DNS Configuration Guide - fake-ip/nameserver

Basic Fields

enableRequired

Whether to enable the built-in DNS server. Needed in almost every setup, especially when using TUN mode.

listenOptional

The address the DNS service listens on, e.g. 0.0.0.0:1053 — other devices on your LAN can also use it as a regular DNS server.

ipv6Optional

Whether to resolve IPv6 results; only takes effect combined with the top-level ipv6: true.

use-hosts / use-system-hostsOptional

Whether to use the hosts field from the config file, and whether to use the system's hosts file.

respect-rulesOptional

Whether DNS requests themselves also follow the rules routing rules to pick an outbound, used together with proxy-server-nameserver.

Enhanced Mode

enhanced-modefake-ip / redir-host

fake-ip: assigns each domain a fake but unique private IP, restoring the real destination once a connection is made; fast and highly compatible, and the recommended choice for most setups (especially TUN mode). redir-host: returns the real resolved result directly — slightly less compatible (some SNI-based routing scenarios may be affected), but friendlier to older clients that don't support the fake-ip range.

fake-ip-range198.18.0.1/16

The address range used for fake-ip; usually no need to change this.

fake-ip-filter-mode / fake-ip-filterOptional

Specifies which domains should skip fake-ip and use real resolution directly — commonly used for internal domains, local service discovery, etc. Supports domain wildcards.

config.yaml YAML

dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter-mode: blacklist
  fake-ip-filter:
    - '*.lan'

Resolver Servers

default-nameserverOptional

The "bootstrap" DNS used to resolve domain-based server addresses in nameserver/fallback — must be an IP here, not a domain name.

nameserverRequired

The default list of DNS resolver servers, supporting UDP/TCP/DoT/DoH/DoQ and more — see DNS Types for details.

nameserver-policyOptional

Specify dedicated resolver servers by domain / geosite: / rule-set:, taking priority over nameserver — commonly used for "domestic domains use domestic DNS, foreign domains use foreign DNS" setups.

fallback / fallback-filterOptional

fallback is a backup resolver (usually set to an overseas DNS server); fallback-filter determines when a resolved result should be treated as "suspicious" and re-queried via fallback instead (e.g. it returned a domestic IP but the domain looks like it may have been tampered with).

direct-nameserver / direct-nameserver-follow-policyOptional

A dedicated resolver used specifically for domains that match a direct rule, combined with direct-nameserver-follow-policy to decide whether nameserver-policy still applies.

proxy-server-nameserver / proxy-server-nameserver-policyOptional

A dedicated DNS used to resolve the domain of the proxy server itself (e.g. your provider's node domain), avoiding a chicken-and-egg problem with resolving user traffic.

config.yaml YAML

default-nameserver:
    - 223.5.5.5
  nameserver-policy:
    '+.arpa': '10.0.0.1'
    'rule-set:cn':
      - https://doh.pub/dns-query
      - https://dns.alidns.com/dns-query
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
  fallback:
    - tls://8.8.4.4
    - tls://1.1.1.1
  fallback-filter:
    geoip: true
    geoip-code: CN
    geosite:
      - gfw
    ipcidr:
      - 240.0.0.0/4
    domain:
      - '+.google.com'

For the full resolution priority order and how these fields work together, see the next page: Resolution Flow.

Extra Parameters

Syntax	Description
`#proxy_name`	Prefer connecting through the proxy node of the same name to send the DNS query; if no proxy with that name is found, connect through the network interface of the same name instead, e.g. `https://1.1.1.1/dns-query#proxy1`
`#RULES`	Makes this DNS query follow routing rules too, equivalent to enabling `respect-rules` just for this entry
`#h3=true`	Force this DoH server to connect over HTTP/3; requires the server to support H3
`#ecs=1.1.1.1/24`	Include the EDNS Client Subnet in DoH requests, so CDNs return results closer to that subnet
`#ecs-override=true`	Force-override any ECS subnet already present in the request