DNS configuration
Hako keeps DNS enabled inside Apple Packet Tunnel and routes TUN-hijacked queries into mihomo's resolver. Fake IP, DoH, DoT, policy resolution, fallback, hosts, and caches are handled by the core.
Practical guidance
- Override
nameserveronly for a concrete need. A resolver can observe your queries, so use one you trust. - Desktop-dependent
system:anddhcp:sources may be removed or repaired. dns.listenopens a local service and is an advanced feature. Never expose it throughallow-lanwithout explicit access control.- Resolver URLs, request headers, and authentication are sensitive data.
31 fields shown
| Field | Type | iOS | macOS | tvOS | Platform notes |
|---|---|---|---|---|---|
dns.cache-algorithm | string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.cache-max-size | int | Supported | Supported | Supported | Consumed by the Hako core. |
dns.default-nameserver | []string | Managed / limited | Managed / limited | Managed / limited | Accepted, but Hako may force, repair, split, or replace the value for Apple networking. |
dns.direct-nameserver | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.direct-nameserver-follow-policy | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.enable | bool | Managed / limited | Managed / limited | Managed / limited | Accepted, but Hako may force, repair, split, or replace the value for Apple networking. |
dns.enhanced-mode | C.DNSMode | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fake-ip-filter | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fake-ip-filter-mode | C.FilterMode | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fake-ip-range | string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fake-ip-range6 | string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fake-ip-ttl | int | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-filter.domain | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-filter.geoip | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-filter.geoip-code | string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-filter.geosite | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-filter.ipcidr | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.fallback-lazy-query | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.ipv6 | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.ipv6-timeout | uint | Supported | Supported | Supported | Consumed by the Hako core. |
dns.listen | string | Advanced | Advanced | Advanced | Can expose a listener or control surface. Use only with explicit access control and strong credentials. |
dns.listen-routing-mark | int | Unsupported | Unsupported | Unsupported | Removed or not consumed in the Apple Packet Tunnel runtime. |
dns.nameserver | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.nameserver-policy | *orderedmap.OrderedMap[string, any] | Supported | Supported | Supported | Consumed by the Hako core. |
dns.prefer-h3 | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.proxy-server-nameserver | []string | Supported | Supported | Supported | Consumed by the Hako core. |
dns.proxy-server-nameserver-policy | *orderedmap.OrderedMap[string, any] | Supported | Supported | Supported | Consumed by the Hako core. |
dns.respect-rules | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.use-hosts | bool | Supported | Supported | Supported | Consumed by the Hako core. |
dns.use-system-hosts | bool | Supported | Supported | Supported | Consumed by the Hako core. |