DNS Configuration Guide: Fixing Resolution Errors and DNS Poisoning

Why DNS Needs Configuration Too

Even if the proxy connection itself works perfectly, if domain resolution uses a poisoned or hijacked DNS server, the browser ends up with the wrong target IP, and access will fail regardless of whether it's proxied. That's why proxy clients typically include a built-in DNS module that intercepts the system's domain resolution requests, resolves them via trusted DNS servers, and then decides which IP to connect to.

Basic DNS Configuration

• default-nameserver: resolves the domains of the DNS-over-HTTPS / DNS-over-TLS servers listed under nameserver below — usually a regular, directly reachable local DNS server.
• nameserver: the DNS server actually used to resolve the sites you visit — use encrypted DoH (https://) or DoT (tls://) to avoid tampering or blocking by intermediate network devices.

fake-ip: Making Routing Smarter

If TUN mode is enabled, fake-ip mode is usually enabled alongside it: the core assigns a virtual IP to each domain and returns it to the system, then when actually connecting, it matches rules and initiates the connection based on the domain (not the real IP). The benefit is that routing decisions can be precise down to the domain level, unaffected by what DNS actually returns.

fake-ip-filter excludes domains unsuitable for a virtual IP (e.g. LAN devices, services requiring a real IP to work properly) — domains matching the filter go through the normal DNS resolution flow.

How to Verify DNS Is Working Correctly

You can use nslookup or dig in a terminal/command prompt to query a domain and compare the returned IP before and after enabling the proxy. If enabling the proxy returns an IP that obviously doesn't belong to the target site (e.g. a private address or invalid address), it's very likely a DNS configuration issue — check your nameserver list or fake-ip-filter settings.

Assigning Different DNS Strategies by Domain

If you want fast resolution for local sites while keeping overseas sites free from poisoning, you can assign different DNS strategies per rule set — local domains resolve directly via local DNS, while overseas domains resolve via encrypted DNS, with no interference between the two:

nameserver-policy lets you assign a dedicated DNS server to a specific domain group (here using the built-in geosite:cn local-domain category). Domains outside the policy's scope continue resolving via the default nameserver list — the two logics don't conflict.

Extra Things to Watch for in IPv6 Environments

If your device or ISP network already has IPv6 enabled, an AAAA record returned by DNS may cause the system to prefer an IPv6 connection, while some proxy nodes or rule sets haven't been fully adapted for IPv6 — leading to the confusing symptom of "sometimes it connects, sometimes it doesn't." If you're unsure whether your IPv6 path is stable, you can disable IPv6 resolution in the DNS config first:

Once you've confirmed node connectivity is fine under IPv6, you can re-enable it. This step quickly helps you rule out the common blind spot of "is it a DNS problem or an IPv6 path problem?"

Summary

DNS issues often look just like "the network isn't working," and get misdiagnosed as node failures. When access seems off, rule out DNS first — switch to a trusted encrypted DNS server, check fake-ip filter rules, and watch for IPv6 compatibility issues. That's often far more effective at pinpointing the problem than repeatedly switching nodes.