Home>Tutorials>DNS Anti-Pollution Configuration

Clash DNS Anti-Pollution Configuration | Prevent DNS Leaks Completely

Updated: 12 min read
Table of Contents
  1. Why DNS Matters for Proxy Privacy
  2. Clash DNS Modes Explained
  3. Deep Dive into Fake-IP Mode
  4. Nameserver-Policy: Per-Domain DNS Routing
  5. DNS Splitting: Domestic vs. Foreign Resolution
  6. Complete Anti-Pollution Setup
  7. DNS Configuration with TUN Mode
  8. Verifying Your DNS Is Leak-Free

Why DNS Matters for Proxy Privacy

DNS (Domain Name System) is the phonebook of the internet. When you visit google.com, your device first sends a DNS query to resolve the domain name into an IP address. This query is visible to your ISP, your router, and any intermediary network equipment.

Even if your web traffic is encrypted through a proxy, unencrypted DNS queries leak your browsing history. Worse, DNS pollution (also called DNS spoofing) can return incorrect IP addresses for certain domains, making them unreachable even through a proxy.

Clash's built-in DNS resolver solves both problems by intercepting DNS queries and routing them through appropriate channels. This guide explains every DNS option and shows you how to configure a bulletproof setup.

If you have not yet configured basic Clash functionality, our installation guide is a good starting point.

Clash DNS Modes Explained

Clash supports two DNS resolution modes controlled by the enhanced-mode setting:

redir-host Mode

In redir-host mode, Clash resolves domain names to their real IP addresses but stores the mapping internally. The resolved IP is returned to the application, and Clash tracks which connection belongs to which domain for rule matching purposes.

dns:
  enable: true
  enhanced-mode: redir-host
  listen: "0.0.0.0:1053"

Pros: Compatible with all applications. Cons: The application receives the real IP, which can lead to DNS leaks if the application makes its own DNS query outside Clash's interception.

fake-ip Mode

In fake-ip mode, Clash returns a fake (synthetic) IP address to the application instead of the real one. The real DNS resolution happens later, either locally or through the proxy, depending on which rule matches the domain.

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: "0.0.0.0:1053"

Pros: Superior privacy (applications never see the real IP), faster initial connections, eliminates DNS-based blocking. Cons: Some applications may behave unexpectedly with fake IPs. Requires fake-ip-filter configuration for compatibility.

Recommendation

Use fake-ip mode for the best privacy and performance. The redir-host mode is primarily useful for troubleshooting or when fake-ip causes compatibility issues with specific applications.

Deep Dive into Fake-IP Mode

The fake-ip mechanism works as follows:

  1. An application requests DNS resolution for www.google.com
  2. Clash's DNS resolver intercepts the query
  3. Clash generates a fake IP (e.g., 198.18.1.42) from the configured range and returns it
  4. Clash stores the mapping: 198.18.1.42 -> www.google.com
  5. The application connects to 198.18.1.42
  6. Clash intercepts this connection, looks up the mapping, and applies rules against www.google.com
  7. Based on the rule result, Clash resolves the real IP through the appropriate DNS channel and connects

The fake-ip-range defines the pool of synthetic addresses. The default 198.18.0.1/16 provides 65,534 addresses, which is more than sufficient. The range 198.18.0.0/15 is reserved by IANA for benchmarking and will not conflict with real networks.

The fake-ip-filter

Some domains need real IP resolution. Network connectivity checks, LAN hostnames, and certain DRM systems break when they receive fake IPs. Use fake-ip-filter to exempt them:

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    # LAN and local domains
    - "*.lan"
    - "*.local"
    - "*.localhost"
    
    # Windows connectivity checks
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"
    
    # Apple connectivity checks
    - "captive.apple.com"
    - "*.apple.com"
    
    # Android connectivity checks
    - "connectivitycheck.gstatic.com"
    - "connect.rom.miui.com"
    
    # Common services that need real IPs
    - "localhost.ptlogin2.qq.com"
    - "localhost.sec.qq.com"
    - "+.stun.*.*"
    - "+.stun.*.*.*"
    - "+.stun.*.*.*.*"
    - "+.stun.*.*.*.*.*"

Nameserver-Policy: Per-Domain DNS Routing

The nameserver-policy feature lets you specify different DNS servers for different domains. This is the foundation of DNS splitting, where domestic domains use domestic DNS servers and foreign domains use foreign DNS servers.

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver-policy:
    # Domestic domains use Chinese DNS
    "+.baidu.com":
      - "https://dns.alidns.com/dns-query"
      - "https://doh.pub/dns-query"
    "+.qq.com":
      - "https://dns.alidns.com/dns-query"
    "+.taobao.com":
      - "https://doh.pub/dns-query"
    
    # Foreign domains use DNS-over-HTTPS through proxy
    "+.google.com":
      - "https://dns.google/dns-query"
    "+.youtube.com":
      - "https://dns.google/dns-query"
    "+.github.com":
      - "https://cloudflare-dns.com/dns-query"
    
    # Catch-all: use the default nameservers
    "+":
      - "https://dns.alidns.com/dns-query"

The nameserver-policy uses the same matching logic as DOMAIN-SUFFIX rules. The wildcard + prefix matches the domain and all subdomains.

