The no-resolve flag: skipping needless DNS lookups

First, a subtle behavior: when a connection with a domain reaches an IP-CIDR or GEOIP rule, Clash must resolve the domain to an IP just to test the match — even if a later rule will send the traffic into the proxy anyway (where the remote end should be doing the resolving).

Two problems follow: an extra local DNS round-trip adds latency, and the lookup itself can leak which domains you visit (one source of DNS leaks) — plus the local answer may be poisoned.

The fix: no-resolve

- IP-CIDR,198.18.0.0/16,DIRECT,no-resolve
- GEOIP,CN,DIRECT   # the final catch-all usually goes WITHOUT it

With no-resolve, the rule applies only to traffic that is already an IP; domain traffic skips it and keeps matching downward — no resolution triggered.

When to add it

• Mid-list rules targeting specific IP ranges: add it and skip pointless lookups;
• The trailing GEOIP,CN,DIRECT catch-all: usually leave it off — its whole job is to resolve stray domestic domains and send them direct. With no-resolve it goes blind, and domestic traffic falls through to MATCH and into the proxy.