Updated September 7, 2026
DNS settings and troubleshooting
A name resolution problem looks a lot like a broken node: pages will not open, certificates complain, requests land somewhere they should not. This guide covers proving it really is DNS, and what to set on the client side.
First prove it really is DNS
The classic signal is that a raw IP address connects while the domain name does not, or the name resolves but to an address that is obviously wrong: you land on a carrier notice page, or the connection is reset the moment it opens.
To be more certain, run nslookup against two different DNS servers for the same domain and compare the answers. Worth knowing: under TUN with Fake-IP, a placeholder address starting with 198.18 is expected behaviour, not poisoning.
The DNS override switch
The client’s DNS override changes the DNS configuration passed to the core; distinguish it from the core setting dns.enable. Check your client version and effective configuration rather than inferring every resolution path from one interface switch.
With TUN, check DNS capture and routing in the effective configuration. Establish a working connection with defaults before making one change at a time and checking logs. Individual applications may also use their own encrypted DNS.
Record the browser, system and client settings before testing. Change one item at a time, compare logs and connectivity, then restore it or retain the change supported by your results.
What nameserver and fallback are for
nameserver is the default resolver list, while settings such as nameserver-policy can affect which resolvers are used. Choose trusted, reachable services and compare resolution results with actual connectivity.
fallback defines backup resolvers. fallback-filter and related settings determine which answers are used. An overseas or encrypted DNS endpoint does not automatically use a proxy; check respect-rules, any explicitly selected proxy and the active routing configuration.
Three DNS layers make debugging pointless
Browsers, the operating system and the client can each configure DNS. First determine which layer resolves the current request instead of changing every switch together.
For a controlled comparison, temporarily adjust browser secure DNS or system DNS, record the original values and restore the settings you need afterwards. Change one item at a time and compare logs, answers and connectivity. Encrypted DNS does not necessarily make every client setting ineffective.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.