DNS Types
Each line under nameserver / fallback is a URL, and the protocol prefix determines how Clash talks to that DNS server. Here are all the supported formats.
Supported Types
| Type | Example | Description |
|---|---|---|
| UDP | 223.5.5.5 or udp://223.5.5.5 | The most common plaintext DNS; this is the default when no protocol prefix is given |
| TCP | tcp://8.8.8.8 | The TCP version of plaintext DNS, slightly more resistant to interference than UDP |
| DNS over TLS | tls://1.1.1.1 | DoT — queries over an encrypted channel after a handshake, on port 853 |
| DNS over HTTPS | https://doh.pub/dns-query | DoH — disguised as regular HTTPS traffic, offers the best network penetration, and is the recommended choice |
| DNS over QUIC | quic://dns.adguard.com:784 | DoQ — based on the QUIC protocol, balancing speed and resistance to interference |
| System DNS | system:// or system | Uses whatever DNS is currently configured at the OS level |
| DHCP | dhcp://en0 | Uses the DNS obtained via DHCP on a specified network interface; dhcp://system is limited to the cmfa client and uses the system DNS |
| Fixed Response | rcode://name_error | Doesn't actually query anything — just returns a fixed error code, commonly used to block domains |
Available rcode Values
Example YAML
rcode://success # No error rcode://format_error # Format error rcode://server_failure # Server failure rcode://name_error # Domain does not exist rcode://not_implemented # Not implemented rcode://refused # Query refused