fake-ip vs redir-host: choosing a DNS mode

The enhanced-mode field in the dns section takes one of two values, deciding how Clash answers DNS queries:

fake-ip (default, recommended)

When a program asks for a domain, Clash instantly answers with a fake address from the reserved 198.18.0.0/16 block and remembers the mapping. When the program then connects to that fake IP, Clash recovers the domain and matches rules by it. Benefits: zero-latency DNS answers, natural immunity to DNS poisoning, and rules see the original domain (most accurate matching).

redir-host

Resolve honestly and return the real IP. Best compatibility, but resolution adds latency, may be poisoned, and in some paths rules can only match by IP.

Known fake-ip quirks and the fix

A few programs cache or report the fake IP (network connectivity checks, some game launchers), which shows up as "no internet after turning the proxy off". The fix is excluding those domains from fake-ip:

dns:
  enhanced-mode: fake-ip
  fake-ip-filter:
    - "*.lan"
    - "+.stun.*.*"
    - "+.msftconnecttest.com"
    - "+.battlenet.com.cn"

Domains matching the filter get real resolution. Most subscriptions ship a sensible filter already; when a specific app misbehaves, add its domain. Unless you hit a concrete incompatibility, stay on fake-ip.