Two DNS blocks, only one is live
There is a DNS override switch in the Clash settings area, named a little differently across versions. While it is off, name resolution follows the dns block that shipped inside your config file. The moment you turn it on, the client uses its own DNS settings and the block from your subscription takes no part at all.
Most DNS confusion starts right here. Someone edits nameserver entries in the config for an hour, never notices the override is on, and cannot work out why nothing changed.
Nothing counts until the profile reloads
The dns block is not applied live. Save, let the config reload once, then test.
fake-ip, the filter list, and the nameserver fields
- 1
Two resolution modes, and why the default fits better
fake-ip resolves nothing locally. It hands the application a synthetic address out of 198.18.0.1/16 and the real lookup happens on the proxy side. That is fast, and since your machine never sends the query outward, there is very little room for a leak. redir-host honestly resolves the real address before connecting: better compatibility, lower speed. Without a specific reason, stay on fake-ip.
- 2
fake-ip-filter is an allow list
Anything matched by fake-ip-filter skips the synthetic address and gets resolved normally. Local device names, several multiplayer games, and any service that needs a genuine address inside your network have to sit in that list, otherwise they receive something starting with 198.18 and simply cannot connect. The shipped list covers the common cases. When one specific service breaks, add its domain.
- 3
Each nameserver field owns a different job
nameserver handles ordinary queries. proxy-server-nameserver resolves the hostnames of your nodes themselves, and a wrong or empty value there produces the classic picture where no node works at all because its own domain never resolved. nameserver-policy assigns a dedicated server to specific domains, which is how a company intranet suffix gets sent to an internal resolver.
Reading a leak test correctly
Open any DNS leak test page and look at which region the reported resolvers sit in. Line up with the node you are using and the setup is doing its job. A full list of servers belonging to your local ISP means some path is going around Clash Verge.
- Turn off encrypted DNS (DoH or DoT) in the browser before testing; it walks around everything you configured
- Glance at the network adapter too, in case a public DNS address was typed in there by hand
- Before changing the fake-ip range, make sure the new one does not collide with your LAN
Common questions
The proxy is on, but the leak test still reports my local DNS servers.
Work through three places in order. First the browser: Chrome and Firefox may have secure DNS on by default, that traffic leaves over DoH, and nothing can intercept it. Second, a DNS server typed by hand into the network adapter properties. Third, the running mode: system proxy only covers programs that respect proxy settings, and the resolver of the operating system does not necessarily go through it. TUN mode picks up the rest.
Some apps throw errors under fake-ip. What do I do?
Those apps want a real address and treat anything starting with 198.18 as unreachable. Add their domain to fake-ip-filter so that one name resolves for real and everything else stays as it is. Switching the whole profile to redir-host also fixes it, at the price of slowing every lookup down, which is a bad trade for a single app.