DNS

Generated by website/scripts/build-config.mjs; do not edit. It reads sail’s configuration types (its Rust source), sing-box’s field registry (sail/src/config/singbox/fields.json, sing-box v1.14.2) and the tiers the registry test measured (fields.tiers.json). Change the source comments or those files, then run npm run docs:config in website/.

• Status: each sing-box field as the registry test measured it: Supported (read and acted on; a value sail cannot take is still an error), Warned (dropped with a warning) or Error (the configuration is refused), with the reason; sail extension marks fields and types sing-box does not have.
• Type: sing-box’s JSON type for its fields; from sail’s Rust definitions for extensions.
• Default: from sail’s serde declarations; unset means the field may be left out, and the description says what applies then. Only fields sail reads have one.
• Description: sail’s source comments, in their source language; for an extension without one, the registry test’s note.
• Build: the cfg conditions in the Rust source (Cargo features and platforms).

Validate a configuration with sail -c config.json -T. Editors check and complete it by the JSON schema: put "$schema": "https://peakpassvpn.github.io/sail/schema.json" at its top (made by the same generator; a field sail refuses is marked not allowed, one it warns of deprecated). The Clash and Surge support tables are under Compatibility.

dns

Rust: Dns

Field	Type	Default	Status	Description
servers	array → [], [dhcp], [fakeip], [h3], [hosts], [https], [local], [mdns], [openconnect], [openvpn], [quic], [race], [resolved], [sequential], [tailscale], [tcp], [tls], [udp]	[]	Supported	The servers, each by its tag. None is the system’s resolver alone.
rules	array → [], [action=evaluate], [action=predefined], [action=reject], [action=respond], [action=route], [action=route-options], [logical]	[]	Supported	Which server a query goes to, matched in order.
final	string	unset	Supported	The server of the queries no rule matches; the first one when unset.
reverse_mapping	bool	false	Supported	Remembers the domain of each address the DNS answers that pass through carry, so that connections to the address are routed by the domain.
strategy	string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	prefer_ipv4	Supported	Which address families names resolve to, and in what order.
timeout	duration	unset	Supported	How long one query to one server may take; 10s when unset, as in sing-box.
disable_cache	bool	false	Supported	No answer is kept: each query goes to its server.
disable_expire	bool	false	Supported	Answers kept are used however old they are, until the cache is full or cleared.
cache_capacity	number	unset	Supported	How many answers are kept; 1024 when unset, and at least that, as in sing-box.
optimistic	bool|object → object	unset	Supported	An answer that has expired is still given, for up to its timeout, while the server is asked again in the background.
client_subnet	string	unset	Supported	The EDNS Client Subnet each query carries, unless a rule says otherwise.
independent_cache	bool	—	Warned: Each server’s answers are kept apart, always: what this asks for (deprecated in sing-box)	—
client_strategy	string, one of prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	unset	sail extension	A sail extension: the address families the answers to clients’ queries (hijack-dns, a DNS listener) carry, besides what strategy and the rules leave out: a family either leaves out is answered with no records. The instance’s own lookups keep strategy. As Mihomo’s dns.ipv6: false answers clients, while its connections still resolve IPv6.

dns.optimistic

Rust: Optimistic

Field	Type	Default	Status	Description
enabled	bool	required	Supported	—
timeout	duration	unset	Supported	How long after it expired an answer may still be given; 3d when unset, as in sing-box.

dns.servers[]

Rust: DnsServer

Field	Type	Default	Status	Description
type	string, one of dhcp, fakeip, h3, hosts, https, local, mdns, openconnect, openvpn, quic, resolved, tailscale, tcp, tls, udp	required	Supported	udp, tcp, tls, https, quic, h3, local, hosts, or sail’s race and sequential.

dns.servers[fakeip]

Rust: FakeIpOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
inet4_range	string	unset	Supported	—
inet6_range	string	unset	Supported	—

dns.servers[h3]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
tls	object → object	unset	Supported	tls, https, quic and h3.
path	string	unset	Supported	https and h3.
method	string	unset	Supported	https and h3: POST, the default, or GET (RFC 8484 §4.1).
headers	map	{}	Supported	https and h3: sent with each request; a Host one is the host the requests name.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.

