DNS settings explained
The core ships a full DNS module handling resolution and leak prevention. The defaults suit almost everyone; this guide explains what the options mean so you can adjust confidently.
Core concepts
The default fake-ip mode answers domain queries with a virtual IP from a reserved range, mapped back to the real target on forwarding — dramatically lowering resolution latency and defeating DNS poisoning. Apps with compatibility trouble can use redir-host mode instead. The nameserver entries are the regular resolvers; DoH endpoints (e.g. https://1.1.1.1/dns-query) are recommended so resolution is encrypted.
Common adjustments
- Settings has a “DNS Overwrite” toggle: when on, the client’s built-in DNS config replaces the subscription’s DNS section.
- If LAN devices (printers, NAS) become unreachable, add the relevant domains or ranges to the fake-ip filter list.
- Suspect a DNS leak? Verify with a DNS leak test site in your browser.