DNS

All platforms. These live in their own DNS section in Settings — they apply in ordinary VPN mode too, not only when the local proxy is in use.

Local DNS

off · port 10853

All platforms

Resolves DNS inside the tunnel instead of through the system resolver. A subscription's own DNS section always takes precedence.

DNS leak protection

on

All platforms

Captures every DNS query the OS or an app makes (ports 53 and 853) into the tunnel, so lookups can't slip out to your ISP's resolver over the physical connection. Leave it on unless a specific setup needs the system resolver reachable directly.

DNS-over-HTTPS (DoH)

off

All platforms

Resolves DNS over an encrypted HTTPS connection (dnsforge.de by default) instead of plaintext UDP, so the network can't read or tamper with your lookups. You can point it at any DoH endpoint; the query goes through the tunnel, not the physical network. A subscription's own DNS section always takes precedence; a provider can also enable DoH via a subscription header, and your toggle overrides it locally.

Fallback DoH resolvers

off

All platforms

If the resolver your provider specified doesn't answer, the address is looked up through a small built-in list of resolvers instead (dnsforge.de, 42l.fr, ffmuc.net and others — all known to work with the app). Off by default: with it off, a resolver that doesn't answer simply falls back to your system DNS.

Turn it on if your network blocks the resolver your provider uses.

Which resolver is used, in order:

the provider's s-resolve header → the RemoteDNSDomain field of the active routing profile → your own setting → the built-in fallback list (if enabled) → your system DNS.