sing-box failed to pass hostname for .onion domains

Operating system

Linux

System version

1.13.14

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

Description

singbox 1.13.14 failed to pass hostnames to tor socks while singbox 1.12 version works just fine with same config.

you can see logs from 1.12 with proper sniff options:

  "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    }
  ],

Proper log output from 1.12 with correct ip overriding:

+0000 2026-07-17 14:21:03 INFO [51801188 0ms] inbound/direct[dns4]: inbound packet connection from 10.10.5.74:46276
+0000 2026-07-17 14:21:03 INFO [51801188 0ms] inbound/direct[dns4]: inbound packet connection to 10.10.5.5:53
+0000 2026-07-17 14:21:03 INFO [51801188 2ms] dns: exchanged A flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion. 0 IN A 172.16.0.1
+0000 2026-07-17 14:21:03 INFO [1380874693 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45316
+0000 2026-07-17 14:21:03 INFO [3510160057 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45324
+0000 2026-07-17 14:21:03 INFO [1380874693 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [3510160057 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [3510160057 2ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80
+0000 2026-07-17 14:21:03 INFO [877590728 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45330
+0000 2026-07-17 14:21:03 INFO [1380874693 2ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80
+0000 2026-07-17 14:21:03 INFO [877590728 2ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [877590728 4ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80

Same configs with singbox 1.13 with small adjustments because deprecated options:

 "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
    }
  ],
 "route": {
    "rules": [
      {
        "inbound": [ "tproxy4", "tproxy6" ],
        "action": "sniff"
      }
    ],
    "final": "direct"
  },

produce fail logs, wher ip not being overriden and showing socks error:

+0000 2026-07-17 13:07:00 INFO [3552348983 0ms] inbound/direct[dns4]: inbound packet connection from 10.10.5.74:55901
+0000 2026-07-17 13:07:00 INFO [3552348983 0ms] inbound/direct[dns4]: inbound packet connection to 10.10.5.5:53
+0000 2026-07-17 13:07:00 INFO [3552348983 2ms] dns: exchanged A flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion. 0 IN A 172.16.0.1
+0000 2026-07-17 13:07:00 INFO [147736201 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:52846
+0000 2026-07-17 13:07:00 INFO [147736201 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 13:07:00 INFO [147736201 1ms] outbound/socks[tor]: outbound connection to 172.16.0.1:80
+0000 2026-07-17 13:07:00 ERROR [147736201 7ms] connection: open connection to 172.16.0.1:80 using outbound/socks[tor]: socks5: request rejected, code=1

logs from tor socks:

Jul 17 16:39:54.263 [info] connection_handle_listener_read(): New SOCKS connection opened from 127.0.0.1.
Jul 17 16:39:54.266 [warn] Your application (using socks5 to port 80) is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via privoxy or socat) instead. For more information, please see https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks. [9 similar message(s) suppressed in last 60 seconds]

Reproduction

Full configs:

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    }
  ],
  "route": {
    "rules": [
      {
        "inbound": [ "tproxy4", "tproxy6" ],
        "action": "sniff"
      }
    ],
    "final": "direct"
  },
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ]
}

{
  "inbounds": [
    {
      "type": "direct",
      "tag": "dns4",
      "listen": "10.10.5.5",
      "listen_port": 53
    },
    {
      "type": "direct",
      "tag": "dns6",
      "listen": "fd00:10:10:5::5",
      "listen_port": 53
    }
  ],
  "dns": {
    "servers": [
      {
        "tag": "dnsmasq",
        "type": "udp",
        "server": "127.0.0.1",
        "server_port": 53
      }
    ],
    "reverse_mapping": true,
    "final": "dnsmasq"
  },
  "route": {
    "rules": [
      {
        "inbound": [
          "dns4",
          "dns6"
        ],
        "action": "hijack-dns"
      }
    ]
  }
}

{
  "outbounds": [
    {
      "type": "socks",
      "tag": "byedpi",
      "server": "127.0.0.1",
      "server_port": 2933
    },
    {
      "type": "socks",
      "tag": "zapret",
      "server": "127.0.0.1",
      "server_port": 8797
    },
    {
      "type": "plain",
      "tag": "i2p",
      "server": "127.0.0.1",
      "server_port": 4444
    },
    {
      "type": "socks",
      "tag": "google",
      "server": "127.0.0.1",
      "server_port": 4646
    },
    {
      "type": "socks",
      "tag": "xray",
      "server": "127.0.0.1",
      "server_port": 8537
    },
    {
      "type": "direct",
      "tag": "nfqws",
      "routing_mark": 200
    }
 ],
  "route": {
    "rules": [
      {
        "domain_suffix": [
          ".i2p"
        ],
        "outbound": "i2p"
      },
      {
        "ip_cidr": [
          "172.16.0.2/32"
        ],
        "outbound": "i2p"
      }
    ]
  }
}


{
  "outbounds": [
    {
      "type": "socks",
      "tag": "tor",
      "server": "127.0.0.1",
      "server_port": 9050
    }
 ],
  "route": {
    "rules": [
      {
        "domain_suffix": [
          ".onion"
        ],
        "outbound": "tor"
      }
    ]
  }
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the issue with the supplied sing-box configurations and comparing the 1.12 and 1.13 sniffing and routing behavior in the logs. Trace how the tproxy inbound, sniff action, DNS reverse mapping, and SOCKS outbound handle the .onion destination. Done means the 1.13 configuration passes the hostname to the Tor SOCKS proxy instead of using 172.16.0.1.