Skip to content

[Bug] 使用 Mosdns 情况下 DNS 解析错误 #2031

New issue
New issue
Closed
Closed
[Bug] 使用 Mosdns 情况下 DNS 解析错误#2031
Labels
bugSomething isn't working
@CHANTXU64

Description

@CHANTXU64
CHANTXU64
opened on May 12, 2025

验证步骤

  • 我已经阅读了 文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
  • 我仔细看过 文档 并未解决问题
  • 我已在 Issue Tracker 中寻找过我要提出的问题，并且没有找到
  • 我是中文用户，而非其他语言用户
  • 我已经使用最新的 Alpha 分支版本测试过，问题依旧存在
  • 我提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
  • 我提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器或者堆砌大量对于复现无用的配置等。
  • 我提供了完整的日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
  • 我直接使用 Mihomo 命令行程序重现了错误，而不是使用其他工具或脚本。

操作系统

Linux

系统版本

Linux chant-arch 6.14.5-arch1-1 #1 SMP PREEMPT_DYNAMIC Sat, 03 May 2025 13:34:12 +0000 x86_64 GNU/Linux

Mihomo 版本

Mihomo Meta 1.19.6 linux amd64 with go1.24.3 2025-05-12 04:10:31+00:00

配置文件

proxy-providers: ****

mode: rule # clash工作模式（rule/global/direct,meta暂不支持script）

mixed-port: 7890    # 本地混合代理(http和socks5合并）端口
redir-port: 7892

ipv6: true # ip6开关，当为false时，停止解析hostanmes为ip6地址

allow-lan: true

log-level: warning # 日志等级（info/warning/error/debug/silent）

interface-name: ppp0       # 出口网卡名称
# routing-mark: 9527         # 流量标记(仅Linux)

tcp-concurrent: true #【Meta专属】TCP连接并发，如果域名解析结果对应多个IP，
                     # 并发所有IP，选择握手最快的IP进行连接
unified-delay: true # 开启统一延迟时，会计算 RTT，以消除连接握手等带来的不同类型节点的延迟差异

external-controller: 0.0.0.0:9091
external-ui: /usr/share/metacubexd

geodata-mode: true #【Meta专属】使用geoip.dat数据库(默认：false使用mmdb数据库)
geodata-loader: standard
geo-auto-update: true
geo-update-interval: 24
geox-url:
  geoip: "https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat"
  geosite: "https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat"
  mmdb: "https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.metadb"
  asn: "https://github.com/xishang0128/geoip/releases/download/latest/GeoLite2-ASN.mmdb"

find-process-mode: off

global-client-fingerprint: random

profile:
  store-selected: false
  store-fake-ip: false

sniffer:
  enable: true
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: false
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  skip-domain:
    - "Mijia Cloud"
    - "+.push.apple.com"

tun:
  enable: false
  stack: gvisor # mixed # gvisor
  mtu: 1500 # 最大传输单元
  device: tun_clash

hosts:
  # '*.clash.dev': 127.0.0.1

proxy-groups: ****

rules:
  - GEOIP,private,DIRECT,no-resolve
  - DOMAIN-SUFFIX,iprofiles.apple.com,REJECT
  - DOMAIN-SUFFIX,mdmenrollment.apple.com,REJECT
  - DOMAIN-SUFFIX,deviceenrollment.apple.com,REJECT
  - DOMAIN-SUFFIX,gdmf.apple.com,REJECT
  - DOMAIN-SUFFIX,albert.apple.com,REJECT
  - GEOSITE,CN,国内
  - GEOSITE,google-gemini,日本
  - GEOSITE,github,Github
  - GEOSITE,twitter,Twitter
  - GEOSITE,youtube,YouTube
  - GEOSITE,google,Google
  - GEOSITE,telegram,Telegram
  - GEOSITE,netflix,NETFLIX
  - GEOSITE,bilibili,哔哩哔哩
  - GEOSITE,bahamut,巴哈姆特
  - GEOSITE,spotify,Spotify
  - GEOSITE,tiktok,Tiktok
  - GEOSITE,dmm,日本
  - GEOSITE,gfw,默认
  - GEOSITE,category-dev,默认
  - GEOSITE,private,DIRECT
  - DOMAIN-SUFFIX,cloudflare-dns.com,默认
  - DOMAIN-SUFFIX,api.nn.ci,默认
  - DOMAIN-SUFFIX,api.ipify.org,默认
  - DOMAIN-SUFFIX,gsas.apple.com,默认
  - DOMAIN-SUFFIX,hotmail.com,默认
  # - GEOSITE,geolocation-!cn,其他
  # - GEOSITE,category-ads-all,REJECT
  - DOMAIN-REGEX,^gsp.*-ssl\.ls\.apple\.com$,国内 # apple map

