Use stdlib ech

documentation: Bump version
Fix socks5 UDP implementation
2026-04-12 18:17:18 +10:00 · 2024-12-11 19:33:53 +08:00 · 2024-12-10 21:38:13 +08:00 · 2024-12-10 21:38:04 +08:00 · 2024-12-10 21:37:36 +08:00 · 2024-12-10 21:37:36 +08:00
178 changed files with 2588 additions and 22739 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,6 +7,11 @@ on:
        description: "Version name"
        required: true
        type: string
+      prerelease:
+        description: "Is prerelease"
+        required: true
+        type: boolean
+        default: true
      build:
        description: "Build type"
        required: true
@@ -23,6 +28,10 @@ on:
          - tvOS
          - macOS-standalone
          - publish-android
+      macos_project_version:
+        description: "macOS project version"
+        required: false
+        type: string
  push:
    branches:
      - main-next
@@ -38,6 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.outputs.outputs.version }}
+      prerelease: ${{ steps.outputs.outputs.prerelease }}
    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
@@ -51,7 +61,9 @@ jobs:
        if: github.event_name == 'workflow_dispatch'
        run: |-
          echo "version=${{ inputs.version }}" 
+          echo "prerelease=${{ inputs.prerelease }}"
          echo "version=${{ inputs.version }}" >> "$GITHUB_ENV"
+          echo "prerelease=${{ inputs.prerelease }}" >> "$GITHUB_ENV"
      - name: Calculate version
        if: github.event_name != 'workflow_dispatch'
        run: |-
@@ -60,6 +72,7 @@ jobs:
        id: outputs
        run: |-
          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
  build:
    name: Build binary
    if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Binary'
@@ -170,8 +183,7 @@ jobs:
          echo "HOME=$HOME" >> "$GITHUB_ENV"
      - name: Set tag
        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
+          git tag v${{ needs.calculate_version.outputs.version }}
      - name: Build
        if: matrix.goos != 'android'
        run: |-
@@ -231,8 +243,7 @@ jobs:
          /usr/lib/jvm/java-17-openjdk-amd64/bin/java --version
      - name: Set tag
        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
+          git tag v${{ needs.calculate_version.outputs.version }}
      - name: Build library
        run: |-
          make lib_install
@@ -242,12 +253,12 @@ jobs:
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
      - name: Checkout main branch
-        if: github.ref == 'refs/heads/main-next' && github.event_name != 'workflow_dispatch'
+        if: needs.calculate_version.outputs.prerelease == 'false'
        run: |-
          cd clients/android
          git checkout main
      - name: Checkout dev branch
-        if: github.ref == 'refs/heads/dev-next'
+        if: needs.calculate_version.outputs.prerelease == 'true'
        run: |-
          cd clients/android
          git checkout dev
@@ -306,8 +317,7 @@ jobs:
          /usr/lib/jvm/java-17-openjdk-amd64/bin/java --version
      - name: Set tag
        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
+          git tag v${{ needs.calculate_version.outputs.version }}
      - name: Build library
        run: |-
          make lib_install
@@ -317,12 +327,12 @@ jobs:
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
      - name: Checkout main branch
-        if: github.ref == 'refs/heads/main-next' && github.event_name != 'workflow_dispatch'
+        if: needs.calculate_version.outputs.prerelease == 'false'
        run: |-
          cd clients/android
          git checkout main
      - name: Checkout dev branch
-        if: github.ref == 'refs/heads/dev-next'
+        if: needs.calculate_version.outputs.prerelease == 'true'
        run: |-
          cd clients/android
          git checkout dev
@@ -344,38 +354,67 @@ jobs:
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
          LOCAL_PROPERTIES: ${{ secrets.LOCAL_PROPERTIES }}
          SERVICE_ACCOUNT_CREDENTIALS: ${{ secrets.SERVICE_ACCOUNT_CREDENTIALS }}
+  build_apple_library:
+    name: Build Apple library
+    if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'app-store' || inputs.build == 'iOS' || inputs.build == 'macOS' || inputs.build == 'tvOS' || inputs.build == 'macOS-standalone'
+    runs-on: macos-15
+    needs:
+      - calculate_version
+    steps:
+      - name: Checkout
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        with:
+          fetch-depth: 0
+          submodules: 'recursive'
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ^1.23
+      - name: Setup Xcode
+        run: |-
+          sudo xcode-select -s /Applications/Xcode_16.2_beta_3.app
+      - name: Set tag
+        run: |-
+          git tag v${{ needs.calculate_version.outputs.version }}
+      - name: Build library
+        run: |-
+          make lib_install
+          export PATH="$PATH:$(go env GOPATH)/bin"
+          make lib_ios
+      - name: Upload library
+        uses: actions/upload-artifact@v4
+        with:
+          name: library-apple
+          path: 'Libbox.xcframework'
  build_apple:
    name: Build Apple clients
    runs-on: macos-15
    needs:
      - calculate_version
+      - build_apple_library
    strategy:
      matrix:
        include:
          - name: iOS
            if: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'app-store'|| inputs.build == 'iOS' }}
-            platform: ios
            scheme: SFI
            destination: 'generic/platform=iOS'
            archive: build/SFI.xcarchive
            upload: SFI/Upload.plist
          - name: macOS
            if: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'app-store'|| inputs.build == 'macOS' }}
-            platform: macos
            scheme: SFM
            destination: 'generic/platform=macOS'
            archive: build/SFM.xcarchive
            upload: SFI/Upload.plist
          - name: tvOS
            if: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'app-store'|| inputs.build == 'tvOS' }}
-            platform: tvos
            scheme: SFT
            destination: 'generic/platform=tvOS'
            archive: build/SFT.xcarchive
            upload: SFI/Upload.plist
          - name: macOS-standalone
            if: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'macOS-standalone' }}
-            platform: macos
            scheme: SFM.System
            destination: 'generic/platform=macOS'
            archive: build/SFM.System.xcarchive
@@ -393,27 +432,22 @@ jobs:
        uses: actions/setup-go@v5
        with:
          go-version: ^1.23
-      - name: Setup Xcode stable
-        if: matrix.if && github.ref == 'refs/heads/main-next'
+      - name: Setup Xcode
+        if: matrix.if
        run: |-
-          sudo xcode-select -s /Applications/Xcode_16.2.app
-      - name: Setup Xcode beta
-        if: matrix.if && github.ref == 'refs/heads/dev-next'
-        run: |-
-          sudo xcode-select -s /Applications/Xcode_16.2.app
+          sudo xcode-select -s /Applications/Xcode_16.2_beta_3.app
      - name: Set tag
        if: matrix.if
        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
+          git tag v${{ needs.calculate_version.outputs.version }}
          echo "VERSION=${{ needs.calculate_version.outputs.version }}" >> "$GITHUB_ENV"
      - name: Checkout main branch
-        if: matrix.if && github.ref == 'refs/heads/main-next' && github.event_name != 'workflow_dispatch'
+        if: matrix.if && needs.calculate_version.outputs.prerelease == 'false'
        run: |-
          cd clients/apple
          git checkout main
      - name: Checkout dev branch
-        if: matrix.if && github.ref == 'refs/heads/dev-next'
+        if: matrix.if && needs.calculate_version.outputs.prerelease == 'true'
        run: |-
          cd clients/apple
          git checkout dev
@@ -444,10 +478,6 @@ jobs:
            --key $ASC_KEY_PATH \
            --key-id $ASC_KEY_ID \
            --issuer $ASC_KEY_ISSUER_ID
-          
-          echo "ASC_KEY_PATH=$ASC_KEY_PATH" >> "$GITHUB_ENV"
-          echo "ASC_KEY_ID=$ASC_KEY_ID" >> "$GITHUB_ENV"
-          echo "ASC_KEY_ISSUER_ID=$ASC_KEY_ISSUER_ID" >> "$GITHUB_ENV"
        env:
          CERTIFICATES_P12: ${{ secrets.CERTIFICATES_P12 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
@@ -456,19 +486,12 @@ jobs:
          ASC_KEY: ${{ secrets.ASC_KEY }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
-      - name: Build library
+      - name: Download library
        if: matrix.if
-        run: |-
-          make lib_install
-          export PATH="$PATH:$(go env GOPATH)/bin"
-          go run ./cmd/internal/build_libbox -target apple -platform ${{ matrix.platform }}
-          mv Libbox.xcframework clients/apple
-      - name: Update macOS version
-        if: matrix.if && matrix.name == 'macOS' && github.event_name == 'workflow_dispatch'
-        run: |-
-          MACOS_PROJECT_VERSION=$(go run -v ./cmd/internal/app_store_connect next_macos_project_version)
-          echo "MACOS_PROJECT_VERSION=$MACOS_PROJECT_VERSION"
-          echo "MACOS_PROJECT_VERSION=$MACOS_PROJECT_VERSION" >> "$GITHUB_ENV"
+        uses: actions/download-artifact@v4
+        with:
+          name: library-apple
+          path: clients/apple/Libbox.xcframework
      - name: Build
        if: matrix.if
        run: |-
@@ -480,25 +503,27 @@ jobs:
            -destination "${{ matrix.destination }}" \
            -archivePath "${{ matrix.archive }}" \
            -allowProvisioningUpdates \
-            -authenticationKeyPath $ASC_KEY_PATH \
+            -authenticationKeyPath $RUNNER_TEMP/Key.p12 \
            -authenticationKeyID $ASC_KEY_ID \
            -authenticationKeyIssuerID $ASC_KEY_ISSUER_ID
+        env:
+          MACOS_PROJECT_VERSION: ${{ inputs.macos_project_version }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
      - name: Upload to App Store Connect
        if: matrix.if && matrix.name != 'macOS-standalone' && github.event_name == 'workflow_dispatch'
        run: |-
-          go run -v ./cmd/internal/app_store_connect cancel_app_store ${{ matrix.platform }}
          cd clients/apple
          xcodebuild -exportArchive \
            -archivePath "${{ matrix.archive }}" \
            -exportOptionsPlist ${{ matrix.upload }} \
            -allowProvisioningUpdates \
-            -authenticationKeyPath $ASC_KEY_PATH \
+            -authenticationKeyPath $RUNNER_TEMP/Key.p12 \
            -authenticationKeyID $ASC_KEY_ID \
            -authenticationKeyIssuerID $ASC_KEY_ISSUER_ID
-      - name: Publish to TestFlight
-        if: matrix.if && matrix.name != 'macOS-standalone' && github.event_name == 'workflow_dispatch' && github.ref =='refs/heads/dev-next'
-        run: |-
-          go run -v ./cmd/internal/app_store_connect publish_testflight ${{ matrix.platform }}
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
      - name: Build image
        if: matrix.if && matrix.name == 'macOS-standalone' && github.event_name == 'workflow_dispatch'
        run: |-
@@ -532,7 +557,7 @@ jobs:
          path: 'dist'
  upload:
    name: Upload builds
-    if: always() && github.event_name == 'workflow_dispatch' && (inputs.build == 'All' || inputs.build == 'Binary' || inputs.build == 'Android' || inputs.build == 'Apple' || inputs.build == 'macOS-standalone')
+    if: always() && github.event_name == 'workflow_dispatch' && inputs.build != 'publish-android'
    runs-on: ubuntu-latest
    needs:
      - calculate_version
@@ -566,8 +591,7 @@ jobs:
          go install -v .
      - name: Set tag
        run: |-
-          git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
-          git tag v${{ needs.calculate_version.outputs.version }} -f
+          git tag v${{ needs.calculate_version.outputs.version }}
          echo "VERSION=${{ needs.calculate_version.outputs.version }}" >> "$GITHUB_ENV"
      - name: Download builds
        uses: actions/download-artifact@v4
@@ -584,16 +608,8 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      - name: Upload builds
-        if: ${{ env.PUBLISHED == 'false' }}
        run: |-
          export PATH="$PATH:$HOME/go/bin"
          ghr --replace --draft --prerelease -p 5 "v${VERSION}" dist/release
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Replace builds
-        if: ${{ env.PUBLISHED != 'false' }}
-        run: |-
-          export PATH="$PATH:$HOME/go/bin"
-          ghr --replace -p 5 "v${VERSION}" dist/release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -22,16 +22,6 @@ linters-settings:

 run:
  go: "1.23"
-  build-tags:
-    - with_gvisor
-    - with_quic
-    - with_dhcp
-    - with_wireguard
-    - with_ech
-    - with_utls
-    - with_reality_server
-    - with_acme
-    - with_clash_api

 issues:
  exclude-dirs:
--- a/.goreleaser.fury.yaml
+++ b/.goreleaser.fury.yaml
@@ -6,9 +6,7 @@ builds:
      - -v
      - -trimpath
    ldflags:
-      - -X github.com/sagernet/sing-box/constant.Version={{ .Version }}
-      - -s
-      - -buildid=
+      - -X github.com/sagernet/sing-box/constant.Version={{ .Version }} -s -w -buildid=
    tags:
      - with_gvisor
      - with_quic
--- a/22
+++ b/22
@@ -28,7 +28,7 @@ ci_build:
 	go build $(MAIN_PARAMS) $(MAIN)

 generate_completions:
-	go run -v --tags $(TAGS),generate,generate_completions $(MAIN)
+	go run -v --tags generate,generate_completions $(MAIN)

 install:
 	go build -o $(PREFIX)/bin/$(NAME) $(MAIN_PARAMS) $(MAIN)
@@ -182,22 +182,10 @@ release_tvos: build_tvos upload_tvos_app_store
 update_apple_version:
 	go run ./cmd/internal/update_apple_version

-update_macos_version:
-	MACOS_PROJECT_VERSION=$(shell go run -v ./cmd/internal/app_store_connect next_macos_project_version) go run ./cmd/internal/update_apple_version
-
 release_apple: lib_ios update_apple_version release_ios release_macos release_tvos release_macos_standalone

 release_apple_beta: update_apple_version release_ios release_macos release_tvos

-publish_testflight:
-	go run -v ./cmd/internal/app_store_connect publish_testflight
-
-prepare_app_store:
-	go run -v ./cmd/internal/app_store_connect prepare_app_store
-
-publish_app_store:
-	go run -v ./cmd/internal/app_store_connect publish_app_store
-
 test:
 	@go test -v ./... && \
 	cd test && \
@@ -216,11 +204,11 @@ lib_android:
 lib_android_debug:
 	go run ./cmd/internal/build_libbox -target android -debug

-lib_apple:
-	go run ./cmd/internal/build_libbox -target apple
-
 lib_ios:
-	go run ./cmd/internal/build_libbox -target apple -platform ios -debug
+	go run ./cmd/internal/build_libbox -target ios
+
+lib_ios_debug:
+	go run ./cmd/internal/build_libbox -target ios -debug

 lib:
 	go run ./cmd/internal/build_libbox -target android
--- a/adapter/dns.go
+++ b/adapter/dns.go
@@ -1,73 +0,0 @@
-package adapter
-
-import (
-	"context"
-	"net/netip"
-
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common/logger"
-
-	"github.com/miekg/dns"
-)
-
-type DNSRouter interface {
-	Lifecycle
-	Exchange(ctx context.Context, message *dns.Msg, options DNSQueryOptions) (*dns.Msg, error)
-	Lookup(ctx context.Context, domain string, options DNSQueryOptions) ([]netip.Addr, error)
-	ClearCache()
-	LookupReverseMapping(ip netip.Addr) (string, bool)
-	ResetNetwork()
-}
-
-type DNSClient interface {
-	Start()
-	Exchange(ctx context.Context, transport DNSTransport, message *dns.Msg, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) (*dns.Msg, error)
-	Lookup(ctx context.Context, transport DNSTransport, domain string, options DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error)
-	LookupCache(domain string, strategy C.DomainStrategy) ([]netip.Addr, bool)
-	ExchangeCache(ctx context.Context, message *dns.Msg) (*dns.Msg, bool)
-	ClearCache()
-}
-
-type DNSQueryOptions struct {
-	Transport    DNSTransport
-	Strategy     C.DomainStrategy
-	DisableCache bool
-	RewriteTTL   *uint32
-	ClientSubnet netip.Prefix
-}
-
-type RDRCStore interface {
-	LoadRDRC(transportName string, qName string, qType uint16) (rejected bool)
-	SaveRDRC(transportName string, qName string, qType uint16) error
-	SaveRDRCAsync(transportName string, qName string, qType uint16, logger logger.Logger)
-}
-
-type DNSTransport interface {
-	Type() string
-	Tag() string
-	Dependencies() []string
-	Reset()
-	Exchange(ctx context.Context, message *dns.Msg) (*dns.Msg, error)
-}
-
-type LegacyDNSTransport interface {
-	LegacyStrategy() C.DomainStrategy
-	LegacyClientSubnet() netip.Prefix
-}
-
-type DNSTransportRegistry interface {
-	option.DNSTransportOptionsRegistry
-	CreateDNSTransport(ctx context.Context, logger log.ContextLogger, tag string, transportType string, options any) (DNSTransport, error)
-}
-
-type DNSTransportManager interface {
-	Lifecycle
-	Transports() []DNSTransport
-	Transport(tag string) (DNSTransport, bool)
-	Default() DNSTransport
-	FakeIP() FakeIPTransport
-	Remove(tag string) error
-	Create(ctx context.Context, logger log.ContextLogger, tag string, outboundType string, options any) error
-}
--- a/adapter/experimental.go
+++ b/adapter/experimental.go
@@ -7,6 +7,7 @@ import (
 	"time"

 	"github.com/sagernet/sing-box/common/urltest"
+	"github.com/sagernet/sing-dns"
 	"github.com/sagernet/sing/common/varbin"
 )

@@ -30,7 +31,7 @@ type CacheFile interface {
 	FakeIPStorage

 	StoreRDRC() bool
-	RDRCStore
+	dns.RDRCStore

 	LoadMode() string
 	StoreMode(mode string) error
--- a/adapter/fakeip.go
+++ b/adapter/fakeip.go
@@ -3,6 +3,7 @@ package adapter
 import (
 	"net/netip"

+	"github.com/sagernet/sing-dns"
 	"github.com/sagernet/sing/common/logger"
 )

@@ -26,6 +27,6 @@ type FakeIPStorage interface {
 }

 type FakeIPTransport interface {
-	DNSTransport
+	dns.Transport
 	Store() FakeIPStore
 }
--- a/adapter/inbound.go
+++ b/adapter/inbound.go
@@ -71,14 +71,14 @@ type InboundContext struct {
 	UDPDisableDomainUnmapping bool
 	UDPConnect                bool
 	UDPTimeout                time.Duration
-	TLSFragment               bool
-	TLSFragmentFallbackDelay  time.Duration

-	NetworkStrategy     *C.NetworkStrategy
+	NetworkStrategy     C.NetworkStrategy
 	NetworkType         []C.InterfaceType
 	FallbackNetworkType []C.InterfaceType
 	FallbackDelay       time.Duration

