Regarding DNS over HTTPS

[Ptipiak]

Operating system

Linux

System version

6.15.8-200.fc42.x86_64

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

ShadowsocksX-NG v1.10.3 (1)

Version

sing-box version 1.12.2

Environment: go1.25.0 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale
Revision: 97f0dc8a6060f8993388cb36d357668731475f38
CGO: disabled

Description

Hi, first thanks for the amazing software that is sing-box.

A few informations:

• I use the ShadowsocksX-NG client to proxy browsing requests from my local machine.

• My main browser is firefox, firefox settings are set to point at localhost as the proxy destination and DNS over HTTPS is activated in order to forward the DNS query all the way down to the remote proxy endpoint, that setup works perfectly fine.

Here's my issue, I'd like to change from pointing ShadowsocksX-NG client to the remote machine beyond the GFW, to pointing it to the local machine which is, itself, forwarding request to beyond the GFW, this machine is also hosting a set of services, including a pihole.
My end goal would be to forward DNS query through the pihole to blocks advertisement, as well as using the proxy for regular HTTP.S queries.

I can already point the shadowsock to the local machine, and using local hosted pihole as a DNS server, but that include a multi step process of:

• changing the proxy ip in the firefox settings
• disabling the DNS over HTTPS in the firefox settings
• Changing the system DNS on MacOS which is frankly a pain since it's hiden behind three sub-menu

Quite unpractical especially when owning several devices needing to use the proxy.

So my questions would be:

1. can sing-box catch DoH queries ?
2. And if yes how to do so ?

I fail to understand when the DoH terminaison take place, but according to the logs, it deffinetly happen, so my understand is: sing-box can terminate DoH queries, but my configuration is incorrect.

I've include the logs I get when querying for "discord.com", I'd like to get your attention on the fact that first the sniffing doesn't seems to work, and second, we can see at some point sing-box do resolve the DNS query for "discord.com" using local DNS server, but then proceed to forward HTTPS queries using direct-out instead of querying using ss-out (the shadowsock exit)

I didn't include client side config, as the client is the shadowsock-client and is forwarding all the traffic incoming from firefox to the server.

Reproduction

./dns.config.json
{
  "dns": {
    "servers": [
      {
        "type": "local",
        "tag": "direct-out"
      }
    ],
    "rules": [
      {
        "protocol": [
          "http"
        ],
        "server": "direct-out"
      }
    ]
  }
}

routes.config.json
{
  "route": {
    "rules": [{
      "action": "sniff",
      "sniffer": [
        "dns",
        "quic"
      ],
      "timeout": "400ms"
    },{
      "client": [
          "firefox",
          "chromium"
      ],
      "outbound": "ss-out"
    },{
      "protocol": [
          "dns"
      ],
      "outbound": "direct-out"
    }],
    "default_domain_resolver": "direct-out",
    "final": "reject"
  }
}

./ingress.config.json
{
  "inbounds": [{
    "type": "direct",
    "tag": "direct-in",
    "listen": "127.0.0.1",
    "listen_port": PORT
  },{
    "type": "socks",
    "tag": "socks-in",
    "listen": "::",
    "listen_port": PORT
  },{
    "type": "http",
    "tag": "http-in",
    "listen": "::",
    "listen_port": PORT
  },{
    "type": "shadowsocks",
    "tag": "ss-in",
    "listen": "::",
    "listen_port": PORT,
    "method": "chacha20-ietf-poly1305",
    "password": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "users": [
      {
        "name": "MAC_USER",
        "password": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
      }
    ]
  }]
}

