DNS query loopback in transport

Operating system

Linux

System version

Debian 12

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.11.5

Environment: go1.24.1 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_reality_server,with_acme,with_clash_api
Revision: 75f526cb29cf6116cd70f5b7f1f19e0e5114711b
CGO: disabled

Description

DNS query loopback detection triggered while it should not

Reproduction

{
    "log": {
        "level": "debug"
    },
    "inbounds": [
        {
            "tag": "Mixed IN",
            "type": "mixed",
            "listen": "::",
            "listen_port": 1080
        }
    ],
    "outbounds": [
        {
            "tag": "Out1",
            "type": "direct",
            "routing_mark": 51820
        },
        {
            "tag": "Out2",
            "type": "direct",
            "routing_mark": 51821
        }
    ],
    "dns": {
        "final": "Google DNS",
        "independent_cache": true,
        "servers": [
            {
                "tag": "Google DNS",
                "type": "h3",
                "server": "[2001:4860:4860::8844]",
                "server_port": 443,
                "headers": {
                    "Host": "dns.google"
                },
                "tls": {
                    "enabled": true,
                    "disable_sni": false,
                    "server_name": "dns.google"
                },
                "detour": "Out1"
            }
        ]
    },
    "route": {
        "final": "Out1",
        "default_domain_resolver": "Google DNS"
    }
}

Logs

INFO[0000] network: updated default interface ens3, index 2
INFO[0000] inbound/mixed[Mixed IN]: tcp server started at [::]:1080
INFO[0000] sing-box started (0.33s)
INFO[0009] [914426624 0ms] inbound/mixed[Mixed IN]: inbound connection from 127.0.0.1:37938
INFO[0009] [914426624 2ms] inbound/mixed[Mixed IN]: inbound connection to example.com:443
INFO[0009] [914426624 2ms] outbound/direct[Out1]: outbound connection to example.com:443
DEBUG[0009] [914426624 2ms] dns: lookup domain example.com
DEBUG[0009] [914426624 8ms] outbound/direct[Out1]: outbound packet connection to dns.google:443
DEBUG[0009] [914426624 8ms] dns: lookup domain dns.google
DEBUG[0009] [914426624 8ms] dns: lookup failed for dns.google: exchange6: DNS query loopback in transport[Google DNS] | exchange4: DNS query loopback in transport[Google DNS]
DEBUG[0009] [914426624 9ms] dns: lookup failed for example.com: exchange6: exchange6: DNS query loopback in transport[Google DNS] | exchange4: DNS query loopback in transport[Google DNS] | exchange4: exchange6: DNS query loopback in transport[Google DNS] | exchange4: DNS query loopback in transport[Google DNS]
ERROR[0009] [914426624 9ms] connection: open outbound connection: exchange6: exchange6: DNS query loopback in transport[Google DNS] | exchange4: DNS query loopback in transport[Google DNS] | exchange4: exchange6: DNS query loopback in transport[Google DNS] | exchange4: DNS query loopback in transport[Google DNS]

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by running the supplied sing-box configuration on Debian 12 and reviewing the DNS logs around the Out1 detour and Google DNS server. Trace why resolving dns.google is classified as a loopback, then verify that the same configuration resolves example.com without the false loopback error.