+	DNSServer string
+
 	DestinationAddresses []netip.Addr
 	SourceGeoIPCode      string
 	GeoIPCode            string
--- a/adapter/network.go
+++ b/adapter/network.go
@@ -28,7 +28,7 @@ type NetworkManager interface {
 }

 type NetworkOptions struct {
-	NetworkStrategy     *C.NetworkStrategy
+	NetworkStrategy     C.NetworkStrategy
 	NetworkType         []C.InterfaceType
 	FallbackNetworkType []C.InterfaceType
 	FallbackDelay       time.Duration
--- a/adapter/outbound/manager.go
+++ b/adapter/outbound/manager.go
@@ -23,7 +23,7 @@ type Manager struct {
 	registry                adapter.OutboundRegistry
 	endpoint                adapter.EndpointManager
 	defaultTag              string
-	access                  sync.RWMutex
+	access                  sync.Mutex
 	started                 bool
 	stage                   adapter.StartStage
 	outbounds               []adapter.Outbound
@@ -169,15 +169,15 @@ func (m *Manager) Close() error {
 }

 func (m *Manager) Outbounds() []adapter.Outbound {
-	m.access.RLock()
-	defer m.access.RUnlock()
+	m.access.Lock()
+	defer m.access.Unlock()
 	return m.outbounds
 }

 func (m *Manager) Outbound(tag string) (adapter.Outbound, bool) {
-	m.access.RLock()
+	m.access.Lock()
 	outbound, found := m.outboundByTag[tag]
-	m.access.RUnlock()
+	m.access.Unlock()
 	if found {
 		return outbound, true
 	}
@@ -185,8 +185,8 @@ func (m *Manager) Outbound(tag string) (adapter.Outbound, bool) {
 }

 func (m *Manager) Default() adapter.Outbound {
-	m.access.RLock()
-	defer m.access.RUnlock()
+	m.access.Lock()
+	defer m.access.Unlock()
 	if m.defaultOutbound != nil {
 		return m.defaultOutbound
 	} else {
@@ -196,9 +196,9 @@ func (m *Manager) Default() adapter.Outbound {

 func (m *Manager) Remove(tag string) error {
 	m.access.Lock()
-	defer m.access.Unlock()
 	outbound, found := m.outboundByTag[tag]
 	if !found {
+		m.access.Unlock()
 		return os.ErrInvalid
 	}
 	delete(m.outboundByTag, tag)
@@ -232,6 +232,7 @@ func (m *Manager) Remove(tag string) error {
 			})
 		}
 	}
+	m.access.Unlock()
 	if started {
 		return common.Close(outbound)
 	}
--- a/adapter/router.go
+++ b/adapter/router.go
@@ -4,25 +4,42 @@ import (
 	"context"
 	"net"
 	"net/http"
+	"net/netip"
 	"sync"

+	"github.com/sagernet/sing-box/common/geoip"
 	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-dns"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/common/x/list"

+	mdns "github.com/miekg/dns"
 	"go4.org/netipx"
 )

 type Router interface {
 	Lifecycle
+
+	FakeIPStore() FakeIPStore
+
 	ConnectionRouter
 	PreMatch(metadata InboundContext) error
 	ConnectionRouterEx
+
+	GeoIPReader() *geoip.Reader
+	LoadGeosite(code string) (Rule, error)
 	RuleSet(tag string) (RuleSet, bool)
 	NeedWIFIState() bool
+
+	Exchange(ctx context.Context, message *mdns.Msg) (*mdns.Msg, error)
+	Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error)
+	LookupDefault(ctx context.Context, domain string) ([]netip.Addr, error)
+	ClearDNSCache()
 	Rules() []Rule
+
 	SetTracker(tracker ConnectionTracker)
+
 	ResetNetwork()
 }

--- a/adapter/rule.go
+++ b/adapter/rule.go
@@ -13,6 +13,7 @@ type Rule interface {
 	HeadlessRule
 	Service
 	Type() string
+	UpdateGeosite() error
 	Action() RuleAction
 }

--- a/box.go
+++ b/box.go
@@ -14,10 +14,7 @@ import (
 	"github.com/sagernet/sing-box/adapter/outbound"
 	"github.com/sagernet/sing-box/common/dialer"
 	"github.com/sagernet/sing-box/common/taskmonitor"
-	"github.com/sagernet/sing-box/common/tls"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/dns/transport/local"
 	"github.com/sagernet/sing-box/experimental"
 	"github.com/sagernet/sing-box/experimental/cachefile"
 	"github.com/sagernet/sing-box/experimental/libbox/platform"
@@ -36,19 +33,17 @@ import (
 var _ adapter.Service = (*Box)(nil)

 type Box struct {
-	createdAt    time.Time
-	logFactory   log.Factory
-	logger       log.ContextLogger
-	network      *route.NetworkManager
-	endpoint     *endpoint.Manager
-	inbound      *inbound.Manager
-	outbound     *outbound.Manager
-	dnsTransport *dns.TransportManager
-	dnsRouter    *dns.Router
-	connection   *route.ConnectionManager
-	router       *route.Router
-	services     []adapter.LifecycleService
-	done         chan struct{}
+	createdAt  time.Time
+	logFactory log.Factory
+	logger     log.ContextLogger
+	network    *route.NetworkManager
+	endpoint   *endpoint.Manager
+	inbound    *inbound.Manager
+	outbound   *outbound.Manager
+	connection *route.ConnectionManager
+	router     *route.Router
+	services   []adapter.LifecycleService
+	done       chan struct{}
 }

 type Options struct {
@@ -62,7 +57,6 @@ func Context(
 	inboundRegistry adapter.InboundRegistry,
 	outboundRegistry adapter.OutboundRegistry,
 	endpointRegistry adapter.EndpointRegistry,
-	dnsTransportRegistry adapter.DNSTransportRegistry,
 ) context.Context {
 	if service.FromContext[option.InboundOptionsRegistry](ctx) == nil ||
 		service.FromContext[adapter.InboundRegistry](ctx) == nil {
@@ -79,10 +73,6 @@ func Context(
 		ctx = service.ContextWith[option.EndpointOptionsRegistry](ctx, endpointRegistry)
 		ctx = service.ContextWith[adapter.EndpointRegistry](ctx, endpointRegistry)
 	}
-	if service.FromContext[adapter.DNSTransportRegistry](ctx) == nil {
-		ctx = service.ContextWith[option.DNSTransportOptionsRegistry](ctx, dnsTransportRegistry)
-		ctx = service.ContextWith[adapter.DNSTransportRegistry](ctx, dnsTransportRegistry)
-	}
 	return ctx
 }

@@ -97,7 +87,6 @@ func New(options Options) (*Box, error) {
 	endpointRegistry := service.FromContext[adapter.EndpointRegistry](ctx)
 	inboundRegistry := service.FromContext[adapter.InboundRegistry](ctx)
 	outboundRegistry := service.FromContext[adapter.OutboundRegistry](ctx)
-	dnsTransportRegistry := service.FromContext[adapter.DNSTransportRegistry](ctx)

 	if endpointRegistry == nil {
 		return nil, E.New("missing endpoint registry in context")
@@ -142,17 +131,13 @@ func New(options Options) (*Box, error) {
 	}

 	routeOptions := common.PtrValueOrDefault(options.Route)
-	dnsOptions := common.PtrValueOrDefault(options.DNS)
 	endpointManager := endpoint.NewManager(logFactory.NewLogger("endpoint"), endpointRegistry)
 	inboundManager := inbound.NewManager(logFactory.NewLogger("inbound"), inboundRegistry, endpointManager)
 	outboundManager := outbound.NewManager(logFactory.NewLogger("outbound"), outboundRegistry, endpointManager, routeOptions.Final)
-	dnsTransportManager := dns.NewTransportManager(logFactory.NewLogger("dns/transport"), dnsTransportRegistry, outboundManager, dnsOptions.Final)
 	service.MustRegister[adapter.EndpointManager](ctx, endpointManager)
 	service.MustRegister[adapter.InboundManager](ctx, inboundManager)
 	service.MustRegister[adapter.OutboundManager](ctx, outboundManager)
-	service.MustRegister[adapter.DNSTransportManager](ctx, dnsTransportManager)
-	dnsRouter := dns.NewRouter(ctx, logFactory, dnsOptions)
-	service.MustRegister[adapter.DNSRouter](ctx, dnsRouter)
+
 	networkManager, err := route.NewNetworkManager(ctx, logFactory.NewLogger("network"), routeOptions)
 	if err != nil {
 		return nil, E.Cause(err, "initialize network manager")
@@ -160,40 +145,10 @@ func New(options Options) (*Box, error) {
 	service.MustRegister[adapter.NetworkManager](ctx, networkManager)
 	connectionManager := route.NewConnectionManager(logFactory.NewLogger("connection"))
 	service.MustRegister[adapter.ConnectionManager](ctx, connectionManager)
-	router := route.NewRouter(ctx, logFactory, routeOptions, dnsOptions)
-	service.MustRegister[adapter.Router](ctx, router)
-	err = router.Initialize(routeOptions.Rules, routeOptions.RuleSet)
+	router, err := route.NewRouter(ctx, logFactory, routeOptions, common.PtrValueOrDefault(options.DNS))
 	if err != nil {
 		return nil, E.Cause(err, "initialize router")
 	}
-	ntpOptions := common.PtrValueOrDefault(options.NTP)
-	var timeService *tls.TimeServiceWrapper
-	if ntpOptions.Enabled {
-		timeService = new(tls.TimeServiceWrapper)
-		service.MustRegister[ntp.TimeService](ctx, timeService)
-	}
-	for i, transportOptions := range dnsOptions.Servers {
-		var tag string
-		if transportOptions.Tag != "" {
-			tag = transportOptions.Tag
-		} else {
-			tag = F.ToString(i)
-		}
-		err = dnsTransportManager.Create(
-			ctx,
-			logFactory.NewLogger(F.ToString("dns/", transportOptions.Type, "[", tag, "]")),
-			tag,
-			transportOptions.Type,
-			transportOptions.Options,
-		)
-		if err != nil {
-			return nil, E.Cause(err, "initialize inbound[", i, "]")
-		}
-	}
-	err = dnsRouter.Initialize(dnsOptions.Rules)
-	if err != nil {
-		return nil, E.Cause(err, "initialize dns router")
-	}
 	for i, endpointOptions := range options.Endpoints {
 		var tag string
 		if endpointOptions.Tag != "" {
@@ -201,8 +156,7 @@ func New(options Options) (*Box, error) {
 		} else {
 			tag = F.ToString(i)
 		}
-		err = endpointManager.Create(
-			ctx,
+		err = endpointManager.Create(ctx,
 			router,
 			logFactory.NewLogger(F.ToString("endpoint/", endpointOptions.Type, "[", tag, "]")),
 			tag,
@@ -220,8 +174,7 @@ func New(options Options) (*Box, error) {
 		} else {
 			tag = F.ToString(i)
 		}
-		err = inboundManager.Create(
-			ctx,
+		err = inboundManager.Create(ctx,
 			router,
 			logFactory.NewLogger(F.ToString("inbound/", inboundOptions.Type, "[", tag, "]")),
 			tag,
@@ -267,13 +220,6 @@ func New(options Options) (*Box, error) {
 			option.DirectOutboundOptions{},
 		),
 	))
-	dnsTransportManager.Initialize(common.Must1(
-		local.NewTransport(
-			ctx,
-			logFactory.NewLogger("dns/local"),
-			"local",
-			option.LocalDNSServerOptions{},
-		)))
 	if platformInterface != nil {
 		err = platformInterface.Initialize(networkManager)
 		if err != nil {
@@ -308,12 +254,13 @@ func New(options Options) (*Box, error) {
 			service.MustRegister[adapter.V2RayServer](ctx, v2rayServer)
 		}
 	}
+	ntpOptions := common.PtrValueOrDefault(options.NTP)
 	if ntpOptions.Enabled {
-		ntpDialer, err := dialer.New(ctx, ntpOptions.DialerOptions, ntpOptions.ServerIsDomain())
+		ntpDialer, err := dialer.New(ctx, ntpOptions.DialerOptions)
 		if err != nil {
 			return nil, E.Cause(err, "create NTP service")
 		}
-		ntpService := ntp.NewService(ntp.Options{
+		timeService := ntp.NewService(ntp.Options{
 			Context:       ctx,
 			Dialer:        ntpDialer,
 			Logger:        logFactory.NewLogger("ntp"),
@@ -321,23 +268,21 @@ func New(options Options) (*Box, error) {
 			Interval:      time.Duration(ntpOptions.Interval),
 			WriteToSystem: ntpOptions.WriteToSystem,
 		})
-		timeService.TimeService = ntpService
-		services = append(services, adapter.NewLifecycleService(ntpService, "ntp service"))
+		service.MustRegister[ntp.TimeService](ctx, timeService)
+		services = append(services, adapter.NewLifecycleService(timeService, "ntp service"))
 	}
 	return &Box{
-		network:      networkManager,
-		endpoint:     endpointManager,
-		inbound:      inboundManager,
-		outbound:     outboundManager,
-		dnsTransport: dnsTransportManager,
-		dnsRouter:    dnsRouter,
-		connection:   connectionManager,
-		router:       router,
-		createdAt:    createdAt,
-		logFactory:   logFactory,
-		logger:       logFactory.Logger(),
-		services:     services,
-		done:         make(chan struct{}),
+		network:    networkManager,
+		endpoint:   endpointManager,
+		inbound:    inboundManager,
+		outbound:   outboundManager,
+		connection: connectionManager,
+		router:     router,
+		createdAt:  createdAt,
+		logFactory: logFactory,
+		logger:     logFactory.Logger(),
+		services:   services,
+		done:       make(chan struct{}),
 	}, nil
 }

