Skip to content

DNS Deep Dive

Rover's DNS system consists of two layers: the sing-box core DNS and the Rover DNS service.

System Architecture

Application (Browser / Other Apps)
        │
        │ System DNS Query
        ▼
sing-box Core DNS
├── DNS Rule Matching → Select Server → Resolve via Upstream
│       │
│       ├── dns_direct_out  → Direct DNS Server
│       ├── dns_proxy_out   → Proxy DNS Server
│       └── Rover DNS (DoH) → 127.0.0.1:5353
│                                        │
│                                        │ HTTPS POST /dns-query
│                                        ▼
Rover DNS Service (Optional) ─── Local HTTPS DoH Server
├── Concurrent Resolver
│   ├── DoH Upstream
│   ├── DoT Upstream
│   ├── UDP Upstream
│   └── ... (Concurrent query, first success wins)

sing-box Core DNS

DNS Servers

sing-box's dns.servers defines upstream DNS servers, each with an independent tag:

Tag Purpose Typical Config
dns_direct_out Direct DNS for domestic domains Domestic DNS (Alibaba, Tencent, etc.)
dns_proxy_out Proxy DNS for foreign domains DNS resolved through proxy
dns_hosts Local hosts overrides User-defined entries
User-defined Servers specified by DNS policies DoH / DoT / UDP / TCP

DNS Rule Matching

sing-box matches dns.rules in order; once matched, the corresponding server is used:

{
  "dns": {
    "rules": [
      { "rule_set": ["geosite-cn"], "server": "dns_direct_out" },
      { "domain_suffix": [".google.com"], "server": "dns_proxy_out" },
      { "rule_set": ["custom-block"], "action": "reject" }
    ],
    "final": "dns_direct_out"
  }
}

Supported match conditions are similar to policy rules. See Rule Conditions Reference.

DNS Rules vs. Policy Rules

  • Policy Rules (route.rules) — Determine which outbound traffic goes through (proxy/direct/block)
  • DNS Rules (dns.rules) — Determine which DNS server resolves a domain

They are matched independently. For example, a domain may first go through a DNS rule for proxy DNS resolution, then through a policy rule for proxy outbound routing.

FakeIP Mode

Some preset templates enable FakeIP mode:

  • How it works: DNS queries return a fake IP (e.g., 198.18.0.x); sing-box reverse-looks up the real domain for routing
  • Advantages: Prevents DNS leaks, reduces DNS resolution latency
  • Note: Some applications may not be compatible with FakeIP (e.g., local services that need real IPs)

Rover DNS Service

Rover DNS is an optional local DoH server provided by RoverService. It offers:

  • Multi-upstream concurrency — Query multiple DNS servers simultaneously, return the fastest response
  • Protocol variety — Supports DoH / DoT / TCP / UDP upstreams
  • Proxy support — Upstream can connect through a SOCKS5 proxy
  • Bootstrap mechanism — Uses IP-address DNS to resolve upstream domain names, avoiding circular dependencies

See Rover DNS Service.

Two-Layer Cooperation

Layer Responsibility Config Entry
sing-box Core DNS Routing decisions DNS Policies page
Rover DNS Concurrent resolution DNS Server settings

Most users only need to configure the sing-box core DNS (i.e., the DNS Policies page in Rover's interface). Rover DNS is for advanced users who need finer DNS control.

How to Choose?

  • General users: Configure directly on the DNS Policies page
  • Need faster DNS responses: Enable Rover DNS concurrent resolution
  • Need SOCKS5 proxy resolution: Use Rover DNS with proxy configuration