V2Ray DNS Configuration Guide: Split DNS Routing & Anti-Pollution Setup

Two Problems Split DNS Solves

On mainland China networks, direct queries for foreign domains are frequently poisoned: the returned IP doesn't belong to the target site, so connections time out or land on an error page. Encrypted remote resolution wraps the query in a TLS tunnel, so the poisoning source can't tamper with the response — that's DoH's core role in split DNS.

Domestic domains are the opposite. Remote resolution still returns a result, but the query path adds an extra proxy hop, and some Chinese CDNs return different nodes depending on where the query comes from, so remote resolution often gets out-of-region nodes. Handing domestic domains to the local DNS resolves them nearby and makes CDN routing more accurate.

The goal of split DNS isn't to mechanically split queries, but to give each domain type its own resolution channel while making sure the routing rules and the dns section use the same domain set.

Basic Structure of the dns Section and Split DNS Syntax

Xray's dns section is a servers array matched in order: when a domain matches an entry's domains list, that entry is used; entries without domains match everything and go last as a fallback. Just paste the snippet below into the root of your config.

"dns": {
  "servers": [
    {
      "address": "https://1.1.1.1/dns-query",
      "domains": ["geosite:geolocation-!cn"],
      "tag": "proxy"
    },
    {
      "address": "223.5.5.5",
      "domains": ["geosite:cn"],
      "expectIPs": ["geoip:cn"]
    },
    "223.5.5.5"
  ]
}

The first entry handles foreign domains, sending queries through the proxy outbound; the second handles domestic domains and uses expectIPs to validate the response; the third is a bare-address fallback covering domains not in the geosite data. In v2rayN-generated configs, the proxy outbound tag is proxy and direct is direct — keep them consistent when referencing. Use the proxy server's IP address directly instead of its hostname to skip an extra bootstrap resolution step.

Domains that need fixed resolution can go into dns.hosts, which takes priority over the servers array and never sends queries outbound. Internal hostnames and self-hosted service domains belong here.

Pairing routing Rules with domainStrategy

The dns section decides who resolves a domain; routing decides which outbound the connection takes. Configuring only the dns section without routing can still send all traffic through the proxy; configuring only routing without dns leaves domestic domains exposed to remote-resolution poisoning. The two must be set up together.

"routing": {
  "domainStrategy": "IPIfNonMatch",
  "rules": [
    {
      "type": "field",
      "domain": ["geosite:cn"],
      "outboundTag": "direct"
    },
    {
      "type": "field",
      "domain": ["geosite:geolocation-!cn"],
      "outboundTag": "proxy"
    }
  ]
}

When to Use Each of the Three domainStrategy Values

• AsIs: matches rules using only the domain string without resolving proactively — best when all rules are written by domain and you don't depend on IP rules.
• IPIfNonMatch: resolves the domain only when no domain rule matches, then tries IP rules — the usual choice for split DNS setups.
• IPOnDemand: resolves whenever a rule contains an IP condition, causing more DNS queries — usually unnecessary.

expectIPs Anti-Pollution Semantics and Verification

expectIPs isn't a routing rule — it only validates the resolution result: if the result isn't in the given geoip list, it's discarded and the next server is tried in order. The most common form for domestic entries is expectIPs: ["geoip:cn"], which ensures the local DNS only accepts IPs from mainland China.

{
  "address": "223.5.5.5",
  "domains": ["geosite:cn"],
  "expectIPs": ["geoip:cn", "geoip:private"]
}

expectIPs supports negation: foreign entries can add geoip:!cn to reject results that resolve to Chinese CDN nodes. If you'd rather have a validation failure raise an error than fall back, add skipFallback: true to the entry. geoip:private allows private address ranges so internal domains aren't wrongly discarded.

Verify That Split DNS Is Working

1. Go to Settings → Parameter Settings → Basic Settings, set the log level to debug, and reconnect the node.
2. Visit a foreign site and confirm in the log that the domain is resolved by the first DoH entry and the query went through the proxy.
3. Visit a domestic site and confirm the query hits 223.5.5.5 and the response passes the geoip:cn check.
4. Run nslookup www.qq.com 223.5.5.5 in the terminal to confirm the local DNS itself is working.

Common Issues and Troubleshooting

If you run into problems after configuring split DNS, work through these four checks in order.