3x-ui-agent/docs/xray-dns.md

Xray DNS presets and leak notes

The panel DNS preset menu supports plain DNS, DoH, and DoQ server entries accepted by Xray's built-in DNS config. These notes follow Xray's DNS server address forms documented in https://xtls.github.io/en/config/dns.html.

• Plain DNS uses UDP/53 and follows routing unless a local-mode scheme is used. It is easy to observe on the server network path.
• DoH uses https://.../dns-query and goes through Xray routing.
• DoQ uses quic+local://... in Xray. Local mode bypasses Xray routing and connects directly through Freedom, which avoids DNS routing loops but can reveal resolver traffic from the server IP.
• Xray DNS does not have a direct DoT URL scheme. Use DoH/DoQ, or wrap DNS-over-TCP/TLS outside this DNS config if DoT is required.

Leak-prone settings:

• localhost uses the host resolver and is outside Xray control.
• tcp+local://, https+local://, and quic+local:// bypass Xray routing by design.
• Domain resolver names can need system DNS in local mode unless pinned in hosts.
• disableFallback: false or enableParallelQuery: true can query fallback servers and reveal domains to more than one provider.
• clientIp sends EDNS Client Subnet data upstream.
• Plain IP/UDP DNS presets are not encrypted.

For privacy-sensitive setups, prefer DoH through routed outbounds, add hosts pins for resolver hostnames, set disableFallback or skipFallback where fallback is not wanted, and keep clientIp empty.