@@ -391,11 +336,11 @@ func (s *Box) preStart() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(adapter.StartStateInitialize, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint)
+	err = adapter.Start(adapter.StartStateInitialize, s.network, s.connection, s.router, s.outbound, s.inbound, s.endpoint)
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(adapter.StartStateStart, s.outbound, s.dnsTransport, s.dnsRouter, s.network, s.connection, s.router)
+	err = adapter.Start(adapter.StartStateStart, s.outbound, s.network, s.connection, s.router)
 	if err != nil {
 		return err
 	}
@@ -419,7 +364,7 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(adapter.StartStatePostStart, s.outbound, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.inbound, s.endpoint)
+	err = adapter.Start(adapter.StartStatePostStart, s.outbound, s.network, s.connection, s.router, s.inbound, s.endpoint)
 	if err != nil {
 		return err
 	}
@@ -427,7 +372,7 @@ func (s *Box) start() error {
 	if err != nil {
 		return err
 	}
-	err = adapter.Start(adapter.StartStateStarted, s.network, s.dnsTransport, s.dnsRouter, s.connection, s.router, s.outbound, s.inbound, s.endpoint)
+	err = adapter.Start(adapter.StartStateStarted, s.network, s.connection, s.router, s.outbound, s.inbound, s.endpoint)
 	if err != nil {
 		return err
 	}
@@ -446,7 +391,7 @@ func (s *Box) Close() error {
 		close(s.done)
 	}
 	err := common.Close(
-		s.inbound, s.outbound, s.endpoint, s.router, s.connection, s.dnsRouter, s.dnsTransport, s.network,
+		s.inbound, s.outbound, s.router, s.connection, s.network,
 	)
 	for _, lifecycleService := range s.services {
 		err = E.Append(err, lifecycleService.Close(), func(err error) error {
--- a/clients/android
+++ b/clients/android
--- a/clients/apple
+++ b/clients/apple
--- a/cmd/internal/app_store_connect/main.go
+++ b/cmd/internal/app_store_connect/main.go
@@ -1,445 +0,0 @@
-package main
-
-import (
-	"context"
-	"net/http"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/sagernet/asc-go/asc"
-	"github.com/sagernet/sing-box/cmd/internal/build_shared"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-)
-
-func main() {
-	ctx := context.Background()
-	switch os.Args[1] {
-	case "next_macos_project_version":
-		err := fetchMacOSVersion(ctx)
-		if err != nil {
-			log.Fatal(err)
-		}
-	case "publish_testflight":
-		err := publishTestflight(ctx)
-		if err != nil {
-			log.Fatal(err)
-		}
-	case "cancel_app_store":
-		err := cancelAppStore(ctx, os.Args[2])
-		if err != nil {
-			log.Fatal(err)
-		}
-	case "prepare_app_store":
-		err := prepareAppStore(ctx)
-		if err != nil {
-			log.Fatal(err)
-		}
-	case "publish_app_store":
-		err := publishAppStore(ctx)
-		if err != nil {
-			log.Fatal(err)
-		}
-	default:
-		log.Fatal("unknown action: ", os.Args[1])
-	}
-}
-
-const (
-	appID   = "6673731168"
-	groupID = "5c5f3b78-b7a0-40c0-bcad-e6ef87bbefda"
-)
-
-func createClient(expireDuration time.Duration) *asc.Client {
-	privateKey, err := os.ReadFile(os.Getenv("ASC_KEY_PATH"))
-	if err != nil {
-		log.Fatal(err)
-	}
-	tokenConfig, err := asc.NewTokenConfig(os.Getenv("ASC_KEY_ID"), os.Getenv("ASC_KEY_ISSUER_ID"), expireDuration, privateKey)
-	if err != nil {
-		log.Fatal(err)
-	}
-	return asc.NewClient(tokenConfig.Client())
-}
-
-func fetchMacOSVersion(ctx context.Context) error {
-	client := createClient(time.Minute)
-	versions, _, err := client.Apps.ListAppStoreVersionsForApp(ctx, appID, &asc.ListAppStoreVersionsQuery{
-		FilterPlatform: []string{"MAC_OS"},
-	})
-	if err != nil {
-		return err
-	}
-	var versionID string
-findVersion:
-	for _, version := range versions.Data {
-		switch *version.Attributes.AppStoreState {
-		case asc.AppStoreVersionStateReadyForSale,
-			asc.AppStoreVersionStatePendingDeveloperRelease:
-			versionID = version.ID
-			break findVersion
-		}
-	}
-	if versionID == "" {
-		return E.New("no version found")
-	}
-	latestBuild, _, err := client.Builds.GetBuildForAppStoreVersion(ctx, versionID, &asc.GetBuildForAppStoreVersionQuery{})
-	if err != nil {
-		return err
-	}
-	versionInt, err := strconv.Atoi(*latestBuild.Data.Attributes.Version)
-	if err != nil {
-		return E.Cause(err, "parse version code")
-	}
-	os.Stdout.WriteString(F.ToString(versionInt+1, "\n"))
-	return nil
-}
-
-func publishTestflight(ctx context.Context) error {
-	tagVersion, err := build_shared.ReadTagVersion()
-	if err != nil {
-		return err
-	}
-	tag := tagVersion.VersionString()
-	client := createClient(10 * time.Minute)
-
-	log.Info(tag, " list build IDs")
-	buildIDsResponse, _, err := client.TestFlight.ListBuildIDsForBetaGroup(ctx, groupID, nil)
-	if err != nil {
-		return err
-	}
-	buildIDs := common.Map(buildIDsResponse.Data, func(it asc.RelationshipData) string {
-		return it.ID
-	})
-	var platforms []asc.Platform
-	if len(os.Args) == 3 {
-		switch os.Args[2] {
-		case "ios":
-			platforms = []asc.Platform{asc.PlatformIOS}
-		case "macos":
-			platforms = []asc.Platform{asc.PlatformMACOS}
-		case "tvos":
-			platforms = []asc.Platform{asc.PlatformTVOS}
-		default:
-			return E.New("unknown platform: ", os.Args[2])
-		}
-	} else {
-		platforms = []asc.Platform{
-			asc.PlatformIOS,
-			asc.PlatformMACOS,
-			asc.PlatformTVOS,
-		}
-	}
-	for _, platform := range platforms {
-		log.Info(string(platform), " list builds")
-		for {
-			builds, _, err := client.Builds.ListBuilds(ctx, &asc.ListBuildsQuery{
-				FilterApp:                       []string{appID},
-				FilterPreReleaseVersionPlatform: []string{string(platform)},
-			})
-			if err != nil {
-				return err
-			}
-			build := builds.Data[0]
-			if common.Contains(buildIDs, build.ID) || time.Since(build.Attributes.UploadedDate.Time) > 5*time.Minute {
-				log.Info(string(platform), " ", tag, " waiting for process")
-				time.Sleep(15 * time.Second)
-				continue
-			}
-			if *build.Attributes.ProcessingState != "VALID" {
-				log.Info(string(platform), " ", tag, " waiting for process: ", *build.Attributes.ProcessingState)
-				time.Sleep(15 * time.Second)
-				continue
-			}
-			log.Info(string(platform), " ", tag, " list localizations")
-			localizations, _, err := client.TestFlight.ListBetaBuildLocalizationsForBuild(ctx, build.ID, nil)
-			if err != nil {
-				return err
-			}
-			localization := common.Find(localizations.Data, func(it asc.BetaBuildLocalization) bool {
-				return *it.Attributes.Locale == "en-US"
-			})
-			if localization.ID == "" {
-				log.Fatal(string(platform), " ", tag, " no en-US localization found")
-			}
-			if localization.Attributes == nil || localization.Attributes.WhatsNew == nil || *localization.Attributes.WhatsNew == "" {
-				log.Info(string(platform), " ", tag, " update localization")
-				_, _, err = client.TestFlight.UpdateBetaBuildLocalization(ctx, localization.ID, common.Ptr(
-					F.ToString("sing-box ", tagVersion.String()),
-				))
-				if err != nil {
-					return err
-				}
-			}
-			log.Info(string(platform), " ", tag, " publish")
-			response, err := client.TestFlight.AddBuildsToBetaGroup(ctx, groupID, []string{build.ID})
-			if response != nil && response.StatusCode == http.StatusUnprocessableEntity {
-				log.Info("waiting for process")
-				time.Sleep(15 * time.Second)
-				continue
-			} else if err != nil {
-				return err
-			}
-			log.Info(string(platform), " ", tag, " list submissions")
-			betaSubmissions, _, err := client.TestFlight.ListBetaAppReviewSubmissions(ctx, &asc.ListBetaAppReviewSubmissionsQuery{
-				FilterBuild: []string{build.ID},
-			})
-			if err != nil {
-				return err
-			}
-			if len(betaSubmissions.Data) == 0 {
-				log.Info(string(platform), " ", tag, " create submission")
-				_, _, err = client.TestFlight.CreateBetaAppReviewSubmission(ctx, build.ID)
-				if err != nil {
-					return err
-				}
-			}
-			break
-		}
-	}
-	return nil
-}
-
-func cancelAppStore(ctx context.Context, platform string) error {
-	switch platform {
-	case "ios":
-		platform = string(asc.PlatformIOS)
-	case "macos":
-		platform = string(asc.PlatformMACOS)
-	case "tvos":
-		platform = string(asc.PlatformTVOS)
-	}
-	tag, err := build_shared.ReadTag()
-	if err != nil {
-		return err
-	}
-	client := createClient(time.Minute)
-	for {
-		log.Info(platform, " list versions")
-		versions, response, err := client.Apps.ListAppStoreVersionsForApp(ctx, appID, &asc.ListAppStoreVersionsQuery{
-			FilterPlatform: []string{string(platform)},
-		})
-		if isRetryable(response) {
-			continue
-		} else if err != nil {
-			return err
-		}
-		version := common.Find(versions.Data, func(it asc.AppStoreVersion) bool {
-			return *it.Attributes.VersionString == tag
-		})
-		if version.ID == "" {
-			return nil
-		}
-		log.Info(platform, " ", tag, " get submission")
-		submission, response, err := client.Submission.GetAppStoreVersionSubmissionForAppStoreVersion(ctx, version.ID, nil)
-		if response != nil && response.StatusCode == http.StatusNotFound {
-			return nil
-		}
-		if isRetryable(response) {
-			continue
-		} else if err != nil {
-			return err
-		}
-		log.Info(platform, " ", tag, " delete submission")
-		_, err = client.Submission.DeleteSubmission(ctx, submission.Data.ID)
-		if err != nil {
-			return err
-		}
-		return nil
-	}
-}
-
-func prepareAppStore(ctx context.Context) error {
-	tag, err := build_shared.ReadTag()
-	if err != nil {
-		return err
-	}
-	client := createClient(time.Minute)
-	for _, platform := range []asc.Platform{
-		asc.PlatformIOS,
-		asc.PlatformMACOS,
-		asc.PlatformTVOS,
-	} {
-		log.Info(string(platform), " list versions")
-		versions, _, err := client.Apps.ListAppStoreVersionsForApp(ctx, appID, &asc.ListAppStoreVersionsQuery{
-			FilterPlatform: []string{string(platform)},
-		})
-		if err != nil {
-			return err
-		}
-		version := common.Find(versions.Data, func(it asc.AppStoreVersion) bool {
-			return *it.Attributes.VersionString == tag
-		})
-		log.Info(string(platform), " ", tag, " list builds")
-		builds, _, err := client.Builds.ListBuilds(ctx, &asc.ListBuildsQuery{
-			FilterApp:                       []string{appID},
-			FilterPreReleaseVersionPlatform: []string{string(platform)},
-		})
-		if err != nil {
-			return err
-		}
-		if len(builds.Data) == 0 {
-			log.Fatal(platform, " ", tag, " no build found")
-		}
-		buildID := common.Ptr(builds.Data[0].ID)
-		if version.ID == "" {
-			log.Info(string(platform), " ", tag, " create version")
-			newVersion, _, err := client.Apps.CreateAppStoreVersion(ctx, asc.AppStoreVersionCreateRequestAttributes{
-				Platform:      platform,
-				VersionString: tag,
-			}, appID, buildID)
-			if err != nil {
-				return err
-			}
-			version = newVersion.Data
-
-		} else {
-			log.Info(string(platform), " ", tag, " check build")
-			currentBuild, response, err := client.Apps.GetBuildIDForAppStoreVersion(ctx, version.ID)
-			if err != nil {
-				return err
-			}
-			if response.StatusCode != http.StatusOK || currentBuild.Data.ID != *buildID {
-				switch *version.Attributes.AppStoreState {
-				case asc.AppStoreVersionStatePrepareForSubmission,
-					asc.AppStoreVersionStateRejected,
-					asc.AppStoreVersionStateDeveloperRejected:
-				case asc.AppStoreVersionStateWaitingForReview,
-					asc.AppStoreVersionStateInReview,
-					asc.AppStoreVersionStatePendingDeveloperRelease:
-					submission, _, err := client.Submission.GetAppStoreVersionSubmissionForAppStoreVersion(ctx, version.ID, nil)
-					if err != nil {
-						return err
-					}
-					if submission != nil {
-						log.Info(string(platform), " ", tag, " delete submission")
-						_, err = client.Submission.DeleteSubmission(ctx, submission.Data.ID)
-						if err != nil {
-							return err
-						}
-						time.Sleep(5 * time.Second)
-					}
-				default:
-					log.Fatal(string(platform), " ", tag, " unknown state ", string(*version.Attributes.AppStoreState))
-				}
-				log.Info(string(platform), " ", tag, " update build")
-				response, err = client.Apps.UpdateBuildForAppStoreVersion(ctx, version.ID, buildID)
-				if err != nil {
-					return err
-				}
-				if response.StatusCode != http.StatusNoContent {
-					response.Write(os.Stderr)
-					log.Fatal(string(platform), " ", tag, " unexpected response: ", response.Status)
-				}
-			} else {
-				switch *version.Attributes.AppStoreState {
-				case asc.AppStoreVersionStatePrepareForSubmission,
-					asc.AppStoreVersionStateRejected,
-					asc.AppStoreVersionStateDeveloperRejected:
-				case asc.AppStoreVersionStateWaitingForReview,
-					asc.AppStoreVersionStateInReview,
-					asc.AppStoreVersionStatePendingDeveloperRelease:
-					continue
-				default:
-					log.Fatal(string(platform), " ", tag, " unknown state ", string(*version.Attributes.AppStoreState))
-				}
-			}
-		}
-		log.Info(string(platform), " ", tag, " list localization")
-		localizations, _, err := client.Apps.ListLocalizationsForAppStoreVersion(ctx, version.ID, nil)
-		if err != nil {
-			return err
-		}
-		localization := common.Find(localizations.Data, func(it asc.AppStoreVersionLocalization) bool {
-			return *it.Attributes.Locale == "en-US"
-		})
-		if localization.ID == "" {
-			log.Info(string(platform), " ", tag, " no en-US localization found")
-		}
-		if localization.Attributes == nil || localization.Attributes.WhatsNew == nil || *localization.Attributes.WhatsNew == "" {
-			log.Info(string(platform), " ", tag, " update localization")
-			_, _, err = client.Apps.UpdateAppStoreVersionLocalization(ctx, localization.ID, &asc.AppStoreVersionLocalizationUpdateRequestAttributes{
-				PromotionalText: common.Ptr("Yet another distribution for sing-box, the universal proxy platform."),
-				WhatsNew:        common.Ptr(F.ToString("sing-box ", tag, ": Fixes and improvements.")),
-			})
-			if err != nil {
-				return err
-			}
-		}
-		log.Info(string(platform), " ", tag, " create submission")
-	fixSubmit:
-		for {
-			_, response, err := client.Submission.CreateSubmission(ctx, version.ID)
-			if err != nil {
-				switch response.StatusCode {
-				case http.StatusInternalServerError:
-					continue
-				default:
-					return err
-				}
-			}
-			switch response.StatusCode {
-			case http.StatusCreated:
-				break fixSubmit
-			default:
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func publishAppStore(ctx context.Context) error {
-	tag, err := build_shared.ReadTag()
-	if err != nil {
-		return err
-	}
-	client := createClient(time.Minute)
-	for _, platform := range []asc.Platform{
-		asc.PlatformIOS,
-		asc.PlatformMACOS,
-		asc.PlatformTVOS,
-	} {
-		log.Info(string(platform), " list versions")
-		versions, _, err := client.Apps.ListAppStoreVersionsForApp(ctx, appID, &asc.ListAppStoreVersionsQuery{
-			FilterPlatform: []string{string(platform)},
-		})
-		if err != nil {
-			return err
-		}
-		version := common.Find(versions.Data, func(it asc.AppStoreVersion) bool {
-			return *it.Attributes.VersionString == tag
-		})
-		switch *version.Attributes.AppStoreState {
-		case asc.AppStoreVersionStatePrepareForSubmission, asc.AppStoreVersionStateDeveloperRejected:
-			log.Fatal(string(platform), " ", tag, " not submitted")
-		case asc.AppStoreVersionStateWaitingForReview,
-			asc.AppStoreVersionStateInReview:
-			log.Warn(string(platform), " ", tag, " waiting for review")
-			continue
-		case asc.AppStoreVersionStatePendingDeveloperRelease:
-		default:
-			log.Fatal(string(platform), " ", tag, " unknown state ", string(*version.Attributes.AppStoreState))
-		}
-		_, _, err = client.Publishing.CreatePhasedRelease(ctx, common.Ptr(asc.PhasedReleaseStateComplete), version.ID)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func isRetryable(response *asc.Response) bool {
-	if response == nil {
-		return false
-	}
-	switch response.StatusCode {
-	case http.StatusInternalServerError, http.StatusUnprocessableEntity:
-		return true
-	default:
-		return false
-	}
-}
--- a/cmd/internal/build_libbox/main.go
+++ b/cmd/internal/build_libbox/main.go
@@ -18,13 +18,11 @@ import (
 var (
 	debugEnabled bool
 	target       string
-	platform     string
 )

 func init() {
 	flag.BoolVar(&debugEnabled, "debug", false, "enable debug")
 	flag.StringVar(&target, "target", "android", "target platform")
-	flag.StringVar(&platform, "platform", "", "specify platform")
 }

 func main() {
@@ -35,8 +33,8 @@ func main() {
 	switch target {
 	case "android":
 		buildAndroid()
-	case "apple":
-		buildApple()
+	case "ios":
+		buildiOS()
 	}
 }

@@ -83,9 +81,7 @@ func buildAndroid() {
 	}

 	var bindTarget string
-	if platform != "" {
-		bindTarget = platform
-	} else if debugEnabled {
+	if debugEnabled {
 		bindTarget = "android/arm64"
 	} else {
 		bindTarget = "android"
@@ -133,14 +129,12 @@ func buildAndroid() {
 	}
 }

-func buildApple() {
+func buildiOS() {
 	var bindTarget string
-	if platform != "" {
-		bindTarget = platform
-	} else if debugEnabled {
+	if debugEnabled {
 		bindTarget = "ios"
 	} else {
-		bindTarget = "ios,tvos,macos"
+		bindTarget = "ios,iossimulator,tvos,tvossimulator,macos"
 	}

 	args := []string{
--- a/cmd/internal/build_shared/tag.go
+++ b/cmd/internal/build_shared/tag.go
@@ -36,3 +36,11 @@ func ReadTagVersion() (badversion.Version, error) {
 	}
 	return version, nil
 }
+
+func IsDevBranch() bool {
+	branch, err := shell.Exec("git", "branch", "--show-current").ReadOutput()
+	if err != nil {
+		return false
+	}
+	return branch == "dev-next"
+}
--- a/cmd/internal/read_tag/main.go
+++ b/cmd/internal/read_tag/main.go
@@ -6,6 +6,7 @@ import (

 	"github.com/sagernet/sing-box/cmd/internal/build_shared"
 	"github.com/sagernet/sing-box/log"
+	F "github.com/sagernet/sing/common/format"
 )

 var nightly bool
@@ -21,14 +22,25 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		var versionStr string
+		var (
+			versionStr   string
+			isPrerelease bool
+		)
 		if version.PreReleaseIdentifier != "" {
+			isPrerelease = true
 			versionStr = version.VersionString() + "-nightly"
 		} else {
 			version.Patch++
 			versionStr = version.VersionString() + "-nightly"
 		}
-		err = setGitHubEnv("version", versionStr)
+		if build_shared.IsDevBranch() {
+			isPrerelease = true
+		}
+		err = setGitHubOutput("version", versionStr)
+		if err != nil {
+			log.Fatal(err)
+		}
+		err = setGitHubOutput("prerelease", F.ToString(isPrerelease))
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -43,7 +55,7 @@ func main() {
 	}
 }

-func setGitHubEnv(name string, value string) error {
+func setGitHubOutput(name string, value string) error {
 	outputFile, err := os.OpenFile(os.Getenv("GITHUB_ENV"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
 	if err != nil {
 		return err
--- a/cmd/sing-box/cmd.go
+++ b/cmd/sing-box/cmd.go
@@ -69,5 +69,5 @@ func preRun(cmd *cobra.Command, args []string) {
 		configPaths = append(configPaths, "config.json")
 	}
 	globalCtx = service.ContextWith(globalCtx, deprecated.NewStderrManager(log.StdLogger()))
-	globalCtx = box.Context(globalCtx, include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry(), include.DNSTransportRegistry())
+	globalCtx = box.Context(globalCtx, include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry())
 }
--- a/cmd/sing-box/cmd_merge.go
+++ b/cmd/sing-box/cmd_merge.go
@@ -18,7 +18,7 @@ import (
 )

 var commandMerge = &cobra.Command{
-	Use:   "merge <output-path>",
+	Use:   "merge <output>",
 	Short: "Merge configurations",
 	Run: func(cmd *cobra.Command, args []string) {
 		err := merge(args[0])
--- a/cmd/sing-box/cmd_rule_set_merge.go
+++ b/cmd/sing-box/cmd_rule_set_merge.go
@@ -1,162 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/json"
-	"github.com/sagernet/sing/common/json/badjson"
-	"github.com/sagernet/sing/common/rw"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	ruleSetPaths       []string
-	ruleSetDirectories []string
-)
-
-var commandRuleSetMerge = &cobra.Command{
-	Use:   "merge <output-path>",
-	Short: "Merge rule-set source files",
-	Run: func(cmd *cobra.Command, args []string) {
-		err := mergeRuleSet(args[0])
-		if err != nil {
-			log.Fatal(err)
-		}
-	},
-	Args: cobra.ExactArgs(1),
-}
-
-func init() {
-	commandRuleSetMerge.Flags().StringArrayVarP(&ruleSetPaths, "config", "c", nil, "set input rule-set file path")
-	commandRuleSetMerge.Flags().StringArrayVarP(&ruleSetDirectories, "config-directory", "C", nil, "set input rule-set directory path")
-	commandRuleSet.AddCommand(commandRuleSetMerge)
-}
-
-type RuleSetEntry struct {
-	content []byte
-	path    string
-	options option.PlainRuleSetCompat
-}
-
-func readRuleSetAt(path string) (*RuleSetEntry, error) {
-	var (
-		configContent []byte
-		err           error
-	)
-	if path == "stdin" {
-		configContent, err = io.ReadAll(os.Stdin)
-	} else {
-		configContent, err = os.ReadFile(path)
-	}
-	if err != nil {
-		return nil, E.Cause(err, "read config at ", path)
-	}
-	options, err := json.UnmarshalExtendedContext[option.PlainRuleSetCompat](globalCtx, configContent)
-	if err != nil {
-		return nil, E.Cause(err, "decode config at ", path)
-	}
-	return &RuleSetEntry{
-		content: configContent,
-		path:    path,
-		options: options,
-	}, nil
-}
-
-func readRuleSet() ([]*RuleSetEntry, error) {
-	var optionsList []*RuleSetEntry
-	for _, path := range ruleSetPaths {
-		optionsEntry, err := readRuleSetAt(path)
-		if err != nil {
-			return nil, err
-		}
-		optionsList = append(optionsList, optionsEntry)
-	}
-	for _, directory := range ruleSetDirectories {
-		entries, err := os.ReadDir(directory)
-		if err != nil {
-			return nil, E.Cause(err, "read rule-set directory at ", directory)
-		}
-		for _, entry := range entries {
-			if !strings.HasSuffix(entry.Name(), ".json") || entry.IsDir() {
-				continue
-			}
-			optionsEntry, err := readRuleSetAt(filepath.Join(directory, entry.Name()))
-			if err != nil {
-				return nil, err
-			}
-			optionsList = append(optionsList, optionsEntry)
-		}
-	}
-	sort.Slice(optionsList, func(i, j int) bool {
-		return optionsList[i].path < optionsList[j].path
-	})
-	return optionsList, nil
-}
-
-func readRuleSetAndMerge() (option.PlainRuleSetCompat, error) {
-	optionsList, err := readRuleSet()
-	if err != nil {
-		return option.PlainRuleSetCompat{}, err
-	}
-	if len(optionsList) == 1 {
-		return optionsList[0].options, nil
-	}
-	var optionVersion uint8
-	for _, options := range optionsList {
-		if optionVersion < options.options.Version {
-			optionVersion = options.options.Version
-		}
-	}
-	var mergedMessage json.RawMessage
-	for _, options := range optionsList {
-		mergedMessage, err = badjson.MergeJSON(globalCtx, options.options.RawMessage, mergedMessage, false)
-		if err != nil {
-			return option.PlainRuleSetCompat{}, E.Cause(err, "merge config at ", options.path)
-		}
-	}
-	mergedOptions, err := json.UnmarshalExtendedContext[option.PlainRuleSetCompat](globalCtx, mergedMessage)
-	if err != nil {
-		return option.PlainRuleSetCompat{}, E.Cause(err, "unmarshal merged config")
-	}
-	mergedOptions.Version = optionVersion
-	return mergedOptions, nil
-}
-
-func mergeRuleSet(outputPath string) error {
-	mergedOptions, err := readRuleSetAndMerge()
-	if err != nil {
-		return err
-	}
-	buffer := new(bytes.Buffer)
-	encoder := json.NewEncoder(buffer)
-	encoder.SetIndent("", "  ")
-	err = encoder.Encode(mergedOptions)
-	if err != nil {
-		return E.Cause(err, "encode config")
-	}
-	if existsContent, err := os.ReadFile(outputPath); err != nil {
-		if string(existsContent) == buffer.String() {
-			return nil
-		}
-	}
-	err = rw.MkdirParent(outputPath)
-	if err != nil {
-		return err
-	}
-	err = os.WriteFile(outputPath, buffer.Bytes(), 0o644)
-	if err != nil {
-		return err
-	}
-	outputPath, _ = filepath.Abs(outputPath)
-	os.Stderr.WriteString(outputPath + "\n")
-	return nil
-}
--- a/cmd/sing-box/cmd_tools_fetch_http3.go
+++ b/cmd/sing-box/cmd_tools_fetch_http3.go
@@ -21,7 +21,7 @@ func initializeHTTP3Client(instance *box.Box) error {
 		return err
 	}
 	http3Client = &http.Client{
-		Transport: &http3.Transport{
+		Transport: &http3.RoundTripper{
 			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
 				destination := M.ParseSocksaddr(addr)
 				udpConn, dErr := dialer.DialContext(ctx, N.NetworkUDP, destination)
--- a/cmd/sing-box/cmd_tools_synctime.go
+++ b/cmd/sing-box/cmd_tools_synctime.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"

