How to Set Up Fake-IP DNS in Clash Verge Rev on Windows

What Fake-IP DNS Does

Fake-IP DNS is a DNS handling mode supported by Mihomo, the core commonly used by Clash Verge Rev. When an application asks for the address of a domain, Mihomo can return an address from a reserved internal range instead of immediately returning the domain’s real public IP. The core remembers the association between that fake address and the requested domain, then uses the domain information when it processes the connection against your proxy rules.

This approach can make domain-based routing more reliable. With ordinary DNS resolution, an application may connect to a resolved IP address without the proxy core having the original hostname available for matching. Fake-IP mode helps Mihomo retain that context, so rules such as domain suffixes can still be applied. It can also keep DNS requests under the client’s control rather than letting every application independently query a resolver.

Fake-IP mode is not itself a proxy server, a subscription, or a guarantee that every DNS request is encrypted. The actual connection still depends on your active profile, routing rules, selected proxy group, Windows networking mode, and the DNS settings in your configuration. A badly formed profile or a conflicting DNS service can cause name-resolution failures even when the fake-IP option is enabled.

1Prepare the Active Profile in Clash Verge Rev

First confirm which profile Clash Verge Rev is actually using. Open the application on Windows and select Profiles. Locate the profile marked active, or identify the profile whose proxies and rules you currently use. Editing a different profile will not change the DNS behavior of the active one.

Before editing, make a copy of the profile or save its current contents somewhere safe. If the interface offers an edit or open-file action for the selected profile, use that action rather than guessing where the configuration is stored. Profile storage locations can vary by application version and installation method. If you open the YAML file in a text editor, keep the original file intact until the new configuration has been tested.

1. Open Clash Verge Rev and go to Profiles.
2. Select the profile you intend to use and make it active if it is not already selected.
3. Use the profile’s edit or open-file option to inspect the YAML configuration.
4. Find the top-level dns: key. If one already exists, update that section instead of adding a second DNS section.
5. Save the file, return to Clash Verge Rev, and use the profile update, reload, or refresh action available in your version.

Some profiles are managed remotely, and local edits may be replaced during a subscription update. If that happens, check whether your client version provides a profile merge, patch, or override feature. Keep the override separate from the provider’s source profile where possible, and verify the final active configuration after every update. Do not paste private subscription URLs, authentication tokens, or server credentials into public support posts.

2Add a Minimal Fake-IP DNS Configuration

For a straightforward starting point, merge the following settings into the active profile’s existing top-level DNS section. This example uses public resolver IP addresses and a reserved fake-IP range. If the profile already contains resolver choices or policy-specific settings, preserve the parts you need and avoid replacing them blindly.

Each line has a distinct purpose. enable: true turns on Mihomo’s DNS handling. enhanced-mode: fake-ip selects fake-IP behavior. fake-ip-range specifies the reserved address pool used for the synthetic answers. The nameserver list gives Mihomo resolvers to use when it needs real DNS answers. These resolver addresses are examples, not a requirement; use resolvers appropriate for your network, policy, and location.

The example sets ipv6: false to keep the initial test focused on IPv4 and avoid confusion from networks where IPv6 DNS or routing is incomplete. If your network and rules support IPv6, you can later remove this line or configure IPv6 deliberately. Disabling IPv6 in the DNS configuration does not necessarily disable IPv6 throughout Windows, so treat it as a Clash DNS setting rather than a system-wide switch.

YAML indentation matters: use spaces, not tabs, and keep child values indented consistently beneath their parent keys. Do not put the sample inside a fenced Markdown block in the actual profile. If your profile already has nameserver, fallback, nameserver-policy, or other DNS options, do not create duplicate keys. Review the existing section and combine compatible settings into a single valid structure.

Optional Encrypted Resolvers

If you want Mihomo to use DNS-over-HTTPS resolvers, you can use HTTPS resolver URLs in the appropriate DNS fields supported by your core version. For example, Cloudflare and Google publish DNS-over-HTTPS endpoints. Encrypted DNS protects the resolver exchange in transit, but it does not automatically send all application traffic through a proxy, nor does it prove that no other Windows component can make DNS requests.

Start with one simple resolver arrangement and test it before adding fallback filters, per-domain policies, or multiple resolution paths. Extra options can be useful, but they also make it harder to identify which resolver handled a query when debugging. Check the Mihomo documentation for the exact options supported by the core bundled with your Clash Verge Rev version.

3Reload the Profile and Check Windows Routing

After saving the YAML file, return to Clash Verge Rev and reload or update the selected profile. Watch for a parse or validation error. If the profile does not load, restore your backup and compare the edited DNS section carefully for incorrect indentation, a missing colon, a duplicated key, or an unsupported option. Do not assume that a saved file is active until the client confirms that the profile loaded successfully.

Next, check the client’s connection mode. In System Proxy mode, applications that honor the Windows system proxy can send supported traffic through Clash, but not every application uses that setting. TUN mode can route a broader range of Windows traffic through the core, but it may require additional permissions and can interact with other VPNs, security software, or network adapters. DNS configuration and traffic capture are related but separate: enabling fake-IP DNS alone does not ensure that every Windows application is routed through Clash.