dns.servers[h3].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	—	Error: A h3 server offers its own	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Warned: Only for fragmenting the TLS handshake, which sail does not do	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	—	Error: Not for a dns server	—
utls	object → object	—	Error: Not for a h3 server	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

dns.servers[h3].tls.utls

Rust: OutboundUtls

Field	Type	Default	Status	Description
enabled	bool	—	Error: Not for a h3 server	—
fingerprint	string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized	—	Error: Not for a h3 server	—

dns.servers[hosts]

Rust: HostsOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
path	listable-string	[]	Supported	Files in the hosts format; the system’s own when neither these nor predefined are given.
predefined	map	{}	Supported	Names, and their addresses. A sail extension, as Mihomo’s hosts has it: a name may be a pattern, +.a for a and the names under it, .a for those under it alone, a * label for any one label; and it may be given another name, whose addresses it takes.

dns.servers[https]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
tls	object → object	unset	Supported	tls, https, quic and h3.
path	string	unset	Supported	https and h3.
method	string	unset	Supported	https and h3: POST, the default, or GET (RFC 8484 §4.1).
headers	map	{}	Supported	https and h3: sent with each request; a Host one is the host the requests name.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.
prefer_h3	bool	false	sail extension	https: a sail extension, as Mihomo’s prefer-h3: queries go over HTTP/3 beside HTTP/2, and over HTTP/3 alone once it answers; over HTTP/2 for a while once it fails.

dns.servers[https].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	—	Error: A https server offers its own	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Warned: Only for fragmenting the TLS handshake, which sail does not do	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	—	Error: Not for a dns server	—
utls	object → object	unset	Supported	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

dns.servers[local]

Rust: LocalOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
prefer_go	bool	—	Warned: Go’s own resolver rather than the system’s: sail is not Go	—
neighbor_domain	listable-string	[]	Supported	Suffixes, each starting with ., of the single-label names the LAN devices’ addresses answer for, as sing-box’s local server has them; . for bare single-label names.
domain_strategy	string	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.

dns.servers[local].domain_resolver

Rust: DomainResolver

Field	Type	Default	Status	Description
server	string	required	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
timeout	duration	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
strategy	string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
disable_cache	bool	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
disable_optimistic_cache	bool	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
rewrite_ttl	number	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—
client_subnet	string	—	Warned: A local server’s servers are the system’s, addresses: it has no name to resolve	—

dns.servers[mdns]

Rust: MdnsOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
bind_interface	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
inet4_bind_address	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
inet6_bind_address	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
bind_address_no_port	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
protect_path	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
routing_mark	number|string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
reuse_addr	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
netns	string	—	Error: Linux network namespaces: sockets would leave another way	—
connect_timeout	duration	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
tcp_fast_open	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	—
disable_tcp_keep_alive	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
tcp_keep_alive	duration	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
tcp_keep_alive_interval	duration	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
udp_fragment	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
domain_resolver	string|object → object	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	—
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	—
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	—
fallback_delay	duration	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
prefer_go	bool	—	Warned: Go’s own resolver rather than the system’s: sail is not Go	—
neighbor_domain	listable-string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
interface	listable-string	[]	Supported	The interfaces to ask on; all that are up and take multicast when none are named.
domain_strategy	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing (deprecated in sing-box)	—

dns.servers[mdns].domain_resolver

Field	Type	Default	Status	Description
server	string	required	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
timeout	duration	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
strategy	string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
disable_cache	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
disable_optimistic_cache	bool	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
rewrite_ttl	number	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—
client_subnet	string	—	Warned: An mDNS server asks on each interface itself, as sing-box’s, which dials nothing	—

dns.servers[quic]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
tls	object → object	unset	Supported	tls, https, quic and h3.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.