+	"github.com/sagernet/sing-box/common/settings"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -57,7 +58,7 @@ func syncTime() error {
 		return err
 	}
 	if commandSyncTimeWrite {
-		err = ntp.SetSystemTime(response.Time)
+		err = settings.SetSystemTime(response.Time)
 		if err != nil {
 			return E.Cause(err, "write time to system")
 		}
--- a/common/dialer/default.go
+++ b/common/dialer/default.go
@@ -2,16 +2,13 @@ package dialer

 import (
 	"context"
-	"errors"
 	"net"
 	"net/netip"
-	"syscall"
 	"time"

 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/conntrack"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/atomic"
@@ -19,7 +16,6 @@ import (
 	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/service"
 )

 var (
@@ -28,36 +24,31 @@ var (
 )

 type DefaultDialer struct {
-	dialer4                tcpDialer
-	dialer6                tcpDialer
-	udpDialer4             net.Dialer
-	udpDialer6             net.Dialer
-	udpListener            net.ListenConfig
-	udpAddr4               string
-	udpAddr6               string
-	isWireGuardListener    bool
-	networkManager         adapter.NetworkManager
-	networkStrategy        *C.NetworkStrategy
-	defaultNetworkStrategy bool
-	networkType            []C.InterfaceType
-	fallbackNetworkType    []C.InterfaceType
-	networkFallbackDelay   time.Duration
-	networkLastFallback    atomic.TypedValue[time.Time]
+	dialer4              tcpDialer
+	dialer6              tcpDialer
+	udpDialer4           net.Dialer
+	udpDialer6           net.Dialer
+	udpListener          net.ListenConfig
+	udpAddr4             string
+	udpAddr6             string
+	isWireGuardListener  bool
+	networkManager       adapter.NetworkManager
+	networkStrategy      C.NetworkStrategy
+	networkType          []C.InterfaceType
+	fallbackNetworkType  []C.InterfaceType
+	networkFallbackDelay time.Duration
+	networkLastFallback  atomic.TypedValue[time.Time]
 }

-func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDialer, error) {
-	networkManager := service.FromContext[adapter.NetworkManager](ctx)
-	platformInterface := service.FromContext[platform.Interface](ctx)
-
+func NewDefault(networkManager adapter.NetworkManager, options option.DialerOptions) (*DefaultDialer, error) {
 	var (
-		dialer                 net.Dialer
-		listener               net.ListenConfig
-		interfaceFinder        control.InterfaceFinder
-		networkStrategy        *C.NetworkStrategy
-		defaultNetworkStrategy bool
-		networkType            []C.InterfaceType
-		fallbackNetworkType    []C.InterfaceType
-		networkFallbackDelay   time.Duration
+		dialer               net.Dialer
+		listener             net.ListenConfig
+		interfaceFinder      control.InterfaceFinder
+		networkStrategy      C.NetworkStrategy
+		networkType          []C.InterfaceType
+		fallbackNetworkType  []C.InterfaceType
+		networkFallbackDelay time.Duration
 	)
 	if networkManager != nil {
 		interfaceFinder = networkManager.InterfaceFinder()
@@ -83,38 +74,31 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 			listener.Control = control.Append(listener.Control, control.RoutingMark(autoRedirectOutputMark))
 		}
 	}
-	disableDefaultBind := options.BindInterface != "" || options.Inet4BindAddress != nil || options.Inet6BindAddress != nil
-	if disableDefaultBind || options.TCPFastOpen {
-		if options.NetworkStrategy != nil || len(options.NetworkType) > 0 && options.FallbackNetworkType == nil && options.FallbackDelay == 0 {
-			return nil, E.New("`network_strategy` is conflict with `bind_interface`, `inet4_bind_address`, `inet6_bind_address` and `tcp_fast_open`")
+	if C.NetworkStrategy(options.NetworkStrategy) != C.NetworkStrategyDefault {
+		if options.BindInterface != "" || options.Inet4BindAddress != nil || options.Inet6BindAddress != nil {
+			return nil, E.New("`network_strategy` is conflict with `bind_interface`, `inet4_bind_address` and `inet6_bind_address`")
+		}
+		networkStrategy = C.NetworkStrategy(options.NetworkStrategy)
+		networkType = common.Map(options.NetworkType, option.InterfaceType.Build)
+		fallbackNetworkType = common.Map(options.FallbackNetworkType, option.InterfaceType.Build)
+		networkFallbackDelay = time.Duration(options.NetworkFallbackDelay)
+		if networkManager == nil || !networkManager.AutoDetectInterface() {
+			return nil, E.New("`route.auto_detect_interface` is require by `network_strategy`")
 		}
 	}
-
-	if networkManager != nil {
+	if networkManager != nil && options.BindInterface == "" && options.Inet4BindAddress == nil && options.Inet6BindAddress == nil {
 		defaultOptions := networkManager.DefaultOptions()
-		if !disableDefaultBind {
+		if options.BindInterface == "" {
 			if defaultOptions.BindInterface != "" {
 				bindFunc := control.BindToInterface(networkManager.InterfaceFinder(), defaultOptions.BindInterface, -1)
 				dialer.Control = control.Append(dialer.Control, bindFunc)
 				listener.Control = control.Append(listener.Control, bindFunc)
 			} else if networkManager.AutoDetectInterface() {
-				if platformInterface != nil {
-					networkStrategy = (*C.NetworkStrategy)(options.NetworkStrategy)
-					if networkStrategy == nil {
-						networkStrategy = common.Ptr(C.NetworkStrategyDefault)
-						defaultNetworkStrategy = true
-					}
-					networkType = common.Map(options.NetworkType, option.InterfaceType.Build)
-					fallbackNetworkType = common.Map(options.FallbackNetworkType, option.InterfaceType.Build)
-					if networkStrategy == nil && len(networkType) == 0 && len(fallbackNetworkType) == 0 {
-						networkStrategy = defaultOptions.NetworkStrategy
-						networkType = defaultOptions.NetworkType
-						fallbackNetworkType = defaultOptions.FallbackNetworkType
-					}
-					networkFallbackDelay = time.Duration(options.FallbackDelay)
-					if networkFallbackDelay == 0 && defaultOptions.FallbackDelay != 0 {
-						networkFallbackDelay = defaultOptions.FallbackDelay
-					}
+				if defaultOptions.NetworkStrategy != C.NetworkStrategyDefault && C.NetworkStrategy(options.NetworkStrategy) == C.NetworkStrategyDefault {
+					networkStrategy = defaultOptions.NetworkStrategy
+					networkType = defaultOptions.NetworkType
+					fallbackNetworkType = defaultOptions.FallbackNetworkType
+					networkFallbackDelay = defaultOptions.FallbackDelay
 					bindFunc := networkManager.ProtectFunc()
 					dialer.Control = control.Append(dialer.Control, bindFunc)
 					listener.Control = control.Append(listener.Control, bindFunc)
@@ -188,6 +172,9 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 			listener.Control = control.Append(listener.Control, controlFn)
 		}
 	}
+	if networkStrategy != C.NetworkStrategyDefault && options.TCPFastOpen {
+		return nil, E.New("`tcp_fast_open` is conflict with `network_strategy` or `route.default_network_strategy`")
+	}
 	tcpDialer4, err := newTCPDialer(dialer4, options.TCPFastOpen)
 	if err != nil {
 		return nil, err
@@ -197,20 +184,19 @@ func NewDefault(ctx context.Context, options option.DialerOptions) (*DefaultDial
 		return nil, err
 	}
 	return &DefaultDialer{
-		dialer4:                tcpDialer4,
-		dialer6:                tcpDialer6,
-		udpDialer4:             udpDialer4,
-		udpDialer6:             udpDialer6,
-		udpListener:            listener,
-		udpAddr4:               udpAddr4,
-		udpAddr6:               udpAddr6,
-		isWireGuardListener:    options.IsWireGuardListener,
-		networkManager:         networkManager,
-		networkStrategy:        networkStrategy,
-		defaultNetworkStrategy: defaultNetworkStrategy,
-		networkType:            networkType,
-		fallbackNetworkType:    fallbackNetworkType,
-		networkFallbackDelay:   networkFallbackDelay,
+		dialer4:              tcpDialer4,
+		dialer6:              tcpDialer6,
+		udpDialer4:           udpDialer4,
+		udpDialer6:           udpDialer6,
+		udpListener:          listener,
+		udpAddr4:             udpAddr4,
+		udpAddr6:             udpAddr6,
+		isWireGuardListener:  options.IsWireGuardListener,
+		networkManager:       networkManager,
+		networkStrategy:      networkStrategy,
+		networkType:          networkType,
+		fallbackNetworkType:  fallbackNetworkType,
+		networkFallbackDelay: networkFallbackDelay,
 	}, nil
 }

@@ -218,7 +204,7 @@ func (d *DefaultDialer) DialContext(ctx context.Context, network string, address
 	if !address.IsValid() {
 		return nil, E.New("invalid address")
 	}
-	if d.networkStrategy == nil {
+	if d.networkStrategy == C.NetworkStrategyDefault {
 		switch N.NetworkName(network) {
 		case N.NetworkUDP:
 			if !address.IsIPv6() {
@@ -237,21 +223,12 @@ func (d *DefaultDialer) DialContext(ctx context.Context, network string, address
 	}
 }

-func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network string, address M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
-	if strategy == nil {
-		strategy = d.networkStrategy
-	}
-	if strategy == nil {
+func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network string, address M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
+	if strategy == C.NetworkStrategyDefault {
 		return d.DialContext(ctx, network, address)
 	}
-	if len(interfaceType) == 0 {
-		interfaceType = d.networkType
-	}
-	if len(fallbackInterfaceType) == 0 {
-		fallbackInterfaceType = d.fallbackNetworkType
-	}
-	if fallbackDelay == 0 {
-		fallbackDelay = d.networkFallbackDelay
+	if !d.networkManager.AutoDetectInterface() {
+		return nil, E.New("`route.auto_detect_interface` is require by `network_strategy`")
 	}
 	var dialer net.Dialer
 	if N.NetworkName(network) == N.NetworkTCP {
@@ -266,18 +243,12 @@ func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network strin
 		err       error
 	)
 	if !fastFallback {
-		conn, isPrimary, err = d.dialParallelInterface(ctx, dialer, network, address.String(), *strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
+		conn, isPrimary, err = d.dialParallelInterface(ctx, dialer, network, address.String(), strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
 	} else {
-		conn, isPrimary, err = d.dialParallelInterfaceFastFallback(ctx, dialer, network, address.String(), *strategy, interfaceType, fallbackInterfaceType, fallbackDelay, d.networkLastFallback.Store)
+		conn, isPrimary, err = d.dialParallelInterfaceFastFallback(ctx, dialer, network, address.String(), strategy, interfaceType, fallbackInterfaceType, fallbackDelay, d.networkLastFallback.Store)
 	}
 	if err != nil {
-		// bind interface failed on legacy xiaomi systems
-		if d.defaultNetworkStrategy && errors.Is(err, syscall.EPERM) {
-			d.networkStrategy = nil
-			return d.DialContext(ctx, network, address)
-		} else {
-			return nil, err
-		}
+		return nil, err
 	}
 	if !fastFallback && !isPrimary {
 		d.networkLastFallback.Store(time.Now())
@@ -286,7 +257,7 @@ func (d *DefaultDialer) DialParallelInterface(ctx context.Context, network strin
 }

 func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if d.networkStrategy == nil {
+	if d.networkStrategy == C.NetworkStrategyDefault {
 		if destination.IsIPv6() {
 			return trackPacketConn(d.udpListener.ListenPacket(ctx, N.NetworkUDP, d.udpAddr6))
 		} else if destination.IsIPv4() && !destination.Addr.IsUnspecified() {
@@ -299,37 +270,18 @@ func (d *DefaultDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	}
 }

-func (d *DefaultDialer) ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error) {
-	if strategy == nil {
-		strategy = d.networkStrategy
-	}
-	if strategy == nil {
+func (d *DefaultDialer) ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error) {
+	if strategy == C.NetworkStrategyDefault {
 		return d.ListenPacket(ctx, destination)
 	}
-	if len(interfaceType) == 0 {
-		interfaceType = d.networkType
-	}
-	if len(fallbackInterfaceType) == 0 {
-		fallbackInterfaceType = d.fallbackNetworkType
-	}
-	if fallbackDelay == 0 {
-		fallbackDelay = d.networkFallbackDelay
+	if !d.networkManager.AutoDetectInterface() {
+		return nil, E.New("`route.auto_detect_interface` is require by `network_strategy`")
 	}
 	network := N.NetworkUDP
 	if destination.IsIPv4() && !destination.Addr.IsUnspecified() {
 		network += "4"
 	}
-	packetConn, err := d.listenSerialInterfacePacket(ctx, d.udpListener, network, "", *strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
-	if err != nil {
-		// bind interface failed on legacy xiaomi systems
-		if d.defaultNetworkStrategy && errors.Is(err, syscall.EPERM) {
-			d.networkStrategy = nil
-			return d.ListenPacket(ctx, destination)
-		} else {
-			return nil, err
-		}
-	}
-	return trackPacketConn(packetConn, nil)
+	return trackPacketConn(d.listenSerialInterfacePacket(ctx, d.udpListener, network, "", strategy, interfaceType, fallbackInterfaceType, fallbackDelay))
 }

