# DNS, Static Records & Ad Filter

## `[dns]`

This section configures the DNS settings.

| Key | Type | Description |
|---|---|---|
| `system-dns` | List of IPs | Deprecated legacy override, used only when both custom App Routing and Simple Mode are disabled. Prefer `direct-dns` for new profiles. |
| `app-routing-enabled` | Boolean | Enables domain-based routing and split DNS. Set `true` for new profiles; the legacy `false` path is deprecated. |
| `direct-dns` | List of DNS upstreams | DNS servers for direct connections when `app-routing-enabled` is `true`. Supports plain IP DNS, DoT, and DoH. |
| `vpn-dns` | List of DNS upstreams | DNS servers for VPN/proxy connections when `app-routing-enabled` is `true`. Supports plain IP DNS, DoT, and DoH. |
| `bootstrap-dns` | List of IPs | (New in 1.9.0) bootstrap resolvers used when encrypted VPN DNS upstreams are configured with domains. Defaults are provided by the app. |
| `direct-dns-follow-vpn` | Boolean | (New in 1.8.0) whether DNS servers for direct connections should follow the split routing rule. |
| `optimistic-dns-caching` | Boolean | (New in 1.9.0) enables optimistic DNS cache refresh. Default is `true`. |
| `l4proxy-synthetic-ip` | Boolean | Enables synthetic-IP handling for L4 proxy domain routing. Default `false`. |

DNS upstream formats:

- Plain IP DNS: `1.1.1.1`, `8.8.8.8`
- DNS over TLS: `tls://cloudflare-dns.com` or `tls://1.1.1.1`
- DNS over HTTPS: `https://dns.google/dns-query`

When `vpn-dns` contains an encrypted DNS server with a domain name, such as `tls://p2.freedns.controld.com`, add a `VPN-DNS-SERVER-DOMAINS` routing rule so MintFlow can resolve that DNS server domain through a selected VPN/proxy path instead of leaking bootstrap traffic to the direct network.

**Example:**
```ini
[dns]
app-routing-enabled=true
direct-dns=223.5.5.5,114.114.114.114
vpn-dns=tls://p2.freedns.controld.com,https://dns.google/dns-query
bootstrap-dns=1.1.1.1,8.8.8.8
optimistic-dns-caching=true
```

## `[dns-hosts]` (Pro)

Exact hostnames mapped to IPv4 addresses, served by MintFlow DNS. These are DNS answers, not routing rules or wildcard domain suffixes. Configure routing separately and enable App Routing for this example:

```ini
[dns]
app-routing-enabled=true
direct-dns=1.1.1.1,8.8.8.8

[dns-hosts]
nas.example.com=192.168.40.10
```

At most 256 hostnames and 1–16 IPv4 addresses per hostname are supported. Static host records and derived Tailscale records are subject to entitlement and effective DNS configuration checks; inspect the compilation report.

## `[dns-adblock]` (Free)

Opt-in local DNS filtering, available in Simple Mode and Rules Mode. Internal DNS must be active. See [Internal DNS Server](../core-components/internal-dns.md) for setup, precedence, updates, and limitations.

| Key | Meaning |
|---|---|
| `enabled` | Boolean; default `false`. Enables the selected filter. |
| `list` | One of `adguard-dns` (default), `hagezi-normal`, or `oisd-small`. Custom URLs and combining lists are not supported. |

```ini
[dns-adblock]
enabled=true
list=adguard-dns
```