Rover DNS Service¶
Rover DNS is an optional local DoH (DNS over HTTPS) server provided by RoverService. It listens on 127.0.0.1:5353 by default.
Features¶
| Feature | Description |
|---|---|
| Multi-upstream concurrency | Query multiple DNS servers simultaneously, return the fastest response |
| Protocol variety | Supports DoH, DoT, TCP, UDP as upstreams |
| Proxy support | Upstream DNS can connect through a SOCKS5 proxy |
| No system DNS dependency | Uses Bootstrap DNS to resolve upstream domain names, avoiding circular dependencies |
| Local caching | Bootstrap DNS results cached for 5 minutes |
How to Enable¶
Rover DNS is used by adding a rover type DNS server in the DNS server settings:
- Open the DNS Policies page → DNS Server settings dialog
- In the "Rover DNS Service" section, confirm it is enabled and set the listen port (default
5353) - Click to add a DNS server, and select Rover as the type
- Configure upstream addresses, whether to use a proxy, and other parameters
- Select this Rover-type server as the upstream in your DNS policies
Auto Configuration
Rover automatically generates the rover type server as a DoH server configuration pointing to the local https://127.0.0.1:5353/dns-query — no need to fill in the address manually.
Request Flow¶
App DNS Query → sing-box DNS → [match rule] → Rover DNS (DoH)
│
│ POST /dns-query
▼
RoverService DNS Server
├── Upstream A (DoH/DoT/UDP/TCP)
├── Upstream B (DoH/DoT/UDP/TCP)
└── Upstream C (DoH/DoT/UDP/TCP)
│
First success
│
▼
Return DNS response to sing-box
Rover Type Server Configuration¶
When adding a rover type DNS server, you can configure the following parameters:
| Parameter | Description | Example |
|---|---|---|
| Upstream addresses | Upstream DNS address list, comma-separated | tls://8.8.8.8:853,https://1.1.1.1/dns-query |
| Use proxy | Enable to connect upstreams through a SOCKS5 proxy | On/Off |
| Bootstrap addresses | DNS addresses for resolving upstream domains | 223.5.5.5 |
| Fallback addresses | Fallback DNS addresses | 119.29.29.29 |
Upstream Address Format¶
8.8.8.8 → UDP (default port 53)
udp://8.8.8.8:53 → UDP (explicit)
tcp://8.8.8.8:53 → TCP
tls://dns.google:853 → DoT (DNS over TLS)
https://cloudflare-dns.com/dns-query → DoH (DNS over HTTPS)
How Are Upstreams Configured?
Upstream addresses are set automatically by Rover's config generator. When you configure a rover type DNS server, Rover automatically adds the appropriate request headers based on whether proxy is enabled.
Advanced users can check the generated dns.servers configuration in Settings → About → View Current Config to verify upstream settings.
Bootstrap DNS Mechanism¶
To avoid DNS query loops, Rover DNS uses Bootstrap DNS to pre-resolve upstream domain names:
- Resolve the domain name in the upstream address (e.g.,
dns.google) - Use Bootstrap DNS (IP addresses like
223.5.5.5) for A/AAAA queries - Cache the resolution result for 5 minutes
- Use the resolved IP to connect to the upstream server
- TLS/HTTPS connections still use the original domain name as SNI
Why Is Bootstrap Needed?
If the upstream is tls://dns.google:853, we need to first resolve the IP address of dns.google. But if the system DNS itself needs to be resolved through Rover DNS, this creates a circular dependency.
Bootstrap DNS uses pure IP addresses (e.g., 223.5.5.5) that don't require domain resolution, thus breaking the loop.
SOCKS5 Proxy Mode
When using a SOCKS5 proxy, Bootstrap resolution is skipped — the proxy server resolves the domain remotely. This means even if the upstream domain can't be resolved locally, it can still work through the proxy.