dns.servers[quic].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	—	Error: A quic server offers its own	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Warned: Only for fragmenting the TLS handshake, which sail does not do	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	—	Error: Not for a dns server	—
utls	object → object	—	Error: Not for a quic server	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

dns.servers[quic].tls.utls

Rust: OutboundUtls

Field	Type	Default	Status	Description
enabled	bool	—	Error: Not for a quic server	—
fingerprint	string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized	—	Error: Not for a quic server	—

dns.servers[race]

Rust: RaceOptions · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
servers	string or array of string	required	sail extension	A server that asks its members at once and takes the first good answer

dns.servers[sequential]

Rust: SequentialOptions · sail extension

Field	Type	Default	Status	Description
tag	string	""	sail extension	Defaults to the type.
servers	string or array of string	required	sail extension	The servers, by tag, in the order they are asked; two or more, none a race or sequential server. The next is asked only when one gives no answer at all (a timeout, a connection that fails); any answer, SERVFAIL and REFUSED too, ends the query, unlike race, which takes those for failures: asked in order, a server’s plain answer is not to be passed on to the next. Each goes out as its own detour says.
attempt_timeout	duration	unset	sail extension	How long each server has to answer; the last has what the budget leaves. A kept connection that does not answer in half of it is left for a new one to the same server, with the whole time again, once a query. 3s when unset.
budget	duration	unset	sail extension	How long a whole query may take, under dns.timeout; once it is spent the query fails, and a client is answered SERVFAIL. 8s when unset.
prefer_for	duration	unset	sail extension	How long a server that answered, not being the first, is asked first (the next ones after it in turn); 0s keeps the order. 10m when unset.

dns.servers[tcp]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.

dns.servers[tls]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
tls	object → object	unset	Supported	tls, https, quic and h3.
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.

dns.servers[tls].tls

Rust: OutboundTls

Field	Type	Default	Status	Description
enabled	bool	false	Supported	—
engine	string, one of go, apple, windows	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
disable_sni	bool	false	Supported	Sends no SNI. The certificate is still verified against server_name, unless insecure.
server_name	string	unset	Supported	Defaults to the server’s address.
insecure	bool	false	Supported	—
alpn	listable-string	—	Error: A tls server offers its own	—
min_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2.
max_version	string, one of 1.0, 1.1, 1.2, 1.3	unset	Supported	The highest; unset, 1.3.
cipher_suites	listable-string	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
curve_preferences	listable-string, one of P256, P384, P521, X25519, X25519MLKEM768	—	Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked	—
certificate	listable-string	unset	Supported	An inline PEM certificate to trust.
certificate_path	string	unset	Supported	A PEM certificate to trust, by path.
certificate_public_key_sha256	listable-string|array	unset	Supported	The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure.
client_certificate	listable-string	unset	Supported	An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key.
client_certificate_path	string	unset	Supported	client_certificate, by path.
client_key	listable-string	unset	Supported	The inline PEM key of the client certificate.
client_key_path	string	unset	Supported	client_key, by path.
fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
fragment_fallback_delay	duration	—	Warned: Only for fragmenting the TLS handshake, which sail does not do	—
record_fragment	bool	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof	string	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
spoof_method	string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp	—	Error: Fragmenting or spoofing the TLS handshake against censorship	—
kernel_tx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
kernel_rx	bool	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
handshake_timeout	duration	—	Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them	—
ech	object → object	—	Error: Not for a dns server	—
utls	object → object	unset	Supported	The browser the ClientHello imitates. Unset, it is Chrome’s.
reality	object → object	unset	Supported	—
certificate_sha256	string or array of string	unset	sail extension	sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough.

dns.servers[udp]

