Skip to content

DNS Policies

DNS policies determine which DNS server is used to resolve different domains. They are essential for preventing DNS leaks.

Why Do You Need DNS Policies?

If all DNS queries go through your local ISP, your ISP can see which domains you're visiting — even in proxy mode. DNS policies allow you to:

  • Use domestic DNS for domestic domains, ensuring fast resolution
  • Use encrypted DNS through the proxy for foreign domains, preventing leaks
  • Specify custom DNS servers for specific domains

What is a DNS leak?

When you visit google.com, even if the traffic goes through a proxy, if the DNS query goes to your ISP's DNS server, your ISP knows you visited Google. This is a DNS leak. By configuring DNS policies to direct sensitive domains through a proxy-resolved DNS server, you can avoid this problem.

Basic Concepts

  • DNS Rule — Matches a domain condition → specifies which DNS server to use
  • DNS Server — The upstream that actually performs the resolution (e.g., 223.5.5.5, https://dns.google/dns-query)
  • Unmatched Domains — The default DNS server for domains that don't match any rule

Adding a DNS Rule

  1. Click Add Rule
  2. Set the match condition (domain suffix, rule set, etc.)
  3. Select the DNS server to use
  4. Save

Managing DNS Servers

Click the DNS Servers button to add upstream DNS servers:

Protocol Address Format Example
UDP IP address 223.5.5.5
TCP tcp://IP:port tcp://8.8.8.8:53
DNS over TLS tls://domain:port tls://dns.google:853
DNS over HTTPS https://domain/path https://cloudflare-dns.com/dns-query

Each DNS server needs an outbound mode:

  • Direct — Connect to the DNS server directly (recommended for domestic DNS)
  • Proxy — Connect to the DNS server through the proxy (recommended for foreign DNS, prevents leaks)

Outbound Mode Matters

If you set Google DNS (8.8.8.8) to direct outbound, your ISP can still see the DNS queries. Foreign DNS servers must be set to proxy outbound to truly prevent leaks.

Unmatched Domains

Click Unmatched Domains at the bottom of the list to set the default DNS server:

Recommended Configuration

  • Domestic environment — Use direct DNS (Alibaba 223.5.5.5, Tencent 119.29.29.29)
  • Leak prevention needed — Use proxy DNS (Google 8.8.8.8, Cloudflare 1.1.1.1)

Enable / Disable

Each DNS rule has a toggle on the left side for quick enable/disable.

Advanced

For the complete working principle and configuration generation flow of DNS policies, see DNS Deep Dive.