sing-box Custom DNS

Step 1. Open sing-box Custom DNS tab

1. In DNS Settings window click the sing-box Custom DNS tab
2. Enable Enable Custom DNS toggle (if not already on)

sing-box Custom DNS with two empty fields

Step 2. Paste configuration into BOTH fields

The tab has two text fields:

• HTTP/SOCKS — used when sing-box operates in proxy mode
• Tun Mode settings — used when sing-box operates in TUN mode

Paste into both fields

The same configuration goes into both fields.

sing-box DNS JSON — click to expand and copy

sing-box-dns.json

{
  "servers": [
    {
      "tag": "quad9-doh",
      "type": "https",
      "server": "9.9.9.9",
      "server_port": 443,
      "path": "/dns-query",
      "headers": {
        "Host": "dns.quad9.net"
      },
      "tls": {
        "enabled": true,
        "server_name": "dns.quad9.net",
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "detour": "proxy"
    }
  ],
  "rules": [
    {
      "rule_set": [
        "geosite-category-ads-all",
        "geosite-win-spy"
      ],
      "action": "predefined",
      "rcode": "NXDOMAIN"
    }
  ],
  "final": "quad9-doh",
  "strategy": "ipv4_only",
  "cache_capacity": 8192,
  "independent_cache": false
}

Step 3. Set strategy and DNS address

1. At the bottom, set Default domain strategy for outbound: prefer_ipv4
2. Set Outbound DNS address: dhcp://auto
3. Click Confirm

Configuration in both fields, strategy and DNS address set

---

Parameter explanations

DNS server (Quad9 DoH)

server: "9.9.9.9" — connects directly by IP. Elegant DNS loop solution: no need to resolve a hostname, so no bootstrap chain required.

headers: { "Host": "dns.quad9.net" } — HTTP Host header. Since we connect by IP, the server needs this to know which service we want.

tls.server_name — SNI for TLS handshake + certificate validation. Ensures the connection is to the real Quad9, not an impostor.

utls.fingerprint: "chrome" — mimics Chrome's TLS fingerprint. Makes DNS traffic indistinguishable from normal browsing for DPI systems.

detour: "proxy" — DNS queries go through the proxy tunnel. ISP sees nothing.

DNS rule: block ads and telemetry

rcode: "NXDOMAIN" — for ad domains and Windows telemetry, sing-box instantly responds "domain doesn't exist." No real DNS query, no ads, no telemetry.

---

Done!

Click Confirm in DNS Settings — saves both tabs at once.

Restart connection: Ctrl+R

Verification →