DNS Splitting: Domestic vs. Foreign Resolution

DNS splitting is critical for a proxy setup where some traffic goes direct and some goes through a proxy. The principle is simple:

Here is a complete DNS splitting configuration:

dns:
  enable: true
  listen: "0.0.0.0:1053"
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"
    - "captive.apple.com"
  
  # Default DNS servers (used for domestic/general queries)
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  
  # Nameservers for general domain resolution
  nameserver:
    - "https://dns.alidns.com/dns-query"
    - "https://doh.pub/dns-query"
  
  # Nameservers for domains that need proxy resolution
  # These queries are resolved through the proxy
  proxy-server-nameserver:
    - "https://dns.google/dns-query"
    - "https://cloudflare-dns.com/dns-query"
  
  # Per-domain DNS routing
  nameserver-policy:
    # Chinese domains: domestic DNS for best CDN performance
    "geosite:cn,private":
      - "https://dns.alidns.com/dns-query"
      - "https://doh.pub/dns-query"
    
    # Foreign domains: resolve through proxy DNS
    "geosite:geolocation-!cn":
      - "https://dns.google/dns-query"
      - "https://cloudflare-dns.com/dns-query"

Complete Anti-Pollution Setup

DNS pollution works by having a rogue DNS server (typically the ISP) return fake IP addresses for certain blocked domains. When your device queries for www.youtube.com, the polluted DNS returns a wrong IP, and your connection fails.

To counter DNS pollution, use encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) for all foreign domain resolution. Here is the complete anti-pollution configuration:

dns:
  enable: true
  listen: "0.0.0.0:1053"
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "dns.msftncsi.com"
    - "www.msftncsi.com"
    - "www.msftconnecttest.com"
    - "captive.apple.com"
    - "+.stun.*.*"
    - "+.stun.*.*.*"
  
  # Plain DNS for resolving DoH server hostnames only
  # These must be plain IPs, not domain names
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  
  # Primary nameservers for domestic queries
  nameserver:
    - "https://dns.alidns.com/dns-query"
    - "https://doh.pub/dns-query"
  
  # DNS servers for resolving proxy server hostnames
  # Used only to find the IP of your proxy servers
  proxy-server-nameserver:
    - "https://dns.google/dns-query"
    - "https://cloudflare-dns.com/dns-query"
  
  # Fallback DNS for when primary nameservers timeout
  # Helps detect DNS pollution
  fallback:
    - "https://dns.google/dns-query"
    - "https://cloudflare-dns.com/dns-query"
    - "tls://8.8.4.4:853"
  
  # When fallback returns different results from nameserver,
  # use the fallback result (anti-pollution)
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4
  
  # Per-domain policy for precise control
  nameserver-policy:
    "geosite:cn,private":
      - "https://dns.alidns.com/dns-query"
      - "https://doh.pub/dns-query"
    "geosite:geolocation-!cn":
      - "https://dns.google/dns-query"
      - "https://cloudflare-dns.com/dns-query"

How the Fallback Mechanism Works

The fallback and fallback-filter combination provides automatic DNS pollution detection:

  1. Clash sends the DNS query to both nameserver (domestic) and fallback (foreign) simultaneously
  2. If the nameserver returns a result, Clash checks whether the returned IP falls within China (using the geoip-code: CN filter)
  3. If the IP is in China, the nameserver result is used (no pollution detected)
  4. If the IP is not in China, or the nameserver timed out, the fallback result is used

This mechanism effectively neutralizes DNS pollution: even if the domestic DNS returns a polluted (non-Chinese) IP for a blocked foreign domain, Clash detects this and uses the clean result from the foreign DNS server.

DNS Configuration with TUN Mode

When using TUN mode, DNS handling becomes even more critical. All DNS queries are hijacked by the TUN interface, so you must ensure that Clash's DNS resolver is properly configured to handle them.

Key requirements for TUN + DNS:

# Combined TUN + DNS configuration
tun:
  enable: true
  stack: mixed
  dns-hijack:
    - any:53
  auto-route: true
  auto-detect-interface: true

dns:
  enable: true
  listen: "0.0.0.0:1053"
  enhanced-mode: fake-ip
  # ... rest of DNS configuration as above

Verifying Your DNS Is Leak-Free

After configuring your DNS setup, verify that no leaks exist:

Step 1: DNS Leak Test

Visit a DNS leak testing website such as browserleaks.com/dns or dnsleaktest.com. The test should show only your proxy server's DNS resolver, not your ISP's. If you see your ISP's DNS servers, there is a leak.

Step 2: Verify Fake-IP Is Working

On your system, use the nslookup or dig command to check DNS resolution:

# On Windows (with system proxy or TUN active):
nslookup www.google.com

# Expected result: 198.18.x.x (fake IP)
# If you see a real IP, fake-ip mode is not active

# On Linux/macOS:
dig www.google.com +short

# Expected: 198.18.x.x

Step 3: Check Connection Logs

In Clash Verge Rev, open the Logs panel and observe DNS resolution entries. You should see queries being resolved through the correct nameservers. For detailed guidance on debugging connection issues, see our node connection troubleshooting guide.

Step 4: Test Blocked Domains

Try accessing domains known to be affected by DNS pollution. They should load correctly through the proxy. If they fail, check that the domain is hitting the proxy-server-nameserver or fallback path rather than the default nameserver.

For further optimization, review our guides on rule configuration and advanced Clash Verge Rev tips.

Continue Reading

Clash TUN Mode Guide: Global Transparent Proxy Beginner's Guide to Clash Rule Configuration Clash Node Connection Troubleshooting 10 Clash Verge Rev Tips & Hidden Features