 func (d *DefaultDialer) ListenPacketCompat(network, address string) (net.PacketConn, error) {
--- a/common/dialer/default_parallel_interface.go
+++ b/common/dialer/default_parallel_interface.go
@@ -35,12 +35,12 @@ func (d *DefaultDialer) dialParallelInterface(ctx context.Context, dialer net.Di
 		conn, err := perNetDialer.DialContext(ctx, network, addr)
 		if err != nil {
 			select {
-			case results <- dialResult{error: E.Cause(err, "dial ", iif.Name, " (", iif.Index, ")"), primary: primary}:
+			case results <- dialResult{error: E.Cause(err, "dial ", iif.Name, " (", iif.Name, ")"), primary: primary}:
 			case <-returned:
 			}
 		} else {
 			select {
-			case results <- dialResult{Conn: conn, primary: primary}:
+			case results <- dialResult{Conn: conn}:
 			case <-returned:
 				conn.Close()
 			}
@@ -107,12 +107,12 @@ func (d *DefaultDialer) dialParallelInterfaceFastFallback(ctx context.Context, d
 		conn, err := perNetDialer.DialContext(ctx, network, addr)
 		if err != nil {
 			select {
-			case results <- dialResult{error: E.Cause(err, "dial ", iif.Name, " (", iif.Index, ")"), primary: primary}:
+			case results <- dialResult{error: E.Cause(err, "dial ", iif.Name, " (", iif.Name, ")"), primary: primary}:
 			case <-returned:
 			}
 		} else {
 			select {
-			case results <- dialResult{Conn: conn, primary: primary}:
+			case results <- dialResult{Conn: conn}:
 			case <-returned:
 				if primary && time.Since(startAt) <= fallbackDelay {
 					resetFastFallback(time.Time{})
@@ -157,7 +157,7 @@ func (d *DefaultDialer) listenSerialInterfacePacket(ctx context.Context, listene
 		if err == nil {
 			return conn, nil
 		}
-		errors = append(errors, E.Cause(err, "listen ", primaryInterface.Name, " (", primaryInterface.Index, ")"))
+		errors = append(errors, E.Cause(err, "listen ", primaryInterface.Name, " (", primaryInterface.Name, ")"))
 	}
 	for _, fallbackInterface := range fallbackInterfaces {
 		perNetListener := listener
@@ -166,7 +166,7 @@ func (d *DefaultDialer) listenSerialInterfacePacket(ctx context.Context, listene
 		if err == nil {
 			return conn, nil
 		}
-		errors = append(errors, E.Cause(err, "listen ", fallbackInterface.Name, " (", fallbackInterface.Index, ")"))
+		errors = append(errors, E.Cause(err, "listen ", fallbackInterface.Name, " (", fallbackInterface.Name, ")"))
 	}
 	return nil, E.Errors(errors...)
 }
@@ -177,57 +177,44 @@ func selectInterfaces(networkManager adapter.NetworkManager, strategy C.NetworkS
 	case C.NetworkStrategyDefault:
 		if len(interfaceType) == 0 {
 			defaultIf := networkManager.InterfaceMonitor().DefaultInterface()
-			if defaultIf != nil {
-				for _, iif := range interfaces {
-					if iif.Index == defaultIf.Index {
-						primaryInterfaces = append(primaryInterfaces, iif)
-					}
+			for _, iif := range interfaces {
+				if iif.Index == defaultIf.Index {
+					primaryInterfaces = append(primaryInterfaces, iif)
+				} else {
+					fallbackInterfaces = append(fallbackInterfaces, iif)
 				}
-			} else {
-				primaryInterfaces = interfaces
 			}
 		} else {
-			primaryInterfaces = common.Filter(interfaces, func(it adapter.NetworkInterface) bool {
-				return common.Contains(interfaceType, it.Type)
+			primaryInterfaces = common.Filter(interfaces, func(iif adapter.NetworkInterface) bool {
+				return common.Contains(interfaceType, iif.Type)
 			})
 		}
 	case C.NetworkStrategyHybrid:
 		if len(interfaceType) == 0 {
 			primaryInterfaces = interfaces
 		} else {
-			primaryInterfaces = common.Filter(interfaces, func(it adapter.NetworkInterface) bool {
-				return common.Contains(interfaceType, it.Type)
+			primaryInterfaces = common.Filter(interfaces, func(iif adapter.NetworkInterface) bool {
+				return common.Contains(interfaceType, iif.Type)
 			})
 		}
 	case C.NetworkStrategyFallback:
 		if len(interfaceType) == 0 {
 			defaultIf := networkManager.InterfaceMonitor().DefaultInterface()
-			if defaultIf != nil {
-				for _, iif := range interfaces {
-					if iif.Index == defaultIf.Index {
-						primaryInterfaces = append(primaryInterfaces, iif)
-						break
-					}
+			for _, iif := range interfaces {
+				if iif.Index == defaultIf.Index {
+					primaryInterfaces = append(primaryInterfaces, iif)
+				} else {
+					fallbackInterfaces = append(fallbackInterfaces, iif)
 				}
-			} else {
-				primaryInterfaces = interfaces
 			}
 		} else {
-			primaryInterfaces = common.Filter(interfaces, func(it adapter.NetworkInterface) bool {
-				return common.Contains(interfaceType, it.Type)
-			})
-		}
-		if len(fallbackInterfaceType) == 0 {
-			fallbackInterfaces = common.Filter(interfaces, func(it adapter.NetworkInterface) bool {
-				return !common.Any(primaryInterfaces, func(iif adapter.NetworkInterface) bool {
-					return it.Index == iif.Index
-				})
-			})
-		} else {
-			fallbackInterfaces = common.Filter(interfaces, func(iif adapter.NetworkInterface) bool {
-				return common.Contains(fallbackInterfaceType, iif.Type)
+			primaryInterfaces = common.Filter(interfaces, func(iif adapter.NetworkInterface) bool {
+				return common.Contains(interfaceType, iif.Type)
 			})
 		}
+		fallbackInterfaces = common.Filter(interfaces, func(iif adapter.NetworkInterface) bool {
+			return common.Contains(fallbackInterfaceType, iif.Type)
+		})
 	}
 	return primaryInterfaces, fallbackInterfaces
 }
--- a/common/dialer/default_parallel_network.go
+++ b/common/dialer/default_parallel_network.go
@@ -13,13 +13,7 @@ import (
 	N "github.com/sagernet/sing/common/network"
 )

-func DialSerialNetwork(ctx context.Context, dialer N.Dialer, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
-	if len(destinationAddresses) == 0 {
-		if !destination.IsIP() {
-			panic("invalid usage")
-		}
-		destinationAddresses = []netip.Addr{destination.Addr}
-	}
+func DialSerialNetwork(ctx context.Context, dialer N.Dialer, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
 	if parallelDialer, isParallel := dialer.(ParallelNetworkDialer); isParallel {
 		return parallelDialer.DialParallelNetwork(ctx, network, destination, destinationAddresses, strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
 	}
@@ -44,14 +38,7 @@ func DialSerialNetwork(ctx context.Context, dialer N.Dialer, network string, des
 	return nil, E.Errors(errors...)
 }

-func DialParallelNetwork(ctx context.Context, dialer ParallelInterfaceDialer, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, preferIPv6 bool, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
-	if len(destinationAddresses) == 0 {
-		if !destination.IsIP() {
-			panic("invalid usage")
-		}
-		destinationAddresses = []netip.Addr{destination.Addr}
-	}
-
+func DialParallelNetwork(ctx context.Context, dialer ParallelInterfaceDialer, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, preferIPv6 bool, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
 	if fallbackDelay == 0 {
 		fallbackDelay = N.DefaultFallbackDelay
 	}
@@ -129,13 +116,7 @@ func DialParallelNetwork(ctx context.Context, dialer ParallelInterfaceDialer, ne
 	}
 }

-func ListenSerialNetworkPacket(ctx context.Context, dialer N.Dialer, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, netip.Addr, error) {
-	if len(destinationAddresses) == 0 {
-		if !destination.IsIP() {
-			panic("invalid usage")
-		}
-		destinationAddresses = []netip.Addr{destination.Addr}
-	}
+func ListenSerialNetworkPacket(ctx context.Context, dialer N.Dialer, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, netip.Addr, error) {
 	if parallelDialer, isParallel := dialer.(ParallelNetworkDialer); isParallel {
 		return parallelDialer.ListenSerialNetworkPacket(ctx, destination, destinationAddresses, strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
 	}
--- a/common/dialer/dialer.go
+++ b/common/dialer/dialer.go
@@ -8,24 +8,25 @@ import (

 	"github.com/sagernet/sing-box/adapter"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-dns"
 	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/service"
 )

-func New(ctx context.Context, options option.DialerOptions, remoteIsDomain bool) (N.Dialer, error) {
+func New(ctx context.Context, options option.DialerOptions) (N.Dialer, error) {
+	networkManager := service.FromContext[adapter.NetworkManager](ctx)
 	if options.IsWireGuardListener {
-		return NewDefault(ctx, options)
+		return NewDefault(networkManager, options)
 	}
 	var (
 		dialer N.Dialer
 		err    error
 	)
 	if options.Detour == "" {
-		dialer, err = NewDefault(ctx, options)
+		dialer, err = NewDefault(networkManager, options)
 		if err != nil {
 			return nil, err
 		}
@@ -36,26 +37,17 @@ func New(ctx context.Context, options option.DialerOptions, remoteIsDomain bool)
 		}
 		dialer = NewDetour(outboundManager, options.Detour)
 	}
-	if remoteIsDomain && options.Detour == "" && options.DomainResolver == "" {
-		deprecated.Report(ctx, deprecated.OptionMissingDomainResolverInDialOptions)
+	if networkManager == nil {
+		return NewDefault(networkManager, options)
 	}
-	if (options.Detour == "" && remoteIsDomain) || options.DomainResolver != "" {
-		router := service.FromContext[adapter.DNSRouter](ctx)
+	if options.Detour == "" {
+		router := service.FromContext[adapter.Router](ctx)
 		if router != nil {
-			var resolveTransport adapter.DNSTransport
-			if options.DomainResolver != "" {
-				transport, loaded := service.FromContext[adapter.DNSTransportManager](ctx).Transport(options.DomainResolver)
-				if !loaded {
-					return nil, E.New("DNS server not found: " + options.DomainResolver)
-				}
-				resolveTransport = transport
-			}
 			dialer = NewResolveDialer(
 				router,
 				dialer,
 				options.Detour == "" && !options.TCPFastOpen,
-				resolveTransport,
-				C.DomainStrategy(options.DomainStrategy),
+				dns.DomainStrategy(options.DomainStrategy),
 				time.Duration(options.FallbackDelay))
 		}
 	}
@@ -66,38 +58,30 @@ func NewDirect(ctx context.Context, options option.DialerOptions) (ParallelInter
 	if options.Detour != "" {
 		return nil, E.New("`detour` is not supported in direct context")
 	}
+	networkManager := service.FromContext[adapter.NetworkManager](ctx)
 	if options.IsWireGuardListener {
-		return NewDefault(ctx, options)
+		return NewDefault(networkManager, options)
 	}
-	dialer, err := NewDefault(ctx, options)
+	dialer, err := NewDefault(networkManager, options)
 	if err != nil {
 		return nil, err
 	}
-	var resolveTransport adapter.DNSTransport
-	if options.DomainResolver != "" {
-		transport, loaded := service.FromContext[adapter.DNSTransportManager](ctx).Transport(options.DomainResolver)
-		if !loaded {
-			return nil, E.New("DNS server not found: " + options.DomainResolver)
-		}
-		resolveTransport = transport
-	}
 	return NewResolveParallelInterfaceDialer(
-		service.FromContext[adapter.DNSRouter](ctx),
+		service.FromContext[adapter.Router](ctx),
 		dialer,
 		true,
-		resolveTransport,
-		C.DomainStrategy(options.DomainStrategy),
+		dns.DomainStrategy(options.DomainStrategy),
 		time.Duration(options.FallbackDelay),
 	), nil
 }

 type ParallelInterfaceDialer interface {
 	N.Dialer
-	DialParallelInterface(ctx context.Context, network string, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error)
-	ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error)
+	DialParallelInterface(ctx context.Context, network string, destination M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error)
+	ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error)
 }

 type ParallelNetworkDialer interface {
-	DialParallelNetwork(ctx context.Context, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error)
-	ListenSerialNetworkPacket(ctx context.Context, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, netip.Addr, error)
+	DialParallelNetwork(ctx context.Context, network string, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error)
+	ListenSerialNetworkPacket(ctx context.Context, destination M.Socksaddr, destinationAddresses []netip.Addr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, netip.Addr, error)
 }
--- a/common/dialer/resolve.go
+++ b/common/dialer/resolve.go
@@ -3,11 +3,13 @@ package dialer
 import (
 	"context"
 	"net"
+	"net/netip"
 	"time"

 	"github.com/sagernet/sing-box/adapter"
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-dns"
 	"github.com/sagernet/sing/common/bufio"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
@@ -21,18 +23,16 @@ var (
 type resolveDialer struct {
 	dialer        N.Dialer
 	parallel      bool
-	router        adapter.DNSRouter
-	transport     adapter.DNSTransport
-	strategy      C.DomainStrategy
+	router        adapter.Router
+	strategy      dns.DomainStrategy
 	fallbackDelay time.Duration
 }

-func NewResolveDialer(router adapter.DNSRouter, dialer N.Dialer, parallel bool, transport adapter.DNSTransport, strategy C.DomainStrategy, fallbackDelay time.Duration) N.Dialer {
+func NewResolveDialer(router adapter.Router, dialer N.Dialer, parallel bool, strategy dns.DomainStrategy, fallbackDelay time.Duration) N.Dialer {
 	return &resolveDialer{
 		dialer,
 		parallel,
 		router,
-		transport,
 		strategy,
 		fallbackDelay,
 	}
@@ -43,13 +43,12 @@ type resolveParallelNetworkDialer struct {
 	dialer ParallelInterfaceDialer
 }

-func NewResolveParallelInterfaceDialer(router adapter.DNSRouter, dialer ParallelInterfaceDialer, parallel bool, transport adapter.DNSTransport, strategy C.DomainStrategy, fallbackDelay time.Duration) ParallelInterfaceDialer {
+func NewResolveParallelInterfaceDialer(router adapter.Router, dialer ParallelInterfaceDialer, parallel bool, strategy dns.DomainStrategy, fallbackDelay time.Duration) ParallelInterfaceDialer {
 	return &resolveParallelNetworkDialer{
 		resolveDialer{
 			dialer,
 			parallel,
 			router,
-			transport,
 			strategy,
 			fallbackDelay,
 		},
@@ -61,13 +60,22 @@ func (d *resolveDialer) DialContext(ctx context.Context, network string, destina
 	if !destination.IsFqdn() {
 		return d.dialer.DialContext(ctx, network, destination)
 	}
+	ctx, metadata := adapter.ExtendContext(ctx)
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
-	addresses, err := d.router.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{Transport: d.transport, Strategy: d.strategy})
+	metadata.Destination = destination
+	metadata.Domain = ""
+	var addresses []netip.Addr
+	var err error
+	if d.strategy == dns.DomainStrategyAsIS {
+		addresses, err = d.router.LookupDefault(ctx, destination.Fqdn)
+	} else {
+		addresses, err = d.router.Lookup(ctx, destination.Fqdn, d.strategy)
+	}
 	if err != nil {
 		return nil, err
 	}
 	if d.parallel {
-		return N.DialParallel(ctx, d.dialer, network, destination, addresses, d.strategy == C.DomainStrategyPreferIPv6, d.fallbackDelay)
+		return N.DialParallel(ctx, d.dialer, network, destination, addresses, d.strategy == dns.DomainStrategyPreferIPv6, d.fallbackDelay)
 	} else {
 		return N.DialSerial(ctx, d.dialer, network, destination, addresses)
 	}
@@ -77,8 +85,17 @@ func (d *resolveDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
+	ctx, metadata := adapter.ExtendContext(ctx)
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
-	addresses, err := d.router.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{Transport: d.transport, Strategy: d.strategy})
+	metadata.Destination = destination
+	metadata.Domain = ""
+	var addresses []netip.Addr
+	var err error
+	if d.strategy == dns.DomainStrategyAsIS {
+		addresses, err = d.router.LookupDefault(ctx, destination.Fqdn)
+	} else {
+		addresses, err = d.router.Lookup(ctx, destination.Fqdn, d.strategy)
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -89,12 +106,21 @@ func (d *resolveDialer) ListenPacket(ctx context.Context, destination M.Socksadd
 	return bufio.NewNATPacketConn(bufio.NewPacketConn(conn), M.SocksaddrFrom(destinationAddress, destination.Port), destination), nil
 }

-func (d *resolveParallelNetworkDialer) DialParallelInterface(ctx context.Context, network string, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
+func (d *resolveParallelNetworkDialer) DialParallelInterface(ctx context.Context, network string, destination M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.Conn, error) {
 	if !destination.IsFqdn() {
 		return d.dialer.DialContext(ctx, network, destination)
 	}
+	ctx, metadata := adapter.ExtendContext(ctx)
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
-	addresses, err := d.router.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{Transport: d.transport, Strategy: d.strategy})
+	metadata.Destination = destination
+	metadata.Domain = ""
+	var addresses []netip.Addr
+	var err error
+	if d.strategy == dns.DomainStrategyAsIS {
+		addresses, err = d.router.LookupDefault(ctx, destination.Fqdn)
+	} else {
+		addresses, err = d.router.Lookup(ctx, destination.Fqdn, d.strategy)
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -102,18 +128,27 @@ func (d *resolveParallelNetworkDialer) DialParallelInterface(ctx context.Context
 		fallbackDelay = d.fallbackDelay
 	}
 	if d.parallel {
-		return DialParallelNetwork(ctx, d.dialer, network, destination, addresses, d.strategy == C.DomainStrategyPreferIPv6, strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
+		return DialParallelNetwork(ctx, d.dialer, network, destination, addresses, d.strategy == dns.DomainStrategyPreferIPv6, strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
 	} else {
 		return DialSerialNetwork(ctx, d.dialer, network, destination, addresses, strategy, interfaceType, fallbackInterfaceType, fallbackDelay)
 	}
 }

-func (d *resolveParallelNetworkDialer) ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy *C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error) {
+func (d *resolveParallelNetworkDialer) ListenSerialInterfacePacket(ctx context.Context, destination M.Socksaddr, strategy C.NetworkStrategy, interfaceType []C.InterfaceType, fallbackInterfaceType []C.InterfaceType, fallbackDelay time.Duration) (net.PacketConn, error) {
 	if !destination.IsFqdn() {
 		return d.dialer.ListenPacket(ctx, destination)
 	}
+	ctx, metadata := adapter.ExtendContext(ctx)
 	ctx = log.ContextWithOverrideLevel(ctx, log.LevelDebug)
-	addresses, err := d.router.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{Transport: d.transport, Strategy: d.strategy})
+	metadata.Destination = destination
+	metadata.Domain = ""
+	var addresses []netip.Addr
+	var err error
+	if d.strategy == dns.DomainStrategyAsIS {
+		addresses, err = d.router.LookupDefault(ctx, destination.Fqdn)
+	} else {
+		addresses, err = d.router.Lookup(ctx, destination.Fqdn, d.strategy)
+	}
 	if err != nil {
 		return nil, err
 	}
--- a/common/dialer/router.go
+++ b/common/dialer/router.go
@@ -7,27 +7,24 @@ import (
 	"github.com/sagernet/sing-box/adapter"
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/service"
 )

 type DefaultOutboundDialer struct {
-	outbound adapter.OutboundManager
+	outboundManager adapter.OutboundManager
 }

-func NewDefaultOutbound(ctx context.Context) N.Dialer {
-	return &DefaultOutboundDialer{
-		outbound: service.FromContext[adapter.OutboundManager](ctx),
-	}
+func NewDefaultOutbound(outboundManager adapter.OutboundManager) N.Dialer {
+	return &DefaultOutboundDialer{outboundManager: outboundManager}
 }

 func (d *DefaultOutboundDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	return d.outbound.Default().DialContext(ctx, network, destination)
+	return d.outboundManager.Default().DialContext(ctx, network, destination)
 }

 func (d *DefaultOutboundDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	return d.outbound.Default().ListenPacket(ctx, destination)
+	return d.outboundManager.Default().ListenPacket(ctx, destination)
 }

 func (d *DefaultOutboundDialer) Upstream() any {
-	return d.outbound.Default()
+	return d.outboundManager.Default()
 }
--- a/common/settings/time_stub.go
+++ b/common/settings/time_stub.go
@@ -0,0 +1,12 @@
+//go:build !(windows || linux || darwin)
+
+package settings
+
+import (
+	"os"
+	"time"
+)
+
+func SetSystemTime(nowTime time.Time) error {
+	return os.ErrInvalid
+}
--- a/common/settings/time_unix.go
+++ b/common/settings/time_unix.go
@@ -0,0 +1,14 @@
+//go:build linux || darwin
+
+package settings
+
+import (
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+func SetSystemTime(nowTime time.Time) error {
+	timeVal := unix.NsecToTimeval(nowTime.UnixNano())
+	return unix.Settimeofday(&timeVal)
+}
--- a/common/settings/time_windows.go
+++ b/common/settings/time_windows.go
@@ -0,0 +1,32 @@
+package settings
+
+import (
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+func SetSystemTime(nowTime time.Time) error {
+	var systemTime windows.Systemtime
+	systemTime.Year = uint16(nowTime.Year())
+	systemTime.Month = uint16(nowTime.Month())
+	systemTime.Day = uint16(nowTime.Day())
+	systemTime.Hour = uint16(nowTime.Hour())
+	systemTime.Minute = uint16(nowTime.Minute())
+	systemTime.Second = uint16(nowTime.Second())
+	systemTime.Milliseconds = uint16(nowTime.UnixMilli() - nowTime.Unix()*1000)
+
+	dllKernel32 := windows.NewLazySystemDLL("kernel32.dll")
+	proc := dllKernel32.NewProc("SetSystemTime")
+
+	_, _, err := proc.Call(
+		uintptr(unsafe.Pointer(&systemTime)),
+	)
+
+	if err != nil && err.Error() != "The operation completed successfully." {
+		return err
+	}
+
+	return nil
+}
--- a/common/tls/client.go
+++ b/common/tls/client.go
@@ -30,14 +30,15 @@ func NewClient(ctx context.Context, serverAddress string, options option.Outboun
 		return nil, nil
 	}
 	if options.ECH != nil && options.ECH.Enabled {
-		return NewECHClient(ctx, serverAddress, options)
+		if options.ECH.PQSignatureSchemesEnabled || options.ECH.DynamicRecordSizingDisabled {
+			return NewECHClient(ctx, serverAddress, options)
+		}
 	} else if options.Reality != nil && options.Reality.Enabled {
 		return NewRealityClient(ctx, serverAddress, options)
 	} else if options.UTLS != nil && options.UTLS.Enabled {
 		return NewUTLSClient(ctx, serverAddress, options)
-	} else {
-		return NewSTDClient(ctx, serverAddress, options)
 	}
+	return NewSTDClient(ctx, serverAddress, options)
 }

 func ClientHandshake(ctx context.Context, conn net.Conn, config Config) (Conn, error) {
--- a/common/tls/ech_client.go
+++ b/common/tls/ech_client.go
@@ -15,8 +15,8 @@ import (

 	cftls "github.com/sagernet/cloudflare-tls"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/dns"
 	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-dns"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/ntp"
 	"github.com/sagernet/sing/service"
@@ -64,7 +64,6 @@ type echConnWrapper struct {

 func (c *echConnWrapper) ConnectionState() tls.ConnectionState {
 	state := c.Conn.ConnectionState()
-	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
@@ -215,7 +214,7 @@ func fetchECHClientConfig(ctx context.Context) func(_ context.Context, serverNam
 				},
 			},
 		}
-		response, err := service.FromContext[adapter.DNSRouter](ctx).Exchange(ctx, message, adapter.DNSQueryOptions{})
+		response, err := service.FromContext[adapter.Router](ctx).Exchange(ctx, message)
 		if err != nil {
 			return nil, err
 		}
--- a/common/tls/ech_keygen.go
+++ b/common/tls/ech_keygen.go
@@ -7,7 +7,6 @@ import (
 	"encoding/binary"
 	"encoding/pem"

-	cftls "github.com/sagernet/cloudflare-tls"
 	E "github.com/sagernet/sing/common/exceptions"

 	"github.com/cloudflare/circl/hpke"
@@ -59,7 +58,6 @@ func ECHKeygenDefault(serverName string, pqSignatureSchemesEnabled bool) (config

 type echKeyConfigPair struct {
 	id      uint8
-	key     cftls.EXP_ECHKey
 	rawKey  []byte
 	conf    myECHKeyConfig
 	rawConf []byte
@@ -147,23 +145,19 @@ func echKeygen(version uint16, serverName string, conf []myECHKeyConfig, suite [
 		pair.rawConf = b

 		secBuf, err := sec.MarshalBinary()
-		if err != nil {
-			return nil, E.Cause(err, "serialize ECH private key")
-		}
 		sk := []byte{}
 		sk = be.AppendUint16(sk, uint16(len(secBuf)))
 		sk = append(sk, secBuf...)
 		sk = be.AppendUint16(sk, uint16(len(b)))
 		sk = append(sk, b...)

-		cfECHKeys, err := cftls.EXP_UnmarshalECHKeys(sk)
+		cfECHKeys, err := UnmarshalECHKeys(sk)
 		if err != nil {
 			return nil, E.Cause(err, "bug: can't parse generated ECH server key")
 		}
 		if len(cfECHKeys) != 1 {
 			return nil, E.New("bug: unexpected server key count")
 		}
-		pair.key = cfECHKeys[0]
 		pair.rawKey = sk

 		pairs = append(pairs, pair)
--- a/common/tls/ech_quic.go
+++ b/common/tls/ech_quic.go
@@ -28,7 +28,7 @@ func (c *echClientConfig) DialEarly(ctx context.Context, conn net.PacketConn, ad
 }

 func (c *echClientConfig) CreateTransport(conn net.PacketConn, quicConnPtr *quic.EarlyConnection, serverAddr M.Socksaddr, quicConfig *quic.Config) http.RoundTripper {
-	return &http3.Transport{
+	return &http3.RoundTripper{
 		TLSClientConfig: c.config,
 		QUICConfig:      quicConfig,
 		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
--- a/common/tls/reality_client.go
+++ b/common/tls/reality_client.go
@@ -184,7 +184,7 @@ func (e *RealityClientConfig) ClientHandshake(ctx context.Context, conn net.Conn
 		return nil, E.New("reality verification failed")
 	}

-	return &realityClientConnWrapper{uConn}, nil
+	return &utlsConnWrapper{uConn}, nil
 }

 func realityClientFallback(uConn net.Conn, serverName string, fingerprint utls.ClientHelloID) {
@@ -249,36 +249,3 @@ func (c *realityVerifier) VerifyPeerCertificate(rawCerts [][]byte, verifiedChain
 	}
 	return nil
 }
-
-type realityClientConnWrapper struct {
-	*utls.UConn
-}
-
-func (c *realityClientConnWrapper) ConnectionState() tls.ConnectionState {
-	state := c.Conn.ConnectionState()
-	//nolint:staticcheck
-	return tls.ConnectionState{
-		Version:                     state.Version,
-		HandshakeComplete:           state.HandshakeComplete,
-		DidResume:                   state.DidResume,
-		CipherSuite:                 state.CipherSuite,
-		NegotiatedProtocol:          state.NegotiatedProtocol,
-		NegotiatedProtocolIsMutual:  state.NegotiatedProtocolIsMutual,
-		ServerName:                  state.ServerName,
-		PeerCertificates:            state.PeerCertificates,
-		VerifiedChains:              state.VerifiedChains,
-		SignedCertificateTimestamps: state.SignedCertificateTimestamps,
-		OCSPResponse:                state.OCSPResponse,
-		TLSUnique:                   state.TLSUnique,
-	}
-}
-
-func (c *realityClientConnWrapper) Upstream() any {
-	return c.UConn
-}
-
-// Due to low implementation quality, the reality server intercepted half close and caused memory leaks.
-// We fixed it by calling Close() directly.
-func (c *realityClientConnWrapper) CloseWrite() error {
-	return c.Close()
-}
--- a/common/tls/reality_server.go
+++ b/common/tls/reality_server.go
@@ -101,7 +101,7 @@ func NewRealityServer(ctx context.Context, logger log.Logger, options option.Inb
 		tlsConfig.ShortIds[shortID] = true
 	}

-	handshakeDialer, err := dialer.New(ctx, options.Reality.Handshake.DialerOptions, options.Reality.Handshake.ServerIsDomain())
+	handshakeDialer, err := dialer.New(ctx, options.Reality.Handshake.DialerOptions)
 	if err != nil {
 		return nil, err
 	}
@@ -174,7 +174,6 @@ type realityConnWrapper struct {

 func (c *realityConnWrapper) ConnectionState() ConnectionState {
 	state := c.Conn.ConnectionState()
-	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
@@ -194,9 +193,3 @@ func (c *realityConnWrapper) ConnectionState() ConnectionState {
 func (c *realityConnWrapper) Upstream() any {
 	return c.Conn
 }
-
-// Due to low implementation quality, the reality server intercepted half close and caused memory leaks.
-// We fixed it by calling Close() directly.
-func (c *realityConnWrapper) CloseWrite() error {
-	return c.Close()
-}
--- a/common/tls/server.go
+++ b/common/tls/server.go
@@ -17,12 +17,13 @@ func NewServer(ctx context.Context, logger log.Logger, options option.InboundTLS
 		return nil, nil
 	}
 	if options.ECH != nil && options.ECH.Enabled {
-		return NewECHServer(ctx, logger, options)
+		if options.ECH.PQSignatureSchemesEnabled || options.ECH.DynamicRecordSizingDisabled {
+			return NewECHServer(ctx, logger, options)
+		}
 	} else if options.Reality != nil && options.Reality.Enabled {
 		return NewRealityServer(ctx, logger, options)
-	} else {
-		return NewSTDServer(ctx, logger, options)
 	}
+	return NewSTDServer(ctx, logger, options)
 }

 func ServerHandshake(ctx context.Context, conn net.Conn, config ServerConfig) (Conn, error) {
--- a/common/tls/std_client.go
+++ b/common/tls/std_client.go
@@ -4,15 +4,25 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/base64"
 	"net"
+	"net/netip"
 	"os"
 	"strings"

+	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-dns"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/ntp"
+	aTLS "github.com/sagernet/sing/common/tls"
+	"github.com/sagernet/sing/service"
+
+	mDNS "github.com/miekg/dns"
 )

+var _ ConfigCompat = (*STDClientConfig)(nil)
+
 type STDClientConfig struct {
 	config *tls.Config
 }
@@ -45,12 +55,71 @@ func (s *STDClientConfig) Clone() Config {
 	return &STDClientConfig{s.config.Clone()}
 }

+type STDECHClientConfig struct {
+	STDClientConfig
+}
+
+func (s *STDClientConfig) ClientHandshake(ctx context.Context, conn net.Conn) (aTLS.Conn, error) {
+	if len(s.config.EncryptedClientHelloConfigList) == 0 {
+		message := &mDNS.Msg{
+			MsgHdr: mDNS.MsgHdr{
+				RecursionDesired: true,
+			},
+			Question: []mDNS.Question{
+				{
+					Name:   mDNS.Fqdn(s.config.ServerName),
+					Qtype:  mDNS.TypeHTTPS,
+					Qclass: mDNS.ClassINET,
+				},
+			},
+		}
+		dnsRouter := service.FromContext[adapter.Router](ctx)
+		response, err := dnsRouter.Exchange(ctx, message)
+		if err != nil {
+			return nil, E.Cause(err, "fetch ECH config list")
+		}
+		if response.Rcode != mDNS.RcodeSuccess {
+			return nil, E.Cause(dns.RCodeError(response.Rcode), "fetch ECH config list")
+		}
+		for _, rr := range response.Answer {
+			switch resource := rr.(type) {
+			case *mDNS.HTTPS:
+				for _, value := range resource.Value {
+					if value.Key().String() == "ech" {
+						echConfigList, err := base64.StdEncoding.DecodeString(value.String())
+						if err != nil {
+							return nil, E.Cause(err, "decode ECH config")
+						}
+						s.config.EncryptedClientHelloConfigList = echConfigList
+					}
+				}
+			}
+		}
+		return nil, E.New("no ECH config found in DNS records")
+	}
+	tlsConn, err := s.Client(conn)
+	if err != nil {
+		return nil, err
+	}
+	err = tlsConn.HandshakeContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return tlsConn, nil
+}
+
+func (s *STDECHClientConfig) Clone() Config {
+	return &STDECHClientConfig{STDClientConfig{s.config.Clone()}}
+}
+
 func NewSTDClient(ctx context.Context, serverAddress string, options option.OutboundTLSOptions) (Config, error) {
 	var serverName string
 	if options.ServerName != "" {
 		serverName = options.ServerName
 	} else if serverAddress != "" {
-		serverName = serverAddress
+		if _, err := netip.ParseAddr(serverName); err != nil {
+			serverName = serverAddress
+		}
 	}
 	if serverName == "" && !options.Insecure {
 		return nil, E.New("missing server_name or insecure=true")
@@ -125,5 +194,21 @@ func NewSTDClient(ctx context.Context, serverAddress string, options option.Outb
 		}
 		tlsConfig.RootCAs = certPool
 	}
+	if options.ECH != nil && options.ECH.Enabled {
+		var echConfig []byte
+		if len(options.ECH.Config) > 0 {
+			echConfig = []byte(strings.Join(options.ECH.Config, "\n"))
+		} else if options.ECH.ConfigPath != "" {
+			content, err := os.ReadFile(options.ECH.ConfigPath)
+			if err != nil {
+				return nil, E.Cause(err, "read ECH config")
+			}
+			echConfig = content
+		}
+		if echConfig != nil {
+			tlsConfig.EncryptedClientHelloConfigList = echConfig
+		}
+		return &STDECHClientConfig{STDClientConfig{&tlsConfig}}, nil
+	}
 	return &STDClientConfig{&tlsConfig}, nil
 }
--- a/common/tls/std_server.go
+++ b/common/tls/std_server.go
@@ -3,6 +3,7 @@ package tls
 import (
 	"context"
 	"crypto/tls"
+	"encoding/pem"
 	"net"
 	"os"
 	"strings"
@@ -14,6 +15,8 @@ import (
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/ntp"
+
+	"golang.org/x/crypto/cryptobyte"
 )

 var errInsecureUnused = E.New("tls: insecure unused")
@@ -238,6 +241,31 @@ func NewSTDServer(ctx context.Context, logger log.Logger, options option.Inbound
 			tlsConfig.Certificates = []tls.Certificate{keyPair}
 		}
 	}
+	if options.ECH != nil && options.ECH.Enabled {
+		var echKey []byte
+		if len(options.ECH.Key) > 0 {
+			echKey = []byte(strings.Join(options.ECH.Key, "\n"))
+		} else if options.ECH.KeyPath != "" {
+			content, err := os.ReadFile(options.ECH.KeyPath)
+			if err != nil {
+				return nil, E.Cause(err, "read ECH key")
+			}
+			echKey = content
+		} else {
+			return nil, E.New("missing ECH key")
+		}
+
+		block, rest := pem.Decode(echKey)
+		if block == nil || block.Type != "ECH KEYS" || len(rest) > 0 {
+			return nil, E.New("invalid ECH keys pem")
+		}
+
+		echKeys, err := UnmarshalECHKeys(block.Bytes)
+		if err != nil {
+			return nil, E.Cause(err, "parse ECH keys")
+		}
+		tlsConfig.EncryptedClientHelloKeys = echKeys
+	}
 	return &STDServerConfig{
 		config:          tlsConfig,
 		logger:          logger,
@@ -248,3 +276,22 @@ func NewSTDServer(ctx context.Context, logger log.Logger, options option.Inbound
 		keyPath:         options.KeyPath,
 	}, nil
 }
+
+func UnmarshalECHKeys(raw []byte) ([]tls.EncryptedClientHelloKey, error) {
+	var keys []tls.EncryptedClientHelloKey
+	rawString := cryptobyte.String(raw)
+	for !rawString.Empty() {
+		var key tls.EncryptedClientHelloKey
+		if !rawString.ReadUint16LengthPrefixed((*cryptobyte.String)(&key.PrivateKey)) {
+			return nil, E.New("error parsing private key")
+		}
+		if !rawString.ReadUint16LengthPrefixed((*cryptobyte.String)(&key.Config)) {
+			return nil, E.New("error parsing config")
+		}
+		keys = append(keys, key)
+	}
+	if len(keys) == 0 {
+		return nil, E.New("empty ECH keys")
+	}
+	return keys, nil
+}
--- a/common/tls/time_wrapper.go
+++ b/common/tls/time_wrapper.go
@@ -1,22 +0,0 @@
-package tls
-
-import (
-	"time"
-
-	"github.com/sagernet/sing/common/ntp"
-)
-
-type TimeServiceWrapper struct {
-	ntp.TimeService
-}
-
-func (w *TimeServiceWrapper) TimeFunc() func() time.Time {
-	if w.TimeService == nil {
-		return nil
-	}
-	return w.TimeService.TimeFunc()
-}
-
-func (w *TimeServiceWrapper) Upstream() any {
-	return w.TimeService
-}
--- a/common/tls/utls_client.go
+++ b/common/tls/utls_client.go
@@ -69,7 +69,6 @@ type utlsConnWrapper struct {

 func (c *utlsConnWrapper) ConnectionState() tls.ConnectionState {
 	state := c.Conn.ConnectionState()
-	//nolint:staticcheck
 	return tls.ConnectionState{
 		Version:                     state.Version,
 		HandshakeComplete:           state.HandshakeComplete,
--- a/common/tlsfragment/conn.go
+++ b/common/tlsfragment/conn.go
@@ -1,125 +0,0 @@
-package tf
-
-import (
-	"context"
-	"math/rand"
-	"net"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/sagernet/sing/common"
-	N "github.com/sagernet/sing/common/network"
-)
-
-type Conn struct {
-	net.Conn
-	syscallConn        syscall.Conn
-	ctx                context.Context
-	firstPacketWritten bool
-	fallbackDelay      time.Duration
-}
-
-func NewConn(conn net.Conn, ctx context.Context, fallbackDelay time.Duration) (*Conn, error) {
-	syscallConn, _ := N.UnwrapReader(conn).(syscall.Conn)
-	return &Conn{
-		Conn:          conn,
-		syscallConn:   syscallConn,
-		ctx:           ctx,
-		fallbackDelay: fallbackDelay,
-	}, nil
-}
-
-func (c *Conn) Write(b []byte) (n int, err error) {
-	if !c.firstPacketWritten {
-		defer func() {
-			c.firstPacketWritten = true
-		}()
-		serverName := indexTLSServerName(b)
-		if serverName != nil {
-			tcpConn, isTCPConn := c.syscallConn.(interface {
-				SetNoDelay(bool) error
-			})
-			if isTCPConn {
-				err = tcpConn.SetNoDelay(true)
-				if err != nil {
-					return
-				}
-			}
-			splits := strings.Split(string(b[serverName.Index:serverName.Index+serverName.Length]), ".")
-			currentIndex := serverName.Index
-			var striped bool
-			if len(splits) > 3 {
-				suffix := splits[len(splits)-3] + "." + splits[len(splits)-2] + "." + splits[len(splits)-1]
-				if publicSuffixMatcher().Match(suffix) {
-					splits = splits[:len(splits)-3]
-				}
-				striped = true
-			}
-			if !striped && len(splits) > 2 {
-				suffix := splits[len(splits)-2] + "." + splits[len(splits)-1]
-				if publicSuffixMatcher().Match(suffix) {
-					splits = splits[:len(splits)-2]
-				}
-				striped = true
-			}
-			if !striped && len(splits) > 1 {
-				suffix := splits[len(splits)-1]
-				if publicSuffixMatcher().Match(suffix) {
-					splits = splits[:len(splits)-1]
-				}
-			}
-			if len(splits) > 1 && common.Contains(publicPrefix, splits[0]) {
-				currentIndex += len(splits[0]) + 1
-				splits = splits[1:]
-			}
-			var splitIndexes []int
-			for i, split := range splits {
-				splitAt := rand.Intn(len(split))
-				splitIndexes = append(splitIndexes, currentIndex+splitAt)
-				currentIndex += len(split)
-				if i != len(splits)-1 {
-					currentIndex++
-				}
-			}
-			for i := 0; i <= len(splitIndexes); i++ {
-				if i == 0 {
-					_, err = c.Conn.Write(b[:splitIndexes[i]])
-				} else if i == len(splitIndexes) {
-					_, err = c.Conn.Write(b[splitIndexes[i-1]:])
-				} else {
-					_, err = c.Conn.Write(b[splitIndexes[i-1]:splitIndexes[i]])
-				}
-				if err != nil {
-					return
-				}
-				if c.syscallConn != nil && i != len(splitIndexes) {
-					err = waitAck(c.ctx, c.syscallConn, c.fallbackDelay)
-					if err != nil {
-						return
-					}
-				}
-			}
-			if isTCPConn {
-				err = tcpConn.SetNoDelay(false)
-				if err != nil {
-					return
-				}
-			}
-			return len(b), nil
-		}
-	}
-	return c.Conn.Write(b)
-}
-
-func (c *Conn) ReaderReplaceable() bool {
-	return true
-}
-
-func (c *Conn) WriterReplaceable() bool {
-	return c.firstPacketWritten
-}
-
-func (c *Conn) Upstream() any {
-	return c.Conn
-}
--- a/common/tlsfragment/index.go
+++ b/common/tlsfragment/index.go
@@ -1,137 +0,0 @@
-package tf
-
-import (
-	"encoding/binary"
-)
-
-const (
-	recordLayerHeaderLen    int    = 5
-	handshakeHeaderLen      int    = 6
-	randomDataLen           int    = 32
-	sessionIDHeaderLen      int    = 1
-	cipherSuiteHeaderLen    int    = 2
-	compressMethodHeaderLen int    = 1
-	extensionsHeaderLen     int    = 2
-	extensionHeaderLen      int    = 4
-	sniExtensionHeaderLen   int    = 5
-	contentType             uint8  = 22
-	handshakeType           uint8  = 1
-	sniExtensionType        uint16 = 0
-	sniNameDNSHostnameType  uint8  = 0
-	tlsVersionBitmask       uint16 = 0xFFFC
-	tls13                   uint16 = 0x0304
-)
-
-type myServerName struct {
-	Index  int
-	Length int
-	sex    []byte
-}
-
-func indexTLSServerName(payload []byte) *myServerName {
-	if len(payload) < recordLayerHeaderLen || payload[0] != contentType {
-		return nil
-	}
-	segmentLen := binary.BigEndian.Uint16(payload[3:5])
-	if len(payload) < recordLayerHeaderLen+int(segmentLen) {
-		return nil
-	}
-	serverName := indexTLSServerNameFromHandshake(payload[recordLayerHeaderLen : recordLayerHeaderLen+int(segmentLen)])
-	if serverName == nil {
-		return nil
-	}
-	serverName.Length += recordLayerHeaderLen
-	return serverName
-}
-
-func indexTLSServerNameFromHandshake(hs []byte) *myServerName {
-	if len(hs) < handshakeHeaderLen+randomDataLen+sessionIDHeaderLen {
-		return nil
-	}
-	if hs[0] != handshakeType {
-		return nil
-	}
-	handshakeLen := uint32(hs[1])<<16 | uint32(hs[2])<<8 | uint32(hs[3])
-	if len(hs[4:]) != int(handshakeLen) {
-		return nil
-	}
-	tlsVersion := uint16(hs[4])<<8 | uint16(hs[5])
-	if tlsVersion&tlsVersionBitmask != 0x0300 && tlsVersion != tls13 {
-		return nil
-	}
-	sessionIDLen := hs[38]
-	if len(hs) < handshakeHeaderLen+randomDataLen+sessionIDHeaderLen+int(sessionIDLen) {
-		return nil
-	}
-	cs := hs[handshakeHeaderLen+randomDataLen+sessionIDHeaderLen+int(sessionIDLen):]
-	if len(cs) < cipherSuiteHeaderLen {
-		return nil
-	}
-	csLen := uint16(cs[0])<<8 | uint16(cs[1])
-	numCiphers := int(csLen / 2)
-	cipherSuites := make([]uint16, 0, numCiphers)
-	if len(cs) < cipherSuiteHeaderLen+int(csLen)+compressMethodHeaderLen {
-		return nil
-	}
-	for i := 0; i < numCiphers; i++ {
-		cipherSuite := uint16(cs[2+i<<1])<<8 | uint16(cs[3+i<<1])
-		cipherSuites = append(cipherSuites, cipherSuite)
-	}
-	compressMethodLen := uint16(cs[cipherSuiteHeaderLen+int(csLen)])
-	if len(cs) < cipherSuiteHeaderLen+int(csLen)+compressMethodHeaderLen+int(compressMethodLen) {
-		return nil
-	}
-	currentIndex := cipherSuiteHeaderLen + int(csLen) + compressMethodHeaderLen + int(compressMethodLen)
-	serverName := indexTLSServerNameFromExtensions(cs[currentIndex:])
-	if serverName == nil {
-		return nil
-	}
-	serverName.Index += currentIndex
-	return serverName
-}
-
-func indexTLSServerNameFromExtensions(exs []byte) *myServerName {
-	if len(exs) == 0 {
-		return nil
-	}
-	if len(exs) < extensionsHeaderLen {
-		return nil
-	}
-	exsLen := uint16(exs[0])<<8 | uint16(exs[1])
-	exs = exs[extensionsHeaderLen:]
-	if len(exs) < int(exsLen) {
-		return nil
-	}
-	for currentIndex := extensionsHeaderLen; len(exs) > 0; {
-		if len(exs) < extensionHeaderLen {
-			return nil
-		}
-		exType := uint16(exs[0])<<8 | uint16(exs[1])
-		exLen := uint16(exs[2])<<8 | uint16(exs[3])
-		if len(exs) < extensionHeaderLen+int(exLen) {
-			return nil
-		}
-		sex := exs[extensionHeaderLen : extensionHeaderLen+int(exLen)]
-
-		switch exType {
-		case sniExtensionType:
-			if len(sex) < sniExtensionHeaderLen {
-				return nil
-			}
-			sniType := sex[2]
-			if sniType != sniNameDNSHostnameType {
-				return nil
-			}
-			sniLen := uint16(sex[3])<<8 | uint16(sex[4])
-			sex = sex[sniExtensionHeaderLen:]
-			return &myServerName{
-				Index:  currentIndex + extensionHeaderLen + sniExtensionHeaderLen,
-				Length: int(sniLen),
-				sex:    sex,
-			}
-		}
-		exs = exs[4+exLen:]
-		currentIndex += 4 + int(exLen)
-	}
-	return nil
-}
--- a/common/tlsfragment/public_suffix.go
+++ b/common/tlsfragment/public_suffix.go
@@ -1,55 +0,0 @@
-package tf
-
-import (
-	"bufio"
-	"bytes"
-	_ "embed"
-	"io"
-	"strings"
-	"sync"
-
-	"github.com/sagernet/sing/common/domain"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-)
-
-var publicPrefix = []string{
-	"www",
-}
-
-//go:generate wget -O public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
-
-//go:embed public_suffix_list.dat
-var publicSuffix []byte
-
-var publicSuffixMatcher = sync.OnceValue(func() *domain.Matcher {
-	matcher, err := initPublicSuffixMatcher()
-	if err != nil {
-		panic(F.ToString("error in initialize public suffix matcher"))
-	}
-	return matcher
-})
-
-func initPublicSuffixMatcher() (*domain.Matcher, error) {
-	reader := bufio.NewReader(bytes.NewReader(publicSuffix))
-	var domainList []string
-	for {
-		line, isPrefix, err := reader.ReadLine()
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			return nil, err
-		}
-		if isPrefix {
-			return nil, E.New("unexpected prefix line")
-		}
-		lineStr := string(line)
-		lineStr = strings.TrimSpace(lineStr)
-		if lineStr == "" || strings.HasPrefix(lineStr, "//") {
-			continue
-		}
-		domainList = append(domainList, lineStr)
-	}
-	return domain.NewMatcher(domainList, nil, false), nil
-}
--- a/common/tlsfragment/public_suffix_list.dat
+++ b/common/tlsfragment/public_suffix_list.dat
--- a/common/tlsfragment/wait_darwin.go
+++ b/common/tlsfragment/wait_darwin.go
@@ -1,89 +0,0 @@
-package tf
-
-import (
-	"context"
-	"syscall"
-	"time"
-
-	"github.com/sagernet/sing/common/control"
-
-	"golang.org/x/sys/unix"
-)
-
-/*
-const tcpMaxNotifyAck = 10
-
-type tcpNotifyAckID uint32
-
-	type tcpNotifyAckComplete struct {
-		NotifyPending       uint32
-		NotifyCompleteCount uint32
-		NotifyCompleteID    [tcpMaxNotifyAck]tcpNotifyAckID
-	}
-
-var sizeOfTCPNotifyAckComplete = int(unsafe.Sizeof(tcpNotifyAckComplete{}))
-
-	func getsockoptTCPNotifyAckComplete(fd, level, opt int) (*tcpNotifyAckComplete, error) {
-		var value tcpNotifyAckComplete
-		vallen := uint32(sizeOfTCPNotifyAckComplete)
-		err := getsockopt(fd, level, opt, unsafe.Pointer(&value), &vallen)
-		return &value, err
-	}
-
-//go:linkname getsockopt golang.org/x/sys/unix.getsockopt
-func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *uint32) error
-
-	func waitAck(ctx context.Context, conn *net.TCPConn, _ time.Duration) error {
-		const TCP_NOTIFY_ACKNOWLEDGEMENT = 0x212
-		return control.Conn(conn, func(fd uintptr) error {
-			err := unix.SetsockoptInt(int(fd), unix.IPPROTO_TCP, TCP_NOTIFY_ACKNOWLEDGEMENT, 1)
-			if err != nil {
-				if errors.Is(err, unix.EINVAL) {
-					return waitAckFallback(ctx, conn, 0)
-				}
-				return err
-			}
-			for {
-				select {
-				case <-ctx.Done():
-					return ctx.Err()
-				default:
-				}
-				var ackComplete *tcpNotifyAckComplete
-				ackComplete, err = getsockoptTCPNotifyAckComplete(int(fd), unix.IPPROTO_TCP, TCP_NOTIFY_ACKNOWLEDGEMENT)
-				if err != nil {
-					return err
-				}
-				if ackComplete.NotifyPending == 0 {
-					return nil
-				}
-				time.Sleep(10 * time.Millisecond)
-			}
-		})
-	}
-*/
-
-func waitAck(ctx context.Context, conn syscall.Conn, fallbackDelay time.Duration) error {
-	return control.Conn(conn, func(fd uintptr) error {
-		start := time.Now()
-		for {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			default:
-			}
-			unacked, err := unix.GetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_NWRITE)
-			if err != nil {
-				return err
-			}
-			if unacked == 0 {
-				if time.Since(start) <= 20*time.Millisecond {
-					// under transparent proxy
-					time.Sleep(fallbackDelay)
-				}
-				return nil
-			}
-			time.Sleep(10 * time.Millisecond)
-		}
-	})
-}
--- a/common/tlsfragment/wait_linux.go
+++ b/common/tlsfragment/wait_linux.go
@@ -1,36 +0,0 @@
-package tf
-
-import (
-	"context"
-	"syscall"
-	"time"
-
-	"github.com/sagernet/sing/common/control"
-
-	"golang.org/x/sys/unix"
-)
-
-func waitAck(ctx context.Context, conn syscall.Conn, fallbackDelay time.Duration) error {
-	return control.Conn(conn, func(fd uintptr) error {
-		start := time.Now()
-		for {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			default:
-			}
-			tcpInfo, err := unix.GetsockoptTCPInfo(int(fd), unix.IPPROTO_TCP, unix.TCP_INFO)
-			if err != nil {
-				return err
-			}
-			if tcpInfo.Unacked == 0 {
-				if time.Since(start) <= 20*time.Millisecond {
-					// under transparent proxy
-					time.Sleep(fallbackDelay)
-				}
-				return nil
-			}
-			time.Sleep(10 * time.Millisecond)
-		}
-	})
-}
--- a/common/tlsfragment/wait_stub.go
+++ b/common/tlsfragment/wait_stub.go
@@ -1,14 +0,0 @@
-//go:build !(linux || darwin)
-
-package tf
-
-import (
-	"context"
-	"syscall"
-	"time"
-)
-
-func waitAck(ctx context.Context, conn syscall.Conn, fallbackDelay time.Duration) error {
-	time.Sleep(fallbackDelay)
-	return nil
-}
--- a/constant/cgo_android_fix.go
+++ b/constant/cgo_android_fix.go
@@ -0,0 +1,8 @@
+//go:build android && debug
+
+package constant
+
+// TODO: remove after fixed
+// https://github.com/golang/go/issues/68760
+
+const FixAndroidStack = true
--- a/constant/cgo_android_fix_stub.go
+++ b/constant/cgo_android_fix_stub.go
@@ -0,0 +1,5 @@
+//go:build !(android && debug)
+
+package constant
+
+const FixAndroidStack = false
--- a/constant/dns.go
+++ b/constant/dns.go
@@ -1,34 +1,5 @@
 package constant

-const (
-	DefaultDNSTTL = 600
-)
-
-type DomainStrategy = uint8
-
-const (
-	DomainStrategyAsIS DomainStrategy = iota
-	DomainStrategyPreferIPv4
-	DomainStrategyPreferIPv6
-	DomainStrategyIPv4Only
-	DomainStrategyIPv6Only
-)
-
-const (
-	DNSTypeLegacy     = "legacy"
-	DNSTypeUDP        = "udp"
-	DNSTypeTCP        = "tcp"
-	DNSTypeTLS        = "tls"
-	DNSTypeHTTPS      = "https"
-	DNSTypeQUIC       = "quic"
-	DNSTypeHTTP3      = "h3"
-	DNSTypeHosts      = "hosts"
-	DNSTypeLocal      = "local"
-	DNSTypePreDefined = "predefined"
-	DNSTypeFakeIP     = "fakeip"
-	DNSTypeDHCP       = "dhcp"
-)
-
 const (
 	DNSProviderAliDNS     = "alidns"
 	DNSProviderCloudflare = "cloudflare"
--- a/constant/timeout.go
+++ b/constant/timeout.go
@@ -16,7 +16,6 @@ const (
 	StopTimeout                = 5 * time.Second
 	FatalStopTimeout           = 10 * time.Second
 	FakeIPMetadataSaveInterval = 10 * time.Second
-	TLSFragmentFallbackDelay   = 500 * time.Millisecond
 )

