DNS Server

Structure

{
  "dns": {
    "servers": [
      {
        "type": "",
        "tag": "",
        "oixcloud": false
      }
    ]
  }
}

type

The type of the DNS server.

Type	Format
empty (default)	Legacy
`local`	Local
`hosts`	Hosts
`tcp`	TCP
`udp`	UDP
`tls`	TLS
`quic`	QUIC
`https`	HTTPS
`h3`	HTTP/3
`dhcp`	DHCP
`mdns`	mDNS
`fakeip`	Fake IP
`tailscale`	Tailscale
`openconnect`	OpenConnect
`openvpn`	OpenVPN
`resolved`	Resolved

tag

The tag of the DNS server.

oixcloud

Enable oixCloud DNS query authentication for remote DNS server types: udp, tcp, tls, https, quic, and h3.

When enabled, sing-box signs every queried domain with the Ed25519 private key embedded at build time and a fixed 300-second time window. The signature is encoded as two lowercase Base32 labels prepended to the query name. Matching names in the response are restored before the response is returned to the DNS client.

This option authenticates queries but does not encrypt DNS packets. Use tls, https, quic, or h3 when transport confidentiality is also required.

The build must contain a valid oixCloud DNS auth private key. Server initialization fails if the key is missing or invalid, and queries that cannot form a valid signed DNS name fail without being sent unsigned.

See Build from source for key injection instructions.