Rust: RemoteOptions

Field	Type	Default	Status	Description
tag	string	""	Supported	Defaults to the type.
detour	string	unset	Supported	The outbound to dial through, in place of a socket of its own.
bind_interface	string	unset	Supported	The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well.
inet4_bind_address	string	unset	Supported	The local address for IPv4 destinations, loopback ones aside: as bind_interface.
inet6_bind_address	string	unset	Supported	The local address for IPv6 destinations, loopback ones aside: as bind_interface.
bind_address_no_port	bool	false	Supported	IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only.
protect_path	string	unset	Supported	A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only.
routing_mark	number|string	unset	Supported	SO_MARK, Linux only.
reuse_addr	bool	false	Supported	SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets.
netns	string	—	Error: Linux network namespaces: sockets would leave another way	Not implemented yet.
connect_timeout	duration	unset	Supported	How long a TCP connect to one address may take; 5s when unset.
tcp_fast_open	bool	false	Supported	TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced.
tcp_multi_path	bool	—	Warned: Socket tuning: connections go the same way without it	Not implemented yet.
disable_tcp_keep_alive	bool	false	Supported	No TCP keepalive at all.
tcp_keep_alive	duration	unset	Supported	How long a TCP connection is idle before keepalive probes it; 5m when unset.
tcp_keep_alive_interval	duration	unset	Supported	Between keepalive probes; 75s when unset.
udp_fragment	bool	unset	Supported	Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default.
domain_resolver	string|object → object	unset	Supported	The DNS server that resolves the names dialled.
network_strategy	string, one of default, fallback, hybrid	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces).
network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types of interface the strategy goes out of first.
fallback_network_type	listable-string, one of cellular, ethernet, other, wifi	—	Error: Choosing among the host’s networks (Wi-Fi, cellular) here: it would go out as the route’s defaults say	The types it falls back to, with fallback.
fallback_delay	duration	unset	Supported	How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset.
server	string	unset	Supported	—
server_port	number	unset	Supported	—
domain_strategy	string	unset	Supported (deprecated in sing-box)	sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before.
respect_rules	bool	false	sail extension	A sail extension, as Mihomo’s respect-rules: the connections go through the outbound the routing rules pick for them, as for a connection from the inbound dnsclient to the server, its domain known.
client_subnet	object → object	unset	sail extension	A sail extension: the EDNS Client Subnet its queries carry, over any they have, as Mihomo’s ecs with ecs-override.

dns.rules[]

