Regression in 1.13.2 on Linux TUN + hijack-dns: systemd-resolved DNS loops to 127.0.0.1:53, while 1.12.4 works

Checklist

• I searched existing issues
• I can reproduce this on the same machine with the same config
• 1.12.4 works, 1.13.2 fails

Environment

• OS: Arch Linux
• DNS stack: systemd-resolved + NetworkManager
• sing-box mode: TUN + hijack-dns
• Working version: 1.12.4
• Broken version: 1.13.2

Summary

I hit a regression after upgrading sing-box from 1.12.4 to 1.13.2.

On the same machine, with the same sing-box config:

• 1.12.4 works
• 1.13.2 breaks DNS resolution

When broken, raw IP connectivity still works, but domain resolution fails.

For example:

• ping 1.1.1.1 works
• ping archlinux.org fails with name resolution errors

After downgrading back to 1.12.4, DNS works again.

Relevant observations

When the problem happens on 1.13.2, resolvectl status shows that tun0 is injected as the default DNS path:

• DNS Servers: 172.19.0.2
• DNS Domain: ~.

At the same time, sing-box logs repeatedly show systemd-resolved traffic being routed to 127.0.0.1:53, which fails:

router: found process path: /usr/lib/systemd/systemd-resolved, user: systemd-resolve
outbound/direct[DIRECT]: outbound connection to 127.0.0.1:53
dial tcp 127.0.0.1:53: connect: connection refused

Important detail

My config does not use DNS server type: "local".

The DNS section is using legacy UDP server entries such as:

"dns": {
"servers": [
{ "tag": "dns_proxy", "type": "udp", "server": "8.8.8.8", "detour": "Auto" },
{ "tag": "dns_direct", "type": "udp", "server": "223.5.5.5" }
],
"final": "dns_proxy"
}

And the route section includes:

{ "protocol": "dns", "action": "hijack-dns" }

TUN inbound is roughly:

{
"type": "tun",
"tag": "tun-in",
"interface_name": "tun0",
"address": ["172.19.0.1/30"],
"auto_route": true,
"strict_route": true,
"sniff": true,
"sniff_override_destination": true
}

Resolver state

I also checked the resolver files:

• /etc/resolv.conf points to stub-resolv.conf
• /run/systemd/resolve/stub-resolv.conf contains 127.0.0.53
• I did not find any persistent config explicitly setting DNS to 127.0.0.1

So 127.0.0.1:53 seems to appear at runtime during the 1.13.2 failure path, not from an obvious static config file.

What I tried

These did not fix the problem on 1.13.2:

• changing dns.final from dns_proxy to dns_direct
• changing strict_route
• changing auto_route
• excluding systemd-resolve UID from TUN
• excluding 127.0.0.0/8 from route

Temporary workaround while still on 1.13.2:

sudo resolvectl revert tun0

That restores DNS, but only as a workaround.

Regression window

• good: 1.12.4
• bad: 1.13.2

On 1.12.4, I can resolve and access domains normally again on the same host.

Related issue

This looks related to #3235, but my repro is different because I am not using DNS server type: "local".

Notes

I already downgraded back to 1.12.4 to restore connectivity on the machine.
If needed, I can reproduce again on 1.13.2 and collect fresh outputs for:

• ip route
• ip rule
• full journalctl -u sing-box
• resolvectl status

Reproduce the failure on sing-box 1.13.2 with the supplied TUN and hijack-dns configuration, then compare it with 1.12.4. Start with resolvectl status, the sing-box journal, ip route, and ip rule; done means domain resolution works without resolvectl revert tun0 while raw IP connectivity remains functional.