dns_tuning.yaml

All examples
Change addresses, credentials, certificate paths, and other deployment-specific values before use. This is a complete source file, not a guarantee it can run unchanged on your machine. Read its comments for prerequisites, then run shoes check with the adapted file.
# DNS resolver examples
#
# Shows the hickory-backed per-upstream tuning knobs:
# - timeout_secs: overall lookup timeout inside hickory
# - connect_timeout_secs: connection setup timeout for TCP/TLS/HTTPS/H3 upstreams
# - attempts: retry count for failed queries
#
# With no dns field, or a dns field with omitted or empty servers, destination
# lookups use the OS resolver. shoes caches successful results for 60 seconds from
# lookup completion, across ports, with at most 10,000 cached hosts.
# This is an application result-age policy, not a DNS record TTL: OS/getaddrinfo
# lookups do not expose authoritative TTLs and may themselves return OS-cached
# data. Failed and empty results are not cached.
# Concurrent misses share a lookup, up to 1,024 participating callers per resolver.
# Excess callers look up independently; this is not an OS lookup concurrency cap.
# Cancelling the owner makes surviving callers retry. The resolver sets no lookup
# deadline; caller timeouts must bound the retry, which may not finish in time.
# Already-running OS calls cannot be stopped. Expired results are not served on
# refresh failure; expiry during a DNS outage can therefore fail new lookups.
# These defaults leave configured upstream resolvers, raw DNS exchange, and
# bootstrap unchanged.

# Native OS/NSS lookup memoization is separate from hickory tuning and DNS TTLs.
# Omitted listener dns defaults to 60 seconds. Explicit system defaults to no cache.
- dns_group: native-short-cache
  dns_servers:
    - url: system
      native_cache_secs: 15

- dns_group: native-no-cache
  dns_servers:
    - url: system
      native_cache_secs: 0

# Direct DNS group with fast-fail tuning.
- dns_group: tuned-direct-dns
  dns_servers:
    - url: tcp://1.1.1.1
      ip_strategy: ipv4_only
      timeout_secs: 3
      connect_timeout_secs: 1
      attempts: 1
    - url: tls://8.8.8.8
      server_name: dns.google
      ip_strategy: ipv4_only
      timeout_secs: 4
      connect_timeout_secs: 2
      attempts: 1

# HTTP proxy using the tuned direct DNS group.
- address: "127.0.0.1:8080"
  dns:
    servers: tuned-direct-dns
  protocol:
    type: http

# Reusable proxy tunnel for remote DNS resolution.
- client_group: dns-tunnel
  client_proxies:
    - address: "edge.example.com:443"
      protocol:
        type: tls
        sni_hostname: "edge.example.com"
        protocol:
          type: vmess
          cipher: aes-128-gcm
          user_id: "b85798ef-e9dc-46a4-9a87-8da4499d36d0"
          h2mux:
            max_connections: 2
            min_streams: 4
            padding: true

# DNS group that sends queries through the named tunnel.
- dns_group: tuned-proxied-dns
  dns_servers:
    - url: tls://1.1.1.1
      server_name: cloudflare-dns.com
      client_chain: dns-tunnel
      ip_strategy: ipv4_only
      timeout_secs: 4
      connect_timeout_secs: 2
      attempts: 1
    - url: tcp://8.8.8.8
      client_chain: dns-tunnel
      ip_strategy: ipv4_only
      timeout_secs: 3
      connect_timeout_secs: 1
      attempts: 1

# SOCKS5 proxy using the proxied DNS group and the same tunnel for traffic.
- address: "127.0.0.1:1080"
  dns:
    servers: tuned-proxied-dns
  protocol:
    type: socks
    udp_enabled: true
  rules:
    - masks: "0.0.0.0/0"
      action: allow
      client_chain: dns-tunnel
View source at this revision