Rust: DnsRule

Field	Type	Default	Status	Description
type	string, one of default, logical	default	Supported	default, or logical.
inbound	listable-string	[]	Supported	Tags of the inbounds the connection that needs the name came in through.
ip_version	number, one of 4, 6	unset	Supported	—
query_type	listable-number|string	[]	Supported	Record types, by name (A, AAAA, HTTPS) or number.
query_client_subnet	listable-string	—	Error: A condition sail does not match: the rule would match otherwise	—
query_dnssec	bool	—	Error: A condition sail does not match: the rule would match otherwise	—
network	listable-string, one of tcp, udp	[]	Supported	—
auth_user	listable-string	[]	Supported	Names of the users an inbound authenticated.
protocol	listable-string, one of tls, http, quic, dns, stun, bittorrent, dtls, ssh, rdp, ntp	[]	Supported	—
domain	listable-string	[]	Supported	—
domain_suffix	listable-string	[]	Supported	—
domain_keyword	listable-string	[]	Supported	—
domain_regex	listable-string	[]	Supported	—
source_ip_cidr	listable-string	[]	Supported	—
source_ip_is_private	bool	false	Supported	—
source_port	listable-number	[]	Supported	—
source_port_range	listable-string	[]	Supported	—
port	listable-number	[]	Supported	—
port_range	listable-string	[]	Supported	—
process_name	listable-string	[]	Supported	—
process_path	listable-string	[]	Supported	—
process_path_regex	listable-string	[]	Supported	—
package_name	listable-string	[]	Supported	—
package_name_regex	listable-string	[]	Supported	—
user	listable-string	[]	Supported	—
user_id	listable-number	[]	Supported	—
clash_mode	string	unset	Supported	The mode of Clash’s API, as in a routing rule.
network_type	listable-string, one of cellular, ethernet, other, wifi	[]	Supported	The kind of network: wifi, cellular, ethernet, other.
network_is_expensive	bool	false	Supported	The network is metered, as the system says.
network_is_constrained	bool	false	Supported	The network is in a low data mode, as the system says.
wifi_ssid	listable-string	[]	Supported	The network the host is on, as the routing rules match it.
wifi_bssid	listable-string	[]	Supported	The address of the Wi-Fi access point, aa:bb:cc:dd:ee:ff, in any case, with : or -, or as 12 hex digits.
interface_address	map	—	Error: A condition sail does not match: the rule would match otherwise	—
network_interface_address	map	—	Error: A condition sail does not match: the rule would match otherwise	—
default_interface_address	listable-string	—	Error: A condition sail does not match: the rule would match otherwise	—
source_mac_address	listable-string	[]	Supported	MAC addresses of the LAN device the query comes from, as the neighbor table and DHCP leases know it.
source_hostname	listable-string	[]	Supported	Host names of the LAN device the query comes from, as its DHCP lease has it.
preferred_by	listable-string	[]	Supported	Tags of DNS servers: matches a name one of them prefers, one it answers for itself, as sing-box’s preferred_by.
rule_set	listable-string	[]	Supported	Tags of rule-sets, any of whose rules matching matches. Their ip_cidr rules match no query, which has no address yet.
rule_set_ip_cidr_match_source	bool	false	Supported	The rule-sets’ ip_cidr match the source address.
match_response	bool|string	unset	Supported	The response of an evaluate rule before it, which the rule then matches: its addresses are what ip_cidr, ip_is_private, ip_accept_any and the rule-sets’ ip_cidr match. With none, the rule matches only inverted.
ip_cidr	listable-string	[]	Supported	—
ip_is_private	bool	false	Supported	—
ip_accept_any	bool	false	Supported	The response has an address.
response_rcode	number|string	unset	Supported	—
response_answer	listable-string	[]	Supported	Records the response has among its answers, as answer writes them: any of them.
response_ns	listable-string	[]	Supported	Records the response has among its name servers.
response_extra	listable-string	[]	Supported	Records the response has among its additional records.
invert	bool	false	Supported	—
outbound	listable-string	[]	Supported (deprecated in sing-box)	Tags of the outbounds that dial the name; of the rule itself, not of a rule a logical one combines.
rule_set_ip_cidr_accept_empty	bool	—	Error: A condition sail does not match: the rule would match otherwise (deprecated in sing-box)	—
action	string, one of route, evaluate, respond, route-options, reject, predefined	unset	Supported	route when unset.
geosite	string or array of string	[]	sail extension	A sail extension, as in a routing rule.
external	string or array of string	[]	sail extension	A sail extension, as in a routing rule: site:<file>:<code>.
process_name_regex	string or array of string	[]	sail extension	A sail extension, as Mihomo’s PROCESS-NAME-REGEX: regular expressions the program’s name, its path’s last part, matches.
wifi_ssid_regex	string or array of string	[]	sail extension	A sail extension, for Surge’s SSID:: regular expressions found in the Wi-Fi network’s name, with case.
wifi_bssid_regex	string or array of string	[]	sail extension	A sail extension, for Surge’s BSSID:: regular expressions found in the access point’s address as aa:bb:cc:dd:ee:ff, whatever the case.
network_gateway	string or array of string	[]	sail extension	A sail extension, for Surge’s ROUTER:: the address of the default gateway.
network_mcc_mnc	string or array of string	[]	sail extension	A sail extension, for Surge’s MCCMNC: and CELLULAR-CARRIER: the cellular carrier, its MCC and MNC as 5 or 6 digits; only off Wi-Fi.
ip_match_all	bool	false	sail extension	A sail extension: the rule’s conditions on the response’s addresses hold for every one of them, rather than for any; a response without one they hold for none. Mihomo’s fallback filter keeps an answer so.

dns.rules[action=evaluate]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.
server	string	unset	Supported	route: the server a matching query goes to.
tag	string	unset	Supported	evaluate: the name of its response, which match_response gives.
speculative	bool	false	Supported	route and evaluate: the query is sent as soon as the rule matches, while race rules before it are still pending, rather than once none of them matched; its response is used only then.
timeout	duration	unset	Supported	How long the query may take, instead of dns.timeout.
disable_cache	bool	false	Supported	route, evaluate and route-options: the query neither comes from the cache nor goes into it.
disable_optimistic_cache	bool	false	Supported	An expired answer is not given while it is asked for again, though dns.optimistic is enabled.
rewrite_ttl	number	unset	Supported	The TTL the answer’s records carry, in seconds.
client_subnet	string	unset	Supported	The EDNS Client Subnet the query carries, instead of dns.client_subnet.
remove_client_subnet	bool	false	Supported	The query carries no EDNS Client Subnet, whatever it or dns.client_subnet has.
strategy	string	unset	Supported (deprecated in sing-box)	route: the address families, instead of dns.strategy.

