UDP DNS Leak
Theoretically, when enabled fake-ip mode in DNS settings when using mihomo core, the request with domain name matching the proxy rule will NOT trigger DNS request in local machine. So we may want to set our DNS config to use system for nameserver and expect only requests that not hit any proxy rule will trigger DNS request locally, which is quite safe, because in this case we could largely assume these requests’ destination is domestic target (otherwise they will hit some proxy rules and there will be no local DNS query at all).
Now let’s check it out, we set system as the first DNS server in nameserver and access google.com.
dns:
nameserver:
- 'system'
# other configs
If we check our log at this point, we may find out there are DNS queries to account.google.com using system DNS! Actually, this is because the premise above doesn’t hold when the original request is using UDP protocol as stated in this GitHub issue.
What Will Trigger DNS Query
As mentioned above, a UDP request may trigger local DNS queries even when using fake-ip, also, IP rules like IP-CIDR or GEOIP may also trigger a DNS request without no-resolve.
So the best practice is to add no-resolve to those rules that don’t require name resolution.
How to Avoid
The official document contain a flowchart describing how DNS process work. Based on that chart, the best way to prevent a leak is to set direct-nameserver to use system DNS server, then use “safe” DNS server in nameserver settings:
dns:
direct-nameserver:
- 'system'
nameserver:
- 'https://dns.alidns.com/dns-query'
By using this config, only domain match to DIRECT outbound will use the system as DNS server, all other requests will use the DNS server list defined by nameserver, which does not have any “unsafe” DNS server.
Notes
Here, “safe” and “unsafe” actually means if it’s ok to use that DNS server to resolve your domain IP address even if you want to proxy your request over that domain.
If you use “unsafe” DNS server to resolve that request, it will know that you are accessing that website even if the communication is encrypted.