{
  "outbounds": [{
    "type": "direct",
    "tag": "direct-out",
  },{
    "type": "shadowsocks",
    "tag": "ss-out",
    "server": "SERVER_IP",
    "server_port": PORT,
    "method": "chacha20-ietf-poly1305",
    "password": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  },{
    "type": "vless",
    "tag": "vless-out",
    "server": "SERVER_IP",
    "server_port": PORT,
    "uuid": "UUUUUUUUUUUUUUUUUUUUUUUUUUUUU",
    "flow": "xtls-rprx-vision",
    "multiplex": {
      "enabled": true,
    },
    "tls": {
      "enabled": true,
      "server_name": "SERVER_NAME",
      "min_version": "1.3",
      "insecure": false,
      "utls": {
        "enabled": true,
        "fingerprint": "chrome"
      },
      "reality": {
        "enabled": true,
        "public_key": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
        "short_id": "BBBBBBBBBBBB"
      }
    },
  }]
}

Logs

+0200 2025-08-23 14:55:06 INFO inbound/direct[direct-in]: tcp server started at 127.0.0.1:51820
+0200 2025-08-23 14:55:06 INFO inbound/direct[direct-in]: udp server started at 127.0.0.1:51820
+0200 2025-08-23 14:55:06 INFO inbound/socks[socks-in]: tcp server started at [::]:1082
+0200 2025-08-23 14:55:06 INFO inbound/http[http-in]: tcp server started at [::]:1083
+0200 2025-08-23 14:55:06 INFO inbound/shadowsocks[ss-in]: tcp server started at [::]:81
+0200 2025-08-23 14:55:06 INFO inbound/shadowsocks[ss-in]: udp server started at [::]:81
+0200 2025-08-23 14:55:06 INFO sing-box started (0.00s)
+0200 2025-08-23 14:55:08 INFO [1708406850 0ms] inbound/shadowsocks[ss-in]: inbound connection from 192.168.AA.BB:54055
+0200 2025-08-23 14:55:08 INFO [1708406850 0ms] inbound/shadowsocks[ss-in]: [MAC_USER] inbound connection to discord.com:443
+0200 2025-08-23 14:55:08 DEBUG [1708406850 0ms] router: match[0] => sniff(dns,quic,400ms)
+0200 2025-08-23 14:55:08 INFO [1708406850 0ms] outbound/direct: outbound connection to discord.com:443
+0200 2025-08-23 14:55:08 DEBUG [1708406850 1ms] dns: lookup domain discord.com
+0200 2025-08-23 14:55:08 DEBUG [1708406850 4ms] dns: exchanged discord.com NOERROR 155
+0200 2025-08-23 14:55:08 DEBUG [1708406850 4ms] dns: exchanged AAAA discord.com. 155 IN AAAA 2a03:2880:f10e:83:face:b00c:0:25de
+0200 2025-08-23 14:55:08 DEBUG [1708406850 5ms] dns: exchanged discord.com NOERROR 155
+0200 2025-08-23 14:55:08 DEBUG [1708406850 5ms] dns: exchanged A discord.com. 155 IN A 108.160.170.52
+0200 2025-08-23 14:55:08 DEBUG [1708406850 5ms] dns: lookup succeed for discord.com: 108.160.170.52 2a03:2880:f10e:83:face:b00c:0:25de
+0200 2025-08-23 14:55:11 INFO [3050386502 0ms] inbound/shadowsocks[ss-in]: inbound connection from 192.168.AA.BB:54057
+0200 2025-08-23 14:55:11 INFO [3050386502 0ms] inbound/shadowsocks[ss-in]: [MAC_USER] inbound connection to push.services.mozilla.com:443
+0200 2025-08-23 14:55:11 DEBUG [3050386502 1ms] router: match[0] => sniff(dns,quic,400ms)
+0200 2025-08-23 14:55:11 INFO [3050386502 1ms] outbound/direct: outbound connection to push.services.mozilla.com:443
+0200 2025-08-23 14:55:11 DEBUG [3050386502 1ms] dns: lookup domain push.services.mozilla.com
+0200 2025-08-23 14:55:11 INFO [3747810073 0ms] inbound/shadowsocks[ss-in]: inbound connection from 192.168.AA.BB:54059
+0200 2025-08-23 14:55:11 INFO [3747810073 0ms] inbound/shadowsocks[ss-in]: [MAC_USER] inbound connection to alive.github.com:443
+0200 2025-08-23 14:55:11 DEBUG [3747810073 0ms] router: match[0] => sniff(dns,quic,400ms)
+0200 2025-08-23 14:55:11 INFO [3747810073 0ms] outbound/direct: outbound connection to alive.github.com:443
+0200 2025-08-23 14:55:11 DEBUG [3747810073 0ms] dns: lookup domain alive.github.com
+0200 2025-08-23 14:55:11 DEBUG [3050386502 10ms] dns: exchanged push.services.mozilla.com NOERROR 155
+0200 2025-08-23 14:55:11 DEBUG [3050386502 10ms] dns: exchanged A push.services.mozilla.com. 155 IN A 34.107.243.93
+0200 2025-08-23 14:55:11 DEBUG [3747810073 11ms] dns: exchanged alive.github.com NOERROR 159
+0200 2025-08-23 14:55:11 DEBUG [3747810073 11ms] dns: exchanged CNAME alive.github.com. 159 IN CNAME live.github.com.
+0200 2025-08-23 14:55:11 DEBUG [3747810073 11ms] dns: exchanged A live.github.com. 159 IN A 140.82.112.25
+0200 2025-08-23 14:55:11 DEBUG [3747810073 11ms] dns: lookup succeed for alive.github.com: 140.82.112.25
+0200 2025-08-23 14:55:11 DEBUG [3050386502 53ms] dns: lookup succeed for push.services.mozilla.com: 34.107.243.93
+0200 2025-08-23 14:55:13 INFO [654930645 0ms] inbound/shadowsocks[ss-in]: inbound connection from 192.168.AA.BB:54061
+0200 2025-08-23 14:55:13 INFO [654930645 0ms] inbound/shadowsocks[ss-in]: [MAC_USER] inbound connection to push.services.mozilla.com:443
+0200 2025-08-23 14:55:13 DEBUG [654930645 0ms] router: match[0] => sniff(dns,quic,400ms)
+0200 2025-08-23 14:55:13 INFO [654930645 0ms] outbound/direct: outbound connection to push.services.mozilla.com:443
+0200 2025-08-23 14:55:13 ERROR [1708406850 5.0s] connection: open connection to discord.com:443 using outbound/direct[direct]: dial tcp 108.160.170.52:443: i/o timeout
+0200 2025-08-23 14:55:13 INFO [787874329 0ms] inbound/shadowsocks[ss-in]: inbound connection from 192.168.AA.BB:54063
+0200 2025-08-23 14:55:13 INFO [787874329 0ms] inbound/shadowsocks[ss-in]: [MAC_USER] inbound connection to discord.com:443
+0200 2025-08-23 14:55:13 DEBUG [787874329 0ms] router: match[0] => sniff(dns,quic,400ms)
+0200 2025-08-23 14:55:13 INFO [787874329 1ms] outbound/direct: outbound connection to discord.com:443
+0200 2025-08-23 14:55:18 ERROR [787874329 5.0s] connection: open connection to discord.com:443 using outbound/direct[direct]: dial tcp 108.160.170.52:443: i/o timeout

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

[Ptipiak]

Update, after tinkering a bit I figured out about the resolveAction Rule, I end up using the following route configuration:

./routes.config.json
{
  "route": {
    "rules": [{
      "inbound": "socks-in",
      "outbound": "ss-out"
    },{
      "action": "resolve",
      "disable_cache": true,
      "server": "local-out"
    },{
      "inbound": "ss-in",
      "outbound": "ss-out"
    },{
      "action": "reject"
    }]
  }
}

With the following dns configuration:

{
  "dns": {
    "servers": [{
        "type": "udp",
        "tag": "local-out",
        "server": "127.0.0.1",
        "server_port": 53
      },{
        "type": "tcp",
        "server": "127.0.0.1",
        "server_port": 53
      }
    ]
  }
}

Although it is working (the contianers queries are coming in from socks-in while the ss-in carry the various devices and browsing queries). I end up with a lot of Secure Connection Failed I suspect it's due to Upgrade-Insecure-Requests failing, which should upgrade http based queries to https.