Custom DNS: DoH / DoT encrypted resolution

Classic DNS travels as plaintext UDP on port 53 — anything on the path can read and tamper with your queries. Switching Clash's upstream DNS to encrypted DoH (DNS over HTTPS) or DoT (DNS over TLS) removes that layer of risk. Override the dns section via Mixin:

mixin:
  dns:
    enable: true
    enhanced-mode: fake-ip
    nameserver:
      - https://dns.alidns.com/dns-query      # DoH
      - tls://dot.pub                          # DoT
    fallback:
      - https://1.1.1.1/dns-query
      - https://8.8.8.8/dns-query
    fallback-filter:
      geoip: true
      geoip-code: CN

nameserver vs fallback

nameserver is the primary pool (pick fast encrypted resolvers near you so local domains resolve quickly and correctly); fallback is the second opinion (trusted foreign resolvers). With fallback-filter.geoip on, whenever the primary answer's IP is not in CN, Clash adopts the fallback answer instead — effectively auto-detecting suspicious answers and switching to the foreign source, balancing speed and accuracy.

Afterwards, Logs at debug level shows which upstream answered each query; combined with fake-ip mode, virtually no plaintext DNS leaves your machine in normal use.