1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
| vi /etc/smartdns/smartdns.conf
# dns server name, default is host name
# server-name,
# example:
server-name smartdns1
#
# Include another configuration options
# conf-file [file]
# conf-file blacklist-ip.conf
# dns server bind ip and port, default dns server port is 53, support binding multi ip and port
# bind udp server
# bind [IP]:[port] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
# bind tcp server
# option:
# -group: set domain request to use the appropriate server group.
# -no-rule-addr: skip address rule.
# -no-rule-nameserver: skip nameserver rule.
# -no-rule-ipset: skip ipset rule.
# -no-speed-check: do not check speed.
# -no-cache: skip cache.
# -no-rule-soa: Skip address SOA(#) rules.
# -no-dualstack-selection: Disable dualstack ip selection.
# -force-aaaa-soa: force AAAA query return SOA.
# example:
# IPV4:
# bind :53
# bind :6053 -group office -no-speed-check
# IPV6:
# bind [::]:53
# bind-tcp [::]:53
bind [::]:53
# tcp connection idle timeout
# tcp-idle-time [second]
# dns cache size
# cache-size [number]
# 0: for no cache
cache-size 4096
# enable persist cache when restart
# cache-persist yes
# cache persist file
# cache-file /tmp/smartdns.cache
# prefetch domain
# prefetch-domain [yesno]
#启用域名预获取
prefetch-domain yes
# cache serve expired
# serve-expired [yesno]
#启用过期缓存服务
serve-expired yes
# cache serve expired TTL
# serve-expired-ttl [num]
#
serve-expired-ttl 0
# reply TTL value to use when replying with expired data
# serve-expired-reply-ttl [num]
# serve-expired-reply-ttl 30
# List of hosts that supply bogus NX domain results
# bogus-nxdomain [ip/subnet]
# List of IPs that will be filtered when nameserver is configured -blacklist-ip parameter
# blacklist-ip [ip/subnet]
# List of IPs that will be accepted when nameserver is configured -whitelist-ip parameter
# whitelist-ip [ip/subnet]
# List of IPs that will be ignored
# ignore-ip [ip/subnet]
# speed check mode
# speed-check-mode [pingtcp:portnone,]
# example:
#测速模式选择，一般只检测两种协议
# speed-check-mode ping,tcp:80
speed-check-mode tcp:443,ping
# speed-check-mode none
# force AAAA query return SOA
# force-AAAA-SOA [yesno]
#禁用IPV6解析
force-AAAA-SOA yes
# force specific qtype return soa
# force-qtype-SOA [qtypeid ...]
# force-qtype-SOA 65 28
# Enable IPV4, IPV6 dual stack IP optimization selection strategy
# dualstack-ip-selection-threshold [num] (0~1000)
# dualstack-ip-selection [yesno]
dualstack-ip-selection no
# edns client subnet
# edns-client-subnet [ip/subnet]
# edns-client-subnet 192.168.1.1/24
# edns-client-subnet [8::8]/56
# ttl for all resource record
# rr-ttl: ttl for all record
# rr-ttl-min: minimum ttl for resource record
# rr-ttl-max: maximum ttl for resource record
# tr-ttl-reply-max: maximum reply ttl for resource record
# example:
#设置TTL最小值和最大值
#rr-ttl 300
rr-ttl-min 60
rr-ttl-max 86400
# rr-ttl-reply-max 60
# set log level
# log-level: [level], level=fatal, error, warn, notice, info, debug
# log-file: file path of log file.
# log-size: size of each log file, support k,m,g
log-num: number of logs
log-level info
log-file /var/log/smartdns.log
log-size 128k
# dns audit
# audit-enable [yesno]: enable or disable audit.
# audit-enable yes
# audit-SOA [yesno]: enable or disable log soa result.
# audit-size size of each audit file, support k,m,g
# audit-file /var/log/smartdns-audit.log
# audit-size 128k
# audit-num 2
# certificate file
# ca-file [file]
# ca-file /etc/ssl/certs/ca-certificates.crt
# certificate path
# ca-path [path]
# ca-path /etc/ss/certs
# remote udp dns server list
# server [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-check-edns] [-group [group] ...] [-exclude-default-group]
