DNS, Static Records & Ad Filter
[dns]
This section configures the DNS settings.
| Key | Type | Description |
|---|---|---|
system-dns | List of IPs | Deprecated legacy override, used only when both custom App Routing and Simple Mode are disabled. Prefer direct-dns for new profiles. |
app-routing-enabled | Boolean | Enables domain-based routing and split DNS. Set true for new profiles; the legacy false path is deprecated. |
direct-dns | List of DNS upstreams | DNS servers for direct connections when app-routing-enabled is true. Supports plain IP DNS, DoT, and DoH. |
vpn-dns | List of DNS upstreams | DNS servers for VPN/proxy connections when app-routing-enabled is true. Supports plain IP DNS, DoT, and DoH. |
bootstrap-dns | List of IPs | (New in 1.9.0) bootstrap resolvers used when encrypted VPN DNS upstreams are configured with domains. Defaults are provided by the app. |
direct-dns-follow-vpn | Boolean | (New in 1.8.0) whether DNS servers for direct connections should follow the split routing rule. |
optimistic-dns-caching | Boolean | (New in 1.9.0) enables optimistic DNS cache refresh. Default is true. |
l4proxy-synthetic-ip | Boolean | Enables synthetic-IP handling for L4 proxy domain routing. Default false. |
DNS upstream formats:
- Plain IP DNS:
1.1.1.1,8.8.8.8 - DNS over TLS:
tls://cloudflare-dns.comortls://1.1.1.1 - DNS over HTTPS:
https://dns.google/dns-query
When vpn-dns contains an encrypted DNS server with a domain name, such as tls://p2.freedns.controld.com, add a VPN-DNS-SERVER-DOMAINS routing rule so MintFlow can resolve that DNS server domain through a selected VPN/proxy path instead of leaking bootstrap traffic to the direct network.
Example:
[dns]
app-routing-enabled=true
direct-dns=223.5.5.5,114.114.114.114
vpn-dns=tls://p2.freedns.controld.com,https://dns.google/dns-query
bootstrap-dns=1.1.1.1,8.8.8.8
optimistic-dns-caching=true
[dns-hosts] (Pro)
Exact hostnames mapped to IPv4 addresses, served by MintFlow DNS. These are DNS answers, not routing rules or wildcard domain suffixes. Configure routing separately and enable App Routing for this example:
[dns]
app-routing-enabled=true
direct-dns=1.1.1.1,8.8.8.8
[dns-hosts]
nas.example.com=192.168.40.10
At most 256 hostnames and 1–16 IPv4 addresses per hostname are supported. Static host records and derived Tailscale records are subject to entitlement and effective DNS configuration checks; inspect the compilation report.
[dns-adblock] (Free)
Opt-in local DNS filtering, available in Simple Mode and Rules Mode. Internal DNS must be active. See Internal DNS Server for setup, precedence, updates, and limitations.
| Key | Meaning |
|---|---|
enabled | Boolean; default false. Enables the selected filter. |
list | One of adguard-dns (default), hagezi-normal, or oisd-small. Custom URLs and combining lists are not supported. |
[dns-adblock]
enabled=true
list=adguard-dns