log:
  level: error
  production: true
  file: "./mosdns.log"

plugins:
# 定期更新中国域名列表到配置目录
# https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/direct-list.txt
  - tag: cn_domainList
    type: "domain_set"
    args:
      files:
        - "./rules/direct-list.txt"
        - "./rules/custom_for_cndns.txt"

# https://raw.githubusercontent.com/privacy-protection-tools/anti-AD/master/anti-ad-domains.txt
  - tag: block_domains
    type: "domain_set"
    args:
      files:
        - "./rules/anti-ad-domains.txt"
        - "./rules/custom_black_list.txt"

  - tag: custom_world_list
    type: "domain_set"
    args:
      files:
        - "./rules/custom_for_worlddns.txt"
        
  - tag: jp_edns_list
    type: "domain_set"
    args:
      files:
        - "./rules/custom_for_jp_edns.txt"
        
  - tag: us_edns_list
    type: "domain_set"
    args:
      files:
        - "./rules/custom_for_us_edns.txt"

  - tag: ddnslist
    type: "domain_set"
    args:
      files:
        - "./rules/ddnslist.txt"

# 定期更新IP列表到配置目录
# https://raw.githubusercontent.com/Loyalsoldier/geoip/release/text/cn.txt
  - tag: cn_ipList
    type: "ip_set"
    args:
      files:
        - "./rules/cn.txt"

# google support ECS 
  - tag: ecs_DNS
    type: "forward"
    args:
      upstreams:
        - tag: google_doh
          addr: "https://dns.google/dns-query"
          #dial_addr: "8.8.8.8"
          bootstrap: "8.8.8.8"
          #socks5: "127.0.0.1:7890"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: google_dot
          addr: "tls://dns.google"
          #dial_addr: "8.8.8.8"
          bootstrap: "8.8.8.8"
          #socks5: "127.0.0.1:7890"
          enable_pipeline: true
          insecure_skip_verify: false

# 国外DNS
  - tag: world_DNS
    type: "forward"
    args:
      concurrent: 2
      upstreams:
        - tag: cloudflare_doh
          addr: "https://one.one.one.one/dns-query"
          dial_addr: "1.0.0.1"
          bootstrap: "8.8.8.8"
          #socks5: "127.0.0.1:7890"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: quad9_dot
          addr: "tls://dns10.quad9.net"
          bootstrap: "8.8.8.8"
          #socks5: "127.0.0.1:7890"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: opendns_doh
          addr: "https://doh.opendns.com/dns-query"
          bootstrap: "8.8.8.8"
          #socks5: "127.0.0.1:7890"
          enable_pipeline: true
          insecure_skip_verify: false

# 国内DNS
  - tag: cn_DNS
    type: "forward"
    args:
      concurrent: 2
      # 为什么不使用阿里腾讯114等知名DNS？因为它们是根据请求者IP来返回解析结果。
      upstreams:
        - tag: OneDNS
          addr: "udp://52.80.52.52"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: CNNIC_SDNS
          addr: "udp://1.2.4.8"
          enable_pipeline: true

        - tag: OneDNS_dot
          addr: "tls://dot-pure.onedns.net"
          bootstrap: "223.6.6.6"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: DNSπ
          addr: "tls://101.226.4.6"
          enable_pipeline: true
          insecure_skip_verify: false

# 国内mosdns请使用DoT、DoH等加密方式
#        - tag: dnspod_doh
#          addr: "https://doh.pub/dns-query"
#          bootstrap: "223.6.6.6"
#          enable_pipeline: true
#          insecure_skip_verify: false

#        - tag: ali_dot
#          addr: "tls://223.5.5.5"
#          insecure_skip_verify: false

  - tag: cn_fallback_DNS
    type: "forward"
    args:
      concurrent: 2
      upstreams:
        - tag: dnspod_doh
          addr: "https://doh.pub/dns-query"
          bootstrap: "223.6.6.6"
          enable_pipeline: true
          insecure_skip_verify: false

        - tag: 360_doh
          addr: "https://doh.360.cn/dns-query"
          enable_pipeline: true

        - tag: ali_dot
          addr: "tls://223.5.5.5"
          insecure_skip_verify: false

        - tag: easymosdns_doh
          addr: "https://doh.apad.pro/dns-query"
          bootstrap: "223.6.6.6"
          enable_pipeline: true
          insecure_skip_verify: false

# cache
  - tag: cache
    type: "cache"
    args:
      size: 65535
      dump_file: "./cache.dump"
      lazy_cache_ttl: 86400
      dump_interval: 600

# hosts
  - tag: custom_hosts
    type: "hosts"
    args:
      files:
        - "./rules/hosts"

# 修改 TTL
  - tag: modify_ddns_ttl
    type: "sequence"
    args:
      - exec: ttl 1-5

  - tag: modify_ttl
    type: "sequence"
    args:
      - exec: ttl 5-10

  - tag: modify_black_ttl
    type: "sequence"
    args:
      - exec: ttl 600-3600

  - tag: modify_resp_ttl
    type: "sequence"
    args:
      - matches: qname $ddnslist
        exec: mark 123   # 123为q-ddns ，456为q-bloke
      - matches: qname $block_domains
        exec: mark 456
      - matches: mark 123
        exec: jump modify_ddns_ttl
      - matches: mark 456
        exec: jump modify_black_ttl
      - matches: 
        - "!mark 123"
        - "!mark 456"
        exec: jump modify_ttl

