fix(tun/dns): bootstrap critical resolvers over DoH-over-IP instead of UDP 53#42
Merged
Merged
Conversation
Every critical name resolution -- the proxy node domain, doh.pub, and default_domain_resolver -- used `domain_resolver: 'dns-bootstrap-udp'` (223.5.5.5:53/UDP). The DoH-over-IP bootstrap the code added "to avoid UDP 53 blocking" (`dns-bootstrap`, 223.5.5.5:443) was never referenced as a resolver, so UDP 53 was a single point of failure: when an ISP rate-limits / hijacks / poisons UDP 53, the node domain fails to resolve and the whole tunnel drops. - Point dns-domestic, dns-remote, the proxy outbound, and default_domain_resolver at `dns-bootstrap` (DoH over the literal IP 223.5.5.5:443), immune to UDP-53 interference and already egressing direct via the existing 223.5.5.5:443 route rule. - Drop the redundant `domain_resolver` on `dns-bootstrap` itself (its server is already an IP, so no resolution is needed). - Keep `dns-bootstrap-udp` for the non-critical app-query path. - Fix two stale comments (the bootstrap bypasses TUN via the route rule, not a DNS `detour`; default_domain_resolver now names dns-bootstrap). Validated with `sing-box check` (1.13.x): no cycle (dns-bootstrap is a terminal IP node). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sway-Chan
added a commit
to Sway-Chan/FlowZ
that referenced
this pull request
Jun 8, 2026
Owner
|
Merged into main branch via local git merge, included in v3.5.0 release. Thank you for your contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
In TUN mode every critical name resolution — the proxy node domain,
doh.pub, anddefault_domain_resolver— is bootstrapped throughdomain_resolver: 'dns-bootstrap-udp'(223.5.5.5:53, UDP).The DoH-over-IP bootstrap that the code explicitly added "to avoid UDP 53 blocking" (
dns-bootstrap,223.5.5.5:443) was never referenced as a resolver by any of these paths. UDP 53 is therefore a single point of failure for the whole resolution chain: when a network rate-limits / hijacks / poisons UDP 53 (common on mobile, hotel, captive and some ISP networks), the proxy node domain can no longer be resolved once its cached entry expires, the outbound cannot connect, and the entire tunnel drops — an intermittent "works for a while then disconnects" failure.Changes
dns-domestic,dns-remote, the proxy outbound, anddefault_domain_resolver— fromdns-bootstrap-udptodns-bootstrap(DoH over the literal IP223.5.5.5:443). DoH-over-IP is immune to UDP-53 interference, needs no name resolution itself, and already egresses direct via the existing223.5.5.5:443route rule (placed beforehijack-dns), so it cannot loop back into TUN.domain_resolverondns-bootstrapitself — itsserveris already an IP, so it is a self-contained terminal node (no resolution required).dns-bootstrap-udpfor the non-critical app-query path (doh.pub/dns.googleapp self-queries), preserving the fast UDP path where it does not matter.ip_cidrrule (not a DNSdetour: 'direct', which it never had), anddefault_domain_resolvernow namesdns-bootstrap.The
dns-bootstrap/dns-bootstrap-udphosts are both223.5.5.5; a follow-up could add a second-IP DoH backup so the bootstrap host itself is not a SPOF.Testing
tsc -p tsconfig.main.json,eslint,prettier --check: clean.sing-box check(1.13.x): EXIT 0. No circular dependency —dns-bootstrapis a terminal IP node (verified that an IP-based DoH server with nodomain_resolveris accepted, while a domain-based one without a resolver is rejected).🤖 Generated with Claude Code