Fake-IP DNS Explained

Fake-IP is a DNS working mode in Clash-family clients designed to reduce the impact of DNS pollution and cut resolution latency. Clash for Windows benefits from it by default under TUN mode.

How It Works

With Fake-IP enabled:

1. When a local app queries DNS through Clash, Clash does not actually resolve—it immediately returns a fake IP (allocated from the reserved range 198.18.0.1/16) and records a "fake IP ↔ domain" mapping in memory
2. The app opens a connection to the fake IP; the request reaches Clash
3. Clash restores the real domain from the mapping and routes by rules. Proxied traffic sends the domain itself to the remote server for resolution—no real DNS query ever happens locally

Benefits:

• Zero local DNS leakage: resolution for proxied traffic happens remotely; your ISP never sees which domains you queried
• Zero resolution latency: fake IPs are allocated instantly—no local recursive lookup
• Naturally immune to DNS pollution: no query means nothing to pollute

Configuration Example

dns:
  enable: true
  enhanced-mode: fake-ip # key field: fake-ip or redir-host
  fake-ip-range: 198.18.0.1/16 # fake IP allocation range
  fake-ip-filter: # domains excluded from fake IPs (real resolution returned)
    - "*.lan"
    - "*.local"
    - "+.stun.*.*"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"
  nameserver:
    - https://doh.pub/dns-query

fake-ip-filter: domains that need real resolution

Some scenarios only work with a real IP—add them to fake-ip-filter:

• LAN discovery and casting: *.lan, *.local
• NAT type detection / voice calls: STUN depends on real IPs
• Windows connectivity checks: msftconnecttest.com; excluding it makes Windows think there is "no Internet"
• Direct-connect services that communicate by IP

Fake-IP vs redir-host

Aspect	fake-ip	redir-host
Local real resolution	Not needed (proxied traffic)	Required—resolves the real IP first
DNS pollution impact	Immune	Affected
Resolution latency	Near zero	Real query overhead
Compatibility	Some real-IP-dependent apps need filters	Very compatible
Best for	TUN mode, daily proxying	Compatibility-sensitive environments

Keep the defaults for daily use in Clash for Windows. When specific apps misbehave, add their domains to fake-ip-filter first rather than disabling Fake-IP.