Reality handshake fails with www.microsoft.com as dest/SNI, but immediately works after switching to www.cloudflare.com

[kunkupl]

Reality handshake fails with www.microsoft.com as dest/SNI, but immediately works after switching to www.cloudflare.com

Hi everyone,

I'd like to share an interesting Reality issue that I spent nearly two days debugging.

I'm not claiming this is an Xray bug. I'm posting this to see whether anyone else can reproduce the same behavior.

Environment

Server

Ubuntu 24.04
Xray 26.3.27
VLESS + REALITY + XTLS Vision
TCP 8443

Client

v2rayN 7.14.12 (Windows)
iPhone (same result)
Symptoms

Everything had been working normally for several months.

Suddenly, all clients started showing:

Latency = -1 ms
Connection failed

Server log repeatedly reported:

REALITY: processed invalid connection
handshake did not complete successfully

Client log contained many messages like:

dns: exchange failed ... IN A: EOF
What I checked

I ruled out the following:

VPS networking
Firewall
SSH
DNS on the VPS
Xray configuration syntax
Client devices (Windows & iPhone)
Xray version (upgraded)
UUID
Reality key
ShortID
VM snapshot rollback

tcpdump also confirmed that:

TCP handshake completed successfully.
ClientHello reached the server.
Xray received the handshake.
The server then closed the connection because Reality handshake validation failed.
Root observation

My original configuration was:

"dest": "www.microsoft.com:443",
"serverNames": [
"www.microsoft.com"
]

Client:

sni = www.microsoft.com

After changing only these values to:

"dest": "www.cloudflare.com:443",
"serverNames": [
"www.cloudflare.com"
]

and

sni = www.cloudflare.com

everything immediately started working again.

No other settings were changed.

Additional observations

Another Reality server I own has always used Cloudflare as dest/SNI and has never experienced this issue.

This makes me wonder whether something has changed in Microsoft Front Door / TLS behavior on some edge clusters, although I currently have no evidence to confirm that.

Question

Can anyone test whether Reality still works correctly with:

dest = www.microsoft.com:443
serverNames = www.microsoft.com
client SNI = www.microsoft.com

If possible, please include:

Server location
VPS provider
IP type (residential / VPS)
Xray version
Works / Doesn't work

I'd like to know whether this is environment-specific or something others can reproduce.

Thanks!

[papka1974]

Hi. OMG. Finally anyone. Fighting with that for some days already. Since I have quite some clients, I can't simply change this, tried to change almost everything already. Nothing help. Notices inside log file, when trying to do a test after connection, there is a message:
REALITY: processed invalid connection from IP:PORT: handshake did not complete successfully

This is it