of domains (potentially all of them).