# default port is 53
# -blacklist-ip: filter result with blacklist ip
# -whitelist-ip: filter result whth whitelist ip, result in whitelist-ip will be accepted.
# -check-edns: result must exist edns RR, or discard result.
# -group [group]: set server to group, use with nameserver /domain/group.
# -exclude-default-group: exclude this server from default group.
# server 8.8.8.8 -blacklist-ip -check-edns -group g1 -group g2
#飞书
server 114.114.114.114 -group feishu -exclude-default-group
nameserver /.feishu.cn/feishu
nameserver /.feishucdn.com/feishu
nameserver /.feishu.com/feishu
nameserver /.bytehwm.com/feishu
nameserver /.ibytedapm.com/feishu
nameserver /.zijieapi.com/feishu
nameserver /.feelgood.cn/feishu
# 百度
server 114.114.114.114 -group baidu -exclude-default-group
nameserver /.baidu.com/baidu
#京东
server 114.114.114.114 -group jd -exclude-default-group
nameserver /.jd.com/jd
#淘宝天猫
server 114.114.114.114 -group taobao -exclude-default-group
nameserver /.taobao.com/taobao
nameserver /.tmall.com/taobao
#阿里
server 114.114.114.114 -group ali -exclude-default-group
nameserver /.aliyun.com/ali
#csdn
server 114.114.114.114 -group csdn -exclude-default-group
nameserver /.csdn.net/csdn
#华为
server 114.114.114.114 -group huawei -exclude-default-group
nameserver /.huaweicloud.com/huawei
#todesk
server 114.114.114.114 -group todesk -exclude-default-group
nameserver /.todesk.com/todesk
#QQ
server 114.114.114.114 -group qq -exclude-default-group
nameserver /.qq.com/qq
# remote tcp dns server list
# server-tcp [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-group [group] ...] [-exclude-default-group]
# default port is 53
# server-tcp 8.8.8.8
server 8.8.8.8
server 8.8.4.4
##server 120.53.129.197
##server 124.70.4.50
# remote tls dns server list
# server-tls [IP]:[PORT] [-blacklist-ip] [-whitelist-ip] [-spki-pin [sha256-pin]] [-group [group] ...] [-exclude-default-group]
# -spki-pin: TLS spki pin to verify.
# -tls-host-verify: cert hostname to verify.
# -host-name: TLS sni hostname.
# -no-check-certificate: no check certificate.
# Get SPKI with this command:
# default port is 853
server-tls 8.8.8.8
server-tls 1.0.0.1
# remote https dns server list
# server-https https://[host]:[port]/path [-blacklist-ip] [-whitelist-ip] [-spki-pin [sha256-pin]] [-group [group] ...] [-exclude-default-group]
# -spki-pin: TLS spki pin to verify.
# -tls-host-verify: cert hostname to verify.
# -host-name: TLS sni hostname.
# -http-host: http host.
# -no-check-certificate: no check certificate.
# default port is 443
server-https https://cloudflare-dns.com/dns-query
# specific nameserver to domain
# nameserver /domain/[group-]
# nameserver /www.example.com/office, Set the domain name to use the appropriate server group.
# nameserver /www.example.com/-, ignore this domain
# specific address to domain
# address /domain/[ip--4-6##4#6]
# address /www.example.com/1.2.3.4, return ip 1.2.3.4 to client
# address /www.example.com/-, ignore address, query from upstream, suffix 4, for ipv4, 6 for ipv6, none for all
# address /www.example.com/#, return SOA to client, suffix 4, for ipv4, 6 for ipv6, none for all
# enable ipset timeout by ttl feature
# ipset-timeout [yes]
# specific ipset to domain
# ipset /domain/[ipset-]
# ipset /www.example.com/block, set ipset with ipset name of block
# ipset /www.example.com/-, ignore this domain
# set domain rules
# domain-rules /domain/ [-speed-check-mode [...]]
# rules:
# [-c] -speed-check-mode [mode]: speed check mode
# speed-check-mode [pingtcp:portnone,]
# [-a] -address [address-]: same as address option
# [-n] -nameserver [group-]: same as nameserver option
# [-p] -ipset [ipset-]: same as ipset option
# [-d] -dualstack-ip-selection [yesno]: same as dualstack-ip-selection option
|