DNS
Chute uses a customized DNS client to support advanced features. It may behave differently from the DNS client of your operating system.
Chute will play as DNS server when session applied DIRECT rule. Chute will check the DNS record of host first, then initial the socket with IP returned in the DNS record. With this method, all session applied DIRECT rule will bypass system DNS configuration and route with Chute DNS server.
Chute iOS will config system DNS server to Chute DNS server.
Upstream DNS Server
Chute uses the DNS server addresses from the operating system by default. You can override them with DNS server, DoH (DNS-over-HTTPS), DoT (DNS-over-TLS), DoQ (DNS-over-QUIC), and DoH3 (DNS-over-HTTP/3) services using 'dns-server' option.
DNS Section
DNS options are normally written in [General], but they may equivalently be written under a top-level [DNS] section: dns-server, doh (alias doh-server), dot, doq, doh3, hijack-dns and always-real-ip behave the same in either section. The very same section also accepts local DNS mapping lines, the per-domain form used in [Host], so both line forms may coexist in one section. Any other key is ignored with a notice in the log.
[DNS]
doh = https://dns.google/dns-query
always-real-ip = *.lan
*.example.com = server:1.1.1.1
Details
Chute simultaneously queries all DNS servers to improve performance, similar to dnsmasq with '--all-servers' parameter. The first answer from servers will be used. Chute iOS app and Chute Dashboard will show which server responds first. If Chute has not received any answer in 2 seconds, it will query all servers again. Note that only DNS server, DoT and DoQ upstreams participate in retries; DoH, DoH3 and syslib are queried on the first round only. After 3 retries (4 attempts in total) or 10 seconds, Chute will give up and report DNS error.
Some domain names may have poorly-performing authoritative name servers, causing upstream DNS servers to return empty answer due to server-side timeout or other connectivity issues. Chute will report empty DNS error to upstream DNS servers explicitly return empty DNS answers, or if some servers return empty answers and others fail to respond in 3 seconds.
Some DNS record has very short TTL due to configuration, Chute enforces a minimum TTL of 60 seconds: shorter TTLs are raised to 60 seconds. Optimistic DNS is enabled by default — the cached DNS result is returned immediately while refreshing in the background. It can be disabled via optimistic-dns = false.
When IPv6 is available and enabled, Chute DNS client will send both A and AAAA questions to upstream DNS Servers. The first A or AAAA answer returned will be used. On single-stack networks, an answer for an address family that is currently not routable is held back in favor of the other family, and is only used as a fallback when the other family yields nothing.