# 国外解析
  - tag: world_resolve
    type: "sequence"
    args:
      - exec: $world_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary world_DNS
      - matches: "has_resp"
        exec: accept

# 国内解析
  - tag: cn_resolve
    type: "sequence"
    args:
      - exec: ecs 123.112.0.0
      - exec: $cn_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary cn_DNS

  - tag: cn_fallback_resolve
    type: "sequence"
    args:
      - exec: ecs 123.112.0.0
      - exec: $cn_fallback_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary cn_fallback_DNS

# ecs_for_jp github
  - tag: ecs_jp_resolve
    type: "sequence"
    args:
      - exec: ecs 1.5.0.0
      - exec: $ecs_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary ecs_jp_resolve
      - matches: "has_resp"
        exec: accept

# ecs_for_us
  - tag: ecs_us_resolve
    type: "sequence"
    args:
      - exec: ecs 4.80.0.0
      - exec: $ecs_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary ecs_us_resolve
      - matches: "has_resp"
        exec: accept

# ecs_for_cn
  - tag: ecs_cn_resolve
    type: "sequence"
    args:
      - exec: ecs 123.112.0.0
      - exec: $ecs_DNS
      - exec: jump modify_resp_ttl
      - exec: query_summary ecs_cn_resolve
      - matches: "has_resp"
        exec: accept

  - tag: match_block_domain
    type: "sequence"
    args:
      - exec: black_hole 127.0.0.1 ::1 0.0.0.0
      - exec: query_summary block_domains

  - tag: custom_hosts_resp
    type: "sequence"
    args:
      - exec: jump modify_resp_ttl
      - matches: "has_resp"
        exec: query_summary custom_hosts
      - matches: "has_resp"
        exec: accept

  - tag: hit_cache_resp
    type: "sequence"
    args:
      - exec: jump modify_resp_ttl
      - matches: "has_resp"
        exec: query_summary hit_cache
      - matches: "has_resp"
        exec: accept

# 拒绝
  - tag: query_is_reject
    type: "sequence"
    args:
      - matches: "qname $block_domains"
        exec: jump match_block_domain
      - matches: qtype 65
        exec: reject 5
      - matches: "has_resp"
        exec: accept

  - tag: fallback_world
    type: "fallback"
    args:
      primary: ecs_cn_resolve    # 主可执行插件的 tag
      secondary: world_resolve   # 副可执行插件的 tag
      threshold: 1500             # 无响应回滚阈值。单位毫秒。默认 500 。
      always_standby: false      # 副可执行插件始终待命。 

  - tag: fallback_cn
    type: "fallback"
    args:
      primary: cn_resolve             # 主可执行插件的 tag
      secondary: cn_fallback_resolve  # 副可执行插件的 tag
      threshold: 2000                 # 无响应回滚阈值。单位毫秒。默认 500 。
      always_standby: false           # 副可执行插件始终待命。 

  - tag: fallback_cn_seq
    type: "sequence"
    args:
      - exec: $fallback_cn
      #- matches: "has_wanted_ans"
      - matches: "resp_ip $cn_ipList"
        exec: accept

  - tag: fallback_world_seq
    type: "sequence"
    args:
      - exec: $fallback_world
      - matches: "has_resp"
        exec: accept

# 解析流程
  - tag: resolve_process
    type: "sequence"
    args:
      - exec: prefer_ipv4
      - exec: $custom_hosts
      - matches: "has_resp"
        exec: goto custom_hosts_resp

      - matches: "!qname $ddnslist"
        exec: $cache
      - matches: "has_resp"
        exec: goto hit_cache_resp

      - matches: "qname $jp_edns_list || github.com"
        exec: jump ecs_jp_resolve
      - matches: "qname $us_edns_list"
        exec: jump ecs_us_resolve
      - matches: "qname $custom_world_list || $ddnslist"
        exec: goto fallback_world_seq
      - exec: jump query_is_reject
      - matches: "qname $cn_domainList"
        exec: jump fallback_cn_seq
 
      - exec: goto fallback_world_seq

# DNS服务
  - tag: udp_server
    type: "udp_server"
    args:
      entry: resolve_process
      listen: "127.0.0.1:53"
  - tag: tcp_server
    type: "tcp_server"
    args:
      entry: resolve_process
      listen: "127.0.0.1:53"
        #cert: "" # 配置 cert 和 key 后会启用 TLS (DoT),别忘记修改为853端口。
        #key:  "" 
        #idle_timeout: 10       # 空连接超时。单位秒。默认 10。

#  - tag: quic_server
#    type: "quic_server"
#    args:
#      entry: resolve_process  # 可执行插件的 tag。
#      listen: "0.0.0.0:853" # 监听地址。
#      cert: ""
#      key:  "" 
#      idle_timeout: 30       # 空连接超时。单位秒。默认 30。

  - tag: server_http
    type: "http_server"
    args:
      entries:                 # []extry
        - path: /dns-query     # 本路径执行
          exec: resolve_process # 可执行插件的 tag。
      src_ip_header: "X-Real-IP"  # 从 HTTP 头获取用户 IP。
      listen: 127.0.0.1:4588 # 监听地址。
      cert: "" # 留空 cert 和 key 后会禁用 TLS。 
      key: ""
      idle_timeout: 10 # 空连接超时。单位秒。默认 30。