Updated July 2026 · 6 min read
DNS settings and troubleshooting
A name resolution problem looks a lot like a broken node: pages will not open, certificates complain, requests land somewhere they should not. This guide covers proving it really is DNS, and what to set on the client side.
First prove it really is DNS
The classic signal is that a raw IP address connects while the domain name does not, or the name resolves but to an address that is obviously wrong: you land on a carrier notice page, or the connection is reset the moment it opens.
To be more certain, run nslookup against two different DNS servers for the same domain and compare the answers. Worth knowing: under TUN with Fake-IP, a placeholder address starting with 198.18 is expected behaviour, not poisoning.
The DNS override switch
Clash settings has a master DNS switch that decides whether the core handles name resolution at all. With it off, resolution stays with the system and the core only sees addresses. With it on, every lookup follows the configuration you set here.
Under TUN this switch has to be on. The adapter has taken the traffic, but if resolution stays with the system, the core receives whatever the system resolved, routing decisions go wrong and poisoned domains stay poisoned. Choosing between Fake-IP and Redir-Host, and when to enable sniffing, each have their own guide and are not covered here.
Before you debug DNS, switch off the secure DNS inside your browser and any encrypted DNS on the system adapter. Leave those two on and nothing you change in the client will show an effect.
What nameserver and fallback are for
nameserver is the default set of resolvers, and nearby directly reachable servers belong here. Local sites depend on it to resolve to a nearby CDN edge; resolve them from abroad instead and you get pointed at a distant data centre, which only makes things slower.
fallback holds encrypted resolvers outside your region, and its queries go out through the proxy, so the answers are hard to tamper with. fallback-filter decides when that answer wins: by default, if the nameserver result lands in a domestic IP range it is kept, otherwise the fallback result is used.
Three DNS layers make debugging pointless
Browsers now ship their own secure DNS — that is the name in Chrome and Edge, Firefox calls it DNS over HTTPS — Windows can set encrypted DNS on the adapter, and the client adds a third. One domain can end up resolved in three separate places.
In that state the browser ignores whatever you change in the client, because it never handed the lookup over. Turn secure DNS off in the browser, confirm the adapter has no encrypted DNS configured, and leave only the client layer. Change one thing, look at the result, and the cause becomes findable.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.