• Confirm the intended profile is active and that its configuration has loaded without errors.
• Use a valid proxy group selection if your rules send test traffic to a proxy group.
• Enable the mode appropriate for the applications you want to test: System Proxy for proxy-aware apps, or TUN when broader traffic capture is needed.
• If Windows asks for permission to create or manage a virtual adapter, review the prompt and allow it only if you trust the installation and intend to use TUN.
• Temporarily disconnect other VPN or DNS-filtering software while testing, since two network interception tools can compete for routes or DNS traffic.

Keep your normal routing rules in mind during tests. A successful DNS response does not mean that the matching rule selected the proxy you expected. For a test domain, inspect the connection or traffic view in Clash Verge Rev and confirm both the matched rule and the selected policy. If the connection is marked DIRECT, that may be correct for the rule in your profile; it is not automatically evidence that fake-IP DNS failed.

4Verify That Fake-IP DNS Is Working

Test from a newly opened terminal or browser after the profile reload. Windows and applications can cache DNS results, so a result obtained before the change may persist temporarily. You can flush the Windows DNS client cache from Command Prompt with ipconfig /flushdns. This clears that cache; it does not clear every browser’s internal cache or the DNS cache maintained inside Clash.

From Command Prompt, request a domain with nslookup example.com. With fake-IP mode active, a queried domain may receive an address from the configured fake-IP range, rather than its ordinary public address. The precise output can depend on the core version, query path, cache state, and configuration. Use the response as one useful signal, not as the only test. A timeout, an unexpected public answer, or a result that differs between applications deserves further investigation.

Then open a site or application that has a predictable rule in your configuration. In the Clash Verge Rev connections view, look for the destination domain, the matched rule, and the policy or proxy group used. If the connection is visible and the expected domain rule matches, Mihomo is receiving enough domain context to make that routing decision. If you use TUN, also confirm that the test application’s traffic is appearing in the client.

For a more controlled check, use the same domain in a command-line lookup and in a browser, then compare the time of each request in the client’s connection view. Avoid testing only a domain already open in a long-running browser tab. The application may reuse an existing connection or cached answer and never generate the DNS request you expect to observe.

5Troubleshoot Common DNS Conflicts

Websites fail to resolve after enabling fake-IP. First check the profile’s parse status and confirm that dns.enable is true. Verify that at least one configured resolver is reachable from your network and that the keys are indented under the correct dns: section. Temporarily return to the simplest configuration to isolate the problem. If the minimal setup works, add other DNS options back one at a time.

Some local devices or applications stop working. Certain software expects a real DNS answer, uses its own resolver, or relies on local network names. Mihomo supports a fake-ip-filter option for domains that should not receive fake addresses. Add exclusions only when you have a specific compatibility issue, and follow the syntax supported by your core version. Broad exclusions can reduce the benefits of fake-IP and make domain-based routing less consistent.

The configuration works until the next subscription update. The provider may replace the edited source profile. Keep a backup, review any profile-merge or override feature in your client, and verify the active result after an update. Avoid repeatedly editing a generated profile without understanding how the client regenerates it.

DNS works but traffic does not use the expected node. DNS answers and routing decisions are not the same thing. Inspect the connection’s matched rule and policy group, confirm that the group has a usable node selected, and check whether the rule intentionally uses DIRECT. Also confirm that your application is covered by System Proxy or TUN mode as appropriate.

Windows reports unexpected DNS behavior. Another VPN, antivirus web shield, DNS filter, browser secure-DNS setting, or manually configured network adapter can send queries through a separate path. Temporarily disable competing network tools for a controlled test, and check the browser’s secure DNS settings if browser results differ from command-line results. Restore your preferred security tools after identifying the conflict.

Clash Verge Rev shows no useful DNS activity. Confirm that the request was made after the profile was reloaded, that the domain was not served from an application cache, and that the application’s traffic is actually reaching Clash. Restarting the application being tested can clear its local connection state. If you change resolver settings, test again with a new query rather than relying on an existing session.

6Keep the Setup Stable

Once the tests pass, save a clean copy of the working configuration and note which profile and core version you tested. After updating Clash Verge Rev, Mihomo, or a subscription profile, check that the DNS section remains present and that the active profile still loads. Core behavior and available options can change, so do not carry forward an advanced setting indefinitely without checking whether the current core supports it.

When a network problem appears, use a short diagnostic sequence: confirm the profile is active, inspect client logs for YAML or DNS errors, check whether a fresh lookup succeeds, and inspect the resulting connection rule. If the problem began after a configuration edit, restore the last known-good version before making further changes. This approach is safer and faster than changing Windows adapter settings, DNS servers, TUN options, and routing rules all at once.

Fake-IP DNS is most useful when Mihomo needs domain context to apply rules consistently. It is not a universal fix for blocked services, poor proxy performance, or every DNS leak scenario. A reliable Windows setup depends on a valid profile, resolvers that are reachable, suitable routing rules, and a traffic mode that covers the applications you are testing.

Download Clash for Free – Get Started Now →