130 lines
3.9 KiB
Plaintext
130 lines
3.9 KiB
Plaintext
# dns server name, defaut is host name
|
|
# server-name,
|
|
# example:
|
|
# server-name smartdns
|
|
#
|
|
|
|
# Include another configuration options
|
|
# conf-file [file]
|
|
# conf-file blacklist-ip.conf
|
|
|
|
# dns server bind ip and port, default dns server port is 53.
|
|
# bind [IP]:port, udp server
|
|
# bind-tcp [IP]:port, tcp server
|
|
# example:
|
|
# IPV4: :53
|
|
# IPV6 [::]:53
|
|
# bind-tcp [::]:53
|
|
|
|
bind [::]:53
|
|
|
|
# tcp connection idle timeout
|
|
# tcp-idle-time [second]
|
|
|
|
# dns cache size
|
|
# cache-size [number]
|
|
# 0: for no cache
|
|
cache-size 512
|
|
|
|
# prefetch domain
|
|
# prefetch-domain [yes|no]
|
|
# prefetch-domain yes
|
|
|
|
# List of hosts that supply bogus NX domain results
|
|
# bogus-nxdomain [ip/subnet]
|
|
|
|
# List of IPs that will be filtered when nameserver is configured -blacklist-ip parameter
|
|
# blacklist-ip [ip/subnet]
|
|
|
|
# List of IPs that will be ignored
|
|
# ignore-ip [ip/subnet]
|
|
|
|
# force AAAA query return SOA
|
|
# force-AAAA-SOA [yes|no]
|
|
|
|
# Enable IPV4, IPV6 dual stack IP optimization selection strategy
|
|
# dualstack-ip-selection-threshold [num] (0~1000)
|
|
# dualstack-ip-selection [yes|no]
|
|
# dualstack-ip-selection yes
|
|
|
|
# edns client subnet
|
|
# edns-client-subnet [ip/subnet]
|
|
# edns-client-subnet 192.168.1.1/24
|
|
# edns-client-subnet [8::8]/56
|
|
|
|
# ttl for all resource record
|
|
# rr-ttl: ttl for all record
|
|
# rr-ttl-min: minimum ttl for resource record
|
|
# rr-ttl-max: maximum ttl for resource record
|
|
# example:
|
|
# rr-ttl 300
|
|
# rr-ttl-min 60
|
|
# rr-ttl-max 86400
|
|
|
|
# set log level
|
|
# log-level: [level], level=fatal, error, warn, notice, info, debug
|
|
# log-file: file path of log file.
|
|
# log-size: size of each log file, support k,m,g
|
|
# log-num: number of logs
|
|
log-level info
|
|
# log-file /var/log/smartdns.log
|
|
# log-size 128k
|
|
# log-num 2
|
|
|
|
# dns audit
|
|
# audit-enable: enable or disable audit [yes|no]
|
|
# audit-enable yes
|
|
# audit-size size of each audit file, support k,m,g
|
|
# audit-file /var/log/smartdns-audit.log
|
|
# audit-size 128k
|
|
# audit-num 2
|
|
|
|
# remote udp dns server list
|
|
# server [IP]:[PORT] [-blacklist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
|
|
# default port is 53
|
|
# -blacklist-ip: filter result with blacklist ip
|
|
# -check-edns: result must exist edns RR, or discard result.
|
|
# -group [group]: set server to group, use with nameserver /domain/group.
|
|
# -exclude-default-group: exclude this server from default group.
|
|
# server 8.8.8.8 -blacklist-ip -check-edns -group g1 -group g2
|
|
|
|
# remote tcp dns server list
|
|
# server-tcp [IP]:[PORT] [-blacklist-ip] [-group [group] ...] [-exclude-default-group]
|
|
# default port is 53
|
|
# server-tcp 8.8.8.8
|
|
|
|
# remote tls dns server list
|
|
# server-tls [IP]:[PORT] [-blacklist-ip] [-spki-pin [sha256-pin]] [-group [group] ...] [-exclude-default-group]
|
|
# -spki-pin: TLS spki pin to verify.
|
|
# Get SKPI with this command:
|
|
# echo | openssl s_client -connect '[ip]:853' | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
|
|
# default port is 853
|
|
# server-tls 8.8.8.8
|
|
# server-tls 1.0.0.1
|
|
|
|
# remote https dns server list
|
|
# server-https https://[host]:[port]/path [-blacklist-ip] [-spki-pin [sha256-pin]] [-group [group] ...] [-exclude-default-group]
|
|
# -spki-pin: TLS spki pin to verify.
|
|
# default port is 443
|
|
# server-https https://cloudflare-dns.com/dns-query
|
|
|
|
# specific nameserver to domain
|
|
# nameserver /domain/[group|-]
|
|
# nameserver /www.example.com/office, Set the domain name to use the appropriate server group.
|
|
# nameserver /www.example.com/-, ignore this domain
|
|
|
|
# specific address to domain
|
|
# address /domain/[ip|-|-4|-6|#|#4|#6]
|
|
# address /www.example.com/1.2.3.4, return ip 1.2.3.4 to client
|
|
# address /www.example.com/-, ignore address, query from upstream, suffix 4, for ipv4, 6 for ipv6, none for all
|
|
# address /www.example.com/#, return SOA to client, suffix 4, for ipv4, 6 for ipv6, none for all
|
|
|
|
# enable ipset timeout by ttl feature
|
|
# ipset-timeout [yes]
|
|
|
|
# specific ipset to domain
|
|
# ipset /domain/[ipset|-]
|
|
# ipset /www.example.com/block, set ipset with ipset name of block
|
|
# ipset /www.example.com/-, ignore this domain
|
|
|