  - IP-CIDR,1.0.0.1/32,默认,no-resolve
  - IP-CIDR,1.1.1.1/32,默认,no-resolve
  - IP-CIDR,8.8.8.8/32,默认,no-resolve
  - IP-CIDR,8.8.4.4/32,默认,no-resolve
  - GEOIP,google,Google
  - GEOIP,netflix,NETFLIX
  - GEOIP,telegram,Telegram
  - GEOIP,twitter,Twitter
  - GEOIP,CN,国内
  - MATCH,其他

描述

我是在 Arch Linux 上搭了个软路由，DNS 解析是 Dnsmasq 监听53端口，Mosdns 监听5335端口，Dnsmasq 转发到5335端口。用 Nftables 把其他流量交给 Mihomo 代理。

现在没有配置 Mihomo DNS 服务器，大多数网站都可以正常上网，但是某一些网站无法上网（www.kookapp.cn, api3.leigod.com, msedge.sb.tlu.dl.delivery.mp.microsoft.com）。Mihomo 警告 Log 一般是 [TCP] dial 国内 (match GeoSite/CN) 10.10.42.45:44010 --> www.kookapp.cn:443 error: dns resolve failed: couldn't find ip

如果启用如下配置这些网站就能正常上网了：

dns:
  enable: true
  listen: 0.0.0.0:5336
  ipv6: true
  enhanced-mode: redir-host
  respect-rules: false
  default-nameserver:
    - https://223.5.5.5/dns-query
  nameserver:
    - udp://127.0.0.1:53

我还发现这些网站 DNS 查询有个共同特征，用 Nslookup 查询第一行会多一个注释：

# nslookup www.kookapp.cn
;; Truncated, retrying in TCP mode.
Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
www.kookapp.cn	canonical name = alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com.
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 59.110.157.125
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 47.93.10.42
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 47.95.203.175
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 39.105.120.149
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 101.200.41.217
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 59.110.164.41
Name:	alb-9pqs02huod7t0anx8q.cn-beijing.alb.aliyuncs.com
Address: 123.56.12.235

上不了网的情况下用 Curl 测试：

# curl -v http://www.kookapp.cn
* Host www.kookapp.cn:80 was resolved.
* IPv6: (none)
* IPv4: 39.106.12.193, 39.107.108.119, 101.200.56.5, 39.106.10.67, 47.94.1.67, 47.94.140.165, 47.94.234.73
*   Trying 39.106.12.193:80...
* Connected to www.kookapp.cn (39.106.12.193) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: www.kookapp.cn
> User-Agent: curl/8.13.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 308 Permanent Redirect
< Date: Mon, 12 May 2025 03:31:56 GMT
< Content-Type: text/html
< Content-Length: 180
< Connection: keep-alive
< Location: https://www.kookapp.cn/
< Via: HTTP/1.1 SLB.128
<
<html>
<head><title>308 Permanent Redirect</title></head>
<body bgcolor="white">
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host www.kookapp.cn left intact

# curl -v https://www.kookapp.cn
* Host www.kookapp.cn:443 was resolved.
* IPv6: (none)
* IPv4: 59.110.157.125, 47.95.203.175, 47.93.10.42, 123.56.12.235, 59.110.164.41, 101.200.41.217, 39.105.120.149
*   Trying 59.110.157.125:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.kookapp.cn:443
* closing connection #0
curl: (35) TLS connect error: error:00000000:lib(0)::reason(0)

重现方式

详见描述

日志

327	[warning]	[TCP] dial 国内 (match GeoSite/CN) 10.10.42.45:38358 --> www.kookapp.cn:443 error: dns resolve failed: couldn't find ip
326	[debug]	[DNS] www.kookapp.cn --> [] A from system(udp://127.0.0.1:53)
325	[debug]	[DNS] www.kookapp.cn --> [] A from udp://127.0.0.1:53
324	[debug]	[DNS] www.kookapp.cn --> [] AAAA from system(udp://127.0.0.1:53)
323	[debug]	[DNS] www.kookapp.cn --> [] AAAA from udp://127.0.0.1:53
322	[debug]	[DNS] resolve www.kookapp.cn AAAA from udp://127.0.0.1:53
321	[debug]	[DNS] resolve www.kookapp.cn AAAA from system(udp://127.0.0.1:53)
320	[debug]	[DNS] cache hit www.kookapp.cn --> [] AAAA, expire at 2025-05-12 12:15:09
319	[debug]	[DNS] resolve www.kookapp.cn A from udp://127.0.0.1:53
318	[debug]	[DNS] resolve www.kookapp.cn A from system(udp://127.0.0.1:53)
317	[debug]	[Rule] use default rules
316	[debug]	[Sniffer] Sniff tcp [10.10.42.45:38358]-->[123.56.12.235:443] success, replace domain []-->[www.kookapp.cn]

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions