Half of routing accuracy is DNS: with poisoned resolution, perfect rules still connect to the wrong place. Clash ships a built-in DNS server that, configured well, fixes both polluted and slow resolution.

Base configuration

dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 1.1.1.1              # everyday resolvers
    - 8.8.8.8
  fallback:                # encrypted resolvers for pollution resistance
    - https://1.1.1.1/dns-query
    - tls://8.8.8.8:853
  fallback-filter:
    geoip: true
    geoip-code: CN

nameserver handles routine lookups; fallback uses encrypted DNS as a safety net. With fallback-filter, domestic results use the former while suspicious (foreign-IP) answers take the fallback's word.

fake-ip mode (recommended)

When a program asks for resolution, Clash instantly answers with a reserved-range "fake IP" (198.18.x.x) and remembers the mapping. The program connects to the fake IP; Clash recovers the domain at connect time, matches rules by name, and lets the node resolve remotely. Benefits:

  • zero resolution latency (no real DNS round trip);
  • domain rules always match (the connection carries its domain);
  • no local real resolution - inherently pollution- and leak-proof.

redir-host mode

Returns real IPs; connections are matched by IP. For compatibility cases (software that validates IPs or genuinely needs the real address). Costs slower resolution and higher leak risk. Use fake-ip day to day.

fake-ip-filter: carve out exceptions

A few scenarios must see real IPs (LAN discovery, some game launchers, Windows connectivity probes). List them to bypass fake-ip:

  fake-ip-filter:
    - "*.lan"
    - "+.stun.*.*"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"

Applying and verifying

  • Subscriptions usually include a dns section; to override it, inject via Mixin.
  • TUN mode requires the built-in DNS, with fake-ip strongly recommended (plus dns-hijack).
  • Verify: nslookup google.com 127.0.0.1 returning 198.18.x.x means fake-ip is live.
Tip: if some app misbehaves after enabling fake-ip, suspect it is doing something special with the fake address - add its domains to fake-ip-filter and retry.