dns.rules[action=predefined]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.
rcode	number|string	unset	Supported	predefined: the code of the answer, NOERROR when unset.
answer	listable-string	[]	Supported	predefined: the answer’s records, as a zone file writes them (localhost. IN A 127.0.0.1, TTL 3600 unless given), or the base64 of their wire form; one named *.suffix. takes the name asked for when it ends so.
ns	listable-string	[]	Supported	predefined: its name server records.
extra	listable-string	[]	Supported	predefined: its additional records.

dns.rules[action=reject]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.
method	string, one of default, drop, reply	—	Warned: How a rejected query is answered: it is rejected all the same	—
no_drop	bool	—	Warned: How a rejected query is answered: it is rejected all the same	—

dns.rules[action=respond]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.

dns.rules[action=route]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.
server	string	unset	Supported	route: the server a matching query goes to.
speculative	bool	false	Supported	route and evaluate: the query is sent as soon as the rule matches, while race rules before it are still pending, rather than once none of them matched; its response is used only then.
timeout	duration	unset	Supported	How long the query may take, instead of dns.timeout.
disable_cache	bool	false	Supported	route, evaluate and route-options: the query neither comes from the cache nor goes into it.
disable_optimistic_cache	bool	false	Supported	An expired answer is not given while it is asked for again, though dns.optimistic is enabled.
rewrite_ttl	number	unset	Supported	The TTL the answer’s records carry, in seconds.
client_subnet	string	unset	Supported	The EDNS Client Subnet the query carries, instead of dns.client_subnet.
remove_client_subnet	bool	false	Supported	The query carries no EDNS Client Subnet, whatever it or dns.client_subnet has.
strategy	string	unset	Supported (deprecated in sing-box)	route: the address families, instead of dns.strategy.

dns.rules[action=route-options]

Rust: DnsRule

Field	Type	Default	Status	Description
race	bool	false	Supported	route, respond, reject and predefined, on a response: the rules after it are matched while its responses are still coming, and the first race rule to match, once they have, decides; the others’ actions wait until none of the race rules before them matched. As sing-box 1.14’s.
timeout	duration	unset	Supported	How long the query may take, instead of dns.timeout.
disable_cache	bool	false	Supported	route, evaluate and route-options: the query neither comes from the cache nor goes into it.
disable_optimistic_cache	bool	false	Supported	An expired answer is not given while it is asked for again, though dns.optimistic is enabled.
rewrite_ttl	number	unset	Supported	The TTL the answer’s records carry, in seconds.
client_subnet	string	unset	Supported	The EDNS Client Subnet the query carries, instead of dns.client_subnet.
remove_client_subnet	bool	false	Supported	The query carries no EDNS Client Subnet, whatever it or dns.client_subnet has.
strategy	string	unset	Supported (deprecated in sing-box)	route: the address families, instead of dns.strategy.

dns.rules[logical]

Rust: DnsRule

Field	Type	Default	Status	Description
mode	string, one of and, or	unset	Supported	logical: and or or.
rules	array	[]	Supported	logical: the rules combined.
invert	bool	false	Supported	—

Types sail does not implement: dns.servers

Type	Status	Fields
dns.servers[dhcp]	Error: A type or value sail does not implement: it would route otherwise	33
dns.servers[openconnect]	Error: A type or value sail does not implement: it would route otherwise	4
dns.servers[openvpn]	Error: A type or value sail does not implement: it would route otherwise	4
dns.servers[resolved]	Error: A type or value sail does not implement: it would route otherwise	3
dns.servers[tailscale]	Error: A type or value sail does not implement: it would route otherwise	4