 var PortProtocols = map[uint16]string{
--- a/dns/client.go
+++ b/dns/client.go
@@ -1,563 +0,0 @@
-package dns
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	"github.com/sagernet/sing/common/task"
-	"github.com/sagernet/sing/contrab/freelru"
-	"github.com/sagernet/sing/contrab/maphash"
-
-	"github.com/miekg/dns"
-)
-
-var (
-	ErrNoRawSupport           = E.New("no raw query support by current transport")
-	ErrNotCached              = E.New("not cached")
-	ErrResponseRejected       = E.New("response rejected")
-	ErrResponseRejectedCached = E.Extend(ErrResponseRejected, "cached")
-)
-
-var _ adapter.DNSClient = (*Client)(nil)
-
-type Client struct {
-	timeout          time.Duration
-	disableCache     bool
-	disableExpire    bool
-	independentCache bool
-	rdrc             adapter.RDRCStore
-	initRDRCFunc     func() adapter.RDRCStore
-	logger           logger.ContextLogger
-	cache            freelru.Cache[dns.Question, *dns.Msg]
-	transportCache   freelru.Cache[transportCacheKey, *dns.Msg]
-}
-
-type ClientOptions struct {
-	Timeout          time.Duration
-	DisableCache     bool
-	DisableExpire    bool
-	IndependentCache bool
-	CacheCapacity    uint32
-	RDRC             func() adapter.RDRCStore
-	Logger           logger.ContextLogger
-}
-
-func NewClient(options ClientOptions) *Client {
-	client := &Client{
-		timeout:          options.Timeout,
-		disableCache:     options.DisableCache,
-		disableExpire:    options.DisableExpire,
-		independentCache: options.IndependentCache,
-		initRDRCFunc:     options.RDRC,
-		logger:           options.Logger,
-	}
-	if client.timeout == 0 {
-		client.timeout = C.DNSTimeout
-	}
-	cacheCapacity := options.CacheCapacity
-	if cacheCapacity < 1024 {
-		cacheCapacity = 1024
-	}
-	if !client.disableCache {
-		if !client.independentCache {
-			client.cache = common.Must1(freelru.NewSharded[dns.Question, *dns.Msg](cacheCapacity, maphash.NewHasher[dns.Question]().Hash32))
-		} else {
-			client.transportCache = common.Must1(freelru.NewSharded[transportCacheKey, *dns.Msg](cacheCapacity, maphash.NewHasher[transportCacheKey]().Hash32))
-		}
-	}
-	return client
-}
-
-type transportCacheKey struct {
-	dns.Question
-	transportTag string
-}
-
-func (c *Client) Start() {
-	if c.initRDRCFunc != nil {
-		c.rdrc = c.initRDRCFunc()
-	}
-}
-
-func (c *Client) Exchange(ctx context.Context, transport adapter.DNSTransport, message *dns.Msg, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) (*dns.Msg, error) {
-	if len(message.Question) == 0 {
-		if c.logger != nil {
-			c.logger.WarnContext(ctx, "bad question size: ", len(message.Question))
-		}
-		responseMessage := dns.Msg{
-			MsgHdr: dns.MsgHdr{
-				Id:       message.Id,
-				Response: true,
-				Rcode:    dns.RcodeFormatError,
-			},
-			Question: message.Question,
-		}
-		return &responseMessage, nil
-	}
-	question := message.Question[0]
-	if options.ClientSubnet.IsValid() {
-		message = SetClientSubnet(message, options.ClientSubnet, true)
-	}
-	isSimpleRequest := len(message.Question) == 1 &&
-		len(message.Ns) == 0 &&
-		len(message.Extra) == 0 &&
-		!options.ClientSubnet.IsValid()
-	disableCache := !isSimpleRequest || c.disableCache || options.DisableCache
-	if !disableCache {
-		response, ttl := c.loadResponse(question, transport)
-		if response != nil {
-			logCachedResponse(c.logger, ctx, response, ttl)
-			response.Id = message.Id
-			return response, nil
-		}
-	}
-	if question.Qtype == dns.TypeA && options.Strategy == C.DomainStrategyIPv6Only || question.Qtype == dns.TypeAAAA && options.Strategy == C.DomainStrategyIPv4Only {
-		responseMessage := dns.Msg{
-			MsgHdr: dns.MsgHdr{
-				Id:       message.Id,
-				Response: true,
-				Rcode:    dns.RcodeSuccess,
-			},
-			Question: []dns.Question{question},
-		}
-		if c.logger != nil {
-			c.logger.DebugContext(ctx, "strategy rejected")
-		}
-		return &responseMessage, nil
-	}
-	messageId := message.Id
-	contextTransport, clientSubnetLoaded := transportTagFromContext(ctx)
-	if clientSubnetLoaded && transport.Tag() == contextTransport {
-		return nil, E.New("DNS query loopback in transport[", contextTransport, "]")
-	}
-	ctx = contextWithTransportTag(ctx, transport.Tag())
-	if responseChecker != nil && c.rdrc != nil {
-		rejected := c.rdrc.LoadRDRC(transport.Tag(), question.Name, question.Qtype)
-		if rejected {
-			return nil, ErrResponseRejectedCached
-		}
-	}
-	ctx, cancel := context.WithTimeout(ctx, c.timeout)
-	response, err := transport.Exchange(ctx, message)
-	cancel()
-	if err != nil {
-		return nil, err
-	}
-	/*if question.Qtype == dns.TypeA || question.Qtype == dns.TypeAAAA {
-		validResponse := response
-	loop:
-		for {
-			var (
-				addresses  int
-				queryCNAME string
-			)
-			for _, rawRR := range validResponse.Answer {
-				switch rr := rawRR.(type) {
-				case *dns.A:
-					break loop
-				case *dns.AAAA:
-					break loop
-				case *dns.CNAME:
-					queryCNAME = rr.Target
-				}
-			}
-			if queryCNAME == "" {
-				break
-			}
-			exMessage := *message
-			exMessage.Question = []dns.Question{{
-				Name:  queryCNAME,
-				Qtype: question.Qtype,
-			}}
-			validResponse, err = c.Exchange(ctx, transport, &exMessage, options, responseChecker)
-			if err != nil {
-				return nil, err
-			}
-		}
-		if validResponse != response {
-			response.Answer = append(response.Answer, validResponse.Answer...)
-		}
-	}*/
-	if responseChecker != nil {
-		addr, addrErr := MessageToAddresses(response)
-		if addrErr != nil || !responseChecker(addr) {
-			if c.rdrc != nil {
-				c.rdrc.SaveRDRCAsync(transport.Tag(), question.Name, question.Qtype, c.logger)
-			}
-			logRejectedResponse(c.logger, ctx, response)
-			return response, ErrResponseRejected
-		}
-	}
-	if question.Qtype == dns.TypeHTTPS {
-		if options.Strategy == C.DomainStrategyIPv4Only || options.Strategy == C.DomainStrategyIPv6Only {
-			for _, rr := range response.Answer {
-				https, isHTTPS := rr.(*dns.HTTPS)
-				if !isHTTPS {
-					continue
-				}
-				content := https.SVCB
-				content.Value = common.Filter(content.Value, func(it dns.SVCBKeyValue) bool {
-					if options.Strategy == C.DomainStrategyIPv4Only {
-						return it.Key() != dns.SVCB_IPV6HINT
-					} else {
-						return it.Key() != dns.SVCB_IPV4HINT
-					}
-				})
-				https.SVCB = content
-			}
-		}
-	}
-	var timeToLive uint32
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			if timeToLive == 0 || record.Header().Ttl > 0 && record.Header().Ttl < timeToLive {
-				timeToLive = record.Header().Ttl
-			}
-		}
-	}
-	if options.RewriteTTL != nil {
-		timeToLive = *options.RewriteTTL
-	}
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			record.Header().Ttl = timeToLive
-		}
-	}
-	response.Id = messageId
-	if !disableCache {
-		c.storeCache(transport, question, response, timeToLive)
-	}
-	logExchangedResponse(c.logger, ctx, response, timeToLive)
-	return response, err
-}
-
-func (c *Client) Lookup(ctx context.Context, transport adapter.DNSTransport, domain string, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error) {
-	domain = FqdnToDomain(domain)
-	dnsName := dns.Fqdn(domain)
-	if options.Strategy == C.DomainStrategyIPv4Only {
-		return c.lookupToExchange(ctx, transport, dnsName, dns.TypeA, options, responseChecker)
-	} else if options.Strategy == C.DomainStrategyIPv6Only {
-		return c.lookupToExchange(ctx, transport, dnsName, dns.TypeAAAA, options, responseChecker)
-	}
-	var response4 []netip.Addr
-	var response6 []netip.Addr
-	var group task.Group
-	group.Append("exchange4", func(ctx context.Context) error {
-		response, err := c.lookupToExchange(ctx, transport, dnsName, dns.TypeA, options, responseChecker)
-		if err != nil {
-			return err
-		}
-		response4 = response
-		return nil
-	})
-	group.Append("exchange6", func(ctx context.Context) error {
-		response, err := c.lookupToExchange(ctx, transport, dnsName, dns.TypeAAAA, options, responseChecker)
-		if err != nil {
-			return err
-		}
-		response6 = response
-		return nil
-	})
-	err := group.Run(ctx)
-	if len(response4) == 0 && len(response6) == 0 {
-		return nil, err
-	}
-	return sortAddresses(response4, response6, options.Strategy), nil
-}
-
-func (c *Client) ClearCache() {
-	if c.cache != nil {
-		c.cache.Purge()
-	}
-	if c.transportCache != nil {
-		c.transportCache.Purge()
-	}
-}
-
-func (c *Client) LookupCache(domain string, strategy C.DomainStrategy) ([]netip.Addr, bool) {
-	if c.disableCache || c.independentCache {
-		return nil, false
-	}
-	if dns.IsFqdn(domain) {
-		domain = domain[:len(domain)-1]
-	}
-	dnsName := dns.Fqdn(domain)
-	if strategy == C.DomainStrategyIPv4Only {
-		response, err := c.questionCache(dns.Question{
-			Name:   dnsName,
-			Qtype:  dns.TypeA,
-			Qclass: dns.ClassINET,
-		}, nil)
-		if err != ErrNotCached {
-			return response, true
-		}
-	} else if strategy == C.DomainStrategyIPv6Only {
-		response, err := c.questionCache(dns.Question{
-			Name:   dnsName,
-			Qtype:  dns.TypeAAAA,
-			Qclass: dns.ClassINET,
-		}, nil)
-		if err != ErrNotCached {
-			return response, true
-		}
-	} else {
-		response4, _ := c.questionCache(dns.Question{
-			Name:   dnsName,
-			Qtype:  dns.TypeA,
-			Qclass: dns.ClassINET,
-		}, nil)
-		response6, _ := c.questionCache(dns.Question{
-			Name:   dnsName,
-			Qtype:  dns.TypeAAAA,
-			Qclass: dns.ClassINET,
-		}, nil)
-		if len(response4) > 0 || len(response6) > 0 {
-			return sortAddresses(response4, response6, strategy), true
-		}
-	}
-	return nil, false
-}
-
-func (c *Client) ExchangeCache(ctx context.Context, message *dns.Msg) (*dns.Msg, bool) {
-	if c.disableCache || c.independentCache || len(message.Question) != 1 {
-		return nil, false
-	}
-	question := message.Question[0]
-	response, ttl := c.loadResponse(question, nil)
-	if response == nil {
-		return nil, false
-	}
-	logCachedResponse(c.logger, ctx, response, ttl)
-	response.Id = message.Id
-	return response, true
-}
-
-func sortAddresses(response4 []netip.Addr, response6 []netip.Addr, strategy C.DomainStrategy) []netip.Addr {
-	if strategy == C.DomainStrategyPreferIPv6 {
-		return append(response6, response4...)
-	} else {
-		return append(response4, response6...)
-	}
-}
-
-func (c *Client) storeCache(transport adapter.DNSTransport, question dns.Question, message *dns.Msg, timeToLive uint32) {
-	if timeToLive == 0 {
-		return
-	}
-	if c.disableExpire {
-		if !c.independentCache {
-			c.cache.Add(question, message)
-		} else {
-			c.transportCache.Add(transportCacheKey{
-				Question:     question,
-				transportTag: transport.Tag(),
-			}, message)
-		}
-		return
-	}
-	if !c.independentCache {
-		c.cache.AddWithLifetime(question, message, time.Second*time.Duration(timeToLive))
-	} else {
-		c.transportCache.AddWithLifetime(transportCacheKey{
-			Question:     question,
-			transportTag: transport.Tag(),
-		}, message, time.Second*time.Duration(timeToLive))
-	}
-}
-
-func (c *Client) lookupToExchange(ctx context.Context, transport adapter.DNSTransport, name string, qType uint16, options adapter.DNSQueryOptions, responseChecker func(responseAddrs []netip.Addr) bool) ([]netip.Addr, error) {
-	question := dns.Question{
-		Name:   name,
-		Qtype:  qType,
-		Qclass: dns.ClassINET,
-	}
-	disableCache := c.disableCache || options.DisableCache
-	if !disableCache {
-		cachedAddresses, err := c.questionCache(question, transport)
-		if err != ErrNotCached {
-			return cachedAddresses, err
-		}
-	}
-	message := dns.Msg{
-		MsgHdr: dns.MsgHdr{
-			RecursionDesired: true,
-		},
-		Question: []dns.Question{question},
-	}
-	response, err := c.Exchange(ctx, transport, &message, options, responseChecker)
-	if err != nil {
-		return nil, err
-	}
-	return MessageToAddresses(response)
-}
-
-func (c *Client) questionCache(question dns.Question, transport adapter.DNSTransport) ([]netip.Addr, error) {
-	response, _ := c.loadResponse(question, transport)
-	if response == nil {
-		return nil, ErrNotCached
-	}
-	return MessageToAddresses(response)
-}
-
-func (c *Client) loadResponse(question dns.Question, transport adapter.DNSTransport) (*dns.Msg, int) {
-	var (
-		response *dns.Msg
-		loaded   bool
-	)
-	if c.disableExpire {
-		if !c.independentCache {
-			response, loaded = c.cache.Get(question)
-		} else {
-			response, loaded = c.transportCache.Get(transportCacheKey{
-				Question:     question,
-				transportTag: transport.Tag(),
-			})
-		}
-		if !loaded {
-			return nil, 0
-		}
-		return response.Copy(), 0
-	} else {
-		var expireAt time.Time
-		if !c.independentCache {
-			response, expireAt, loaded = c.cache.GetWithLifetime(question)
-		} else {
-			response, expireAt, loaded = c.transportCache.GetWithLifetime(transportCacheKey{
-				Question:     question,
-				transportTag: transport.Tag(),
-			})
-		}
-		if !loaded {
-			return nil, 0
-		}
-		timeNow := time.Now()
-		if timeNow.After(expireAt) {
-			if !c.independentCache {
-				c.cache.Remove(question)
-			} else {
-				c.transportCache.Remove(transportCacheKey{
-					Question:     question,
-					transportTag: transport.Tag(),
-				})
-			}
-			return nil, 0
-		}
-		var originTTL int
-		for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-			for _, record := range recordList {
-				if originTTL == 0 || record.Header().Ttl > 0 && int(record.Header().Ttl) < originTTL {
-					originTTL = int(record.Header().Ttl)
-				}
-			}
-		}
-		nowTTL := int(expireAt.Sub(timeNow).Seconds())
-		if nowTTL < 0 {
-			nowTTL = 0
-		}
-		response = response.Copy()
-		if originTTL > 0 {
-			duration := uint32(originTTL - nowTTL)
-			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-				for _, record := range recordList {
-					record.Header().Ttl = record.Header().Ttl - duration
-				}
-			}
-		} else {
-			for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-				for _, record := range recordList {
-					record.Header().Ttl = uint32(nowTTL)
-				}
-			}
-		}
-		return response, nowTTL
-	}
-}
-
-func MessageToAddresses(response *dns.Msg) ([]netip.Addr, error) {
-	if response.Rcode != dns.RcodeSuccess && response.Rcode != dns.RcodeNameError {
-		return nil, RCodeError(response.Rcode)
-	}
-	addresses := make([]netip.Addr, 0, len(response.Answer))
-	for _, rawAnswer := range response.Answer {
-		switch answer := rawAnswer.(type) {
-		case *dns.A:
-			addresses = append(addresses, M.AddrFromIP(answer.A))
-		case *dns.AAAA:
-			addresses = append(addresses, M.AddrFromIP(answer.AAAA))
-		case *dns.HTTPS:
-			for _, value := range answer.SVCB.Value {
-				if value.Key() == dns.SVCB_IPV4HINT || value.Key() == dns.SVCB_IPV6HINT {
-					addresses = append(addresses, common.Map(strings.Split(value.String(), ","), M.ParseAddr)...)
-				}
-			}
-		}
-	}
-	return addresses, nil
-}
-
-func wrapError(err error) error {
-	switch dnsErr := err.(type) {
-	case *net.DNSError:
-		if dnsErr.IsNotFound {
-			return RCodeNameError
-		}
-	case *net.AddrError:
-		return RCodeNameError
-	}
-	return err
-}
-
-type transportKey struct{}
-
-func contextWithTransportTag(ctx context.Context, transportTag string) context.Context {
-	return context.WithValue(ctx, transportKey{}, transportTag)
-}
-
-func transportTagFromContext(ctx context.Context) (string, bool) {
-	value, loaded := ctx.Value(transportKey{}).(string)
-	return value, loaded
-}
-
-func FixedResponse(id uint16, question dns.Question, addresses []netip.Addr, timeToLive uint32) *dns.Msg {
-	response := dns.Msg{
-		MsgHdr: dns.MsgHdr{
-			Id:       id,
-			Rcode:    dns.RcodeSuccess,
-			Response: true,
-		},
-		Question: []dns.Question{question},
-	}
-	for _, address := range addresses {
-		if address.Is4() {
-			response.Answer = append(response.Answer, &dns.A{
-				Hdr: dns.RR_Header{
-					Name:   question.Name,
-					Rrtype: dns.TypeA,
-					Class:  dns.ClassINET,
-					Ttl:    timeToLive,
-				},
-				A: address.AsSlice(),
-			})
-		} else {
-			response.Answer = append(response.Answer, &dns.AAAA{
-				Hdr: dns.RR_Header{
-					Name:   question.Name,
-					Rrtype: dns.TypeAAAA,
-					Class:  dns.ClassINET,
-					Ttl:    timeToLive,
-				},
-				AAAA: address.AsSlice(),
-			})
-		}
-	}
-	return &response
-}
--- a/dns/client_log.go
+++ b/dns/client_log.go
@@ -1,69 +0,0 @@
-package dns
-
-import (
-	"context"
-	"strings"
-
-	"github.com/sagernet/sing/common/logger"
-
-	"github.com/miekg/dns"
-)
-
-func logCachedResponse(logger logger.ContextLogger, ctx context.Context, response *dns.Msg, ttl int) {
-	if logger == nil || len(response.Question) == 0 {
-		return
-	}
-	domain := FqdnToDomain(response.Question[0].Name)
-	logger.DebugContext(ctx, "cached ", domain, " ", dns.RcodeToString[response.Rcode], " ", ttl)
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			logger.InfoContext(ctx, "cached ", dns.Type(record.Header().Rrtype).String(), " ", FormatQuestion(record.String()))
-		}
-	}
-}
-
-func logExchangedResponse(logger logger.ContextLogger, ctx context.Context, response *dns.Msg, ttl uint32) {
-	if logger == nil || len(response.Question) == 0 {
-		return
-	}
-	domain := FqdnToDomain(response.Question[0].Name)
-	logger.DebugContext(ctx, "exchanged ", domain, " ", dns.RcodeToString[response.Rcode], " ", ttl)
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			logger.InfoContext(ctx, "exchanged ", dns.Type(record.Header().Rrtype).String(), " ", FormatQuestion(record.String()))
-		}
-	}
-}
-
-func logRejectedResponse(logger logger.ContextLogger, ctx context.Context, response *dns.Msg) {
-	if logger == nil || len(response.Question) == 0 {
-		return
-	}
-	for _, recordList := range [][]dns.RR{response.Answer, response.Ns, response.Extra} {
-		for _, record := range recordList {
-			logger.InfoContext(ctx, "rejected ", dns.Type(record.Header().Rrtype).String(), " ", FormatQuestion(record.String()))
-		}
-	}
-}
-
-func FqdnToDomain(fqdn string) string {
-	if dns.IsFqdn(fqdn) {
-		return fqdn[:len(fqdn)-1]
-	}
-	return fqdn
-}
-
-func FormatQuestion(string string) string {
-	for strings.HasPrefix(string, ";") {
-		string = string[1:]
-	}
-	string = strings.ReplaceAll(string, "\t", " ")
-	string = strings.ReplaceAll(string, "\n", " ")
-	string = strings.ReplaceAll(string, ";; ", " ")
-	string = strings.ReplaceAll(string, "; ", " ")
-
-	for strings.Contains(string, "  ") {
-		string = strings.ReplaceAll(string, "  ", " ")
-	}
-	return strings.TrimSpace(string)
-}
--- a/dns/client_truncate.go
+++ b/dns/client_truncate.go
@@ -1,29 +0,0 @@
-package dns
-
-import (
-	"github.com/sagernet/sing/common/buf"
-
-	"github.com/miekg/dns"
-)
-
-func TruncateDNSMessage(request *dns.Msg, response *dns.Msg, headroom int) (*buf.Buffer, error) {
-	maxLen := 512
-	if edns0Option := request.IsEdns0(); edns0Option != nil {
-		if udpSize := int(edns0Option.UDPSize()); udpSize > 512 {
-			maxLen = udpSize
-		}
-	}
-	responseLen := response.Len()
-	if responseLen > maxLen {
-		response.Truncate(maxLen)
-	}
-	buffer := buf.NewSize(headroom*2 + 1 + responseLen)
-	buffer.Resize(headroom, 0)
-	rawMessage, err := response.PackBuffer(buffer.FreeBytes())
-	if err != nil {
-		buffer.Release()
-		return nil, err
-	}
-	buffer.Truncate(len(rawMessage))
-	return buffer, nil
-}
--- a/dns/extension_edns0_subnet.go
+++ b/dns/extension_edns0_subnet.go
@@ -1,56 +0,0 @@
-package dns
-
-import (
-	"net/netip"
-
-	"github.com/miekg/dns"
-)
-
-func SetClientSubnet(message *dns.Msg, clientSubnet netip.Prefix, override bool) *dns.Msg {
-	var (
-		optRecord    *dns.OPT
-		subnetOption *dns.EDNS0_SUBNET
-	)
-findExists:
-	for _, record := range message.Extra {
-		var isOPTRecord bool
-		if optRecord, isOPTRecord = record.(*dns.OPT); isOPTRecord {
-			for _, option := range optRecord.Option {
-				var isEDNS0Subnet bool
-				subnetOption, isEDNS0Subnet = option.(*dns.EDNS0_SUBNET)
-				if isEDNS0Subnet {
-					if !override {
-						return message
-					}
-					break findExists
-				}
-			}
-		}
-	}
-	if optRecord == nil {
-		exMessage := *message
-		message = &exMessage
-		optRecord = &dns.OPT{
-			Hdr: dns.RR_Header{
-				Name:   ".",
-				Rrtype: dns.TypeOPT,
-			},
-		}
-		message.Extra = append(message.Extra, optRecord)
-	} else {
-		message = message.Copy()
-	}
-	if subnetOption == nil {
-		subnetOption = new(dns.EDNS0_SUBNET)
-		optRecord.Option = append(optRecord.Option, subnetOption)
-	}
-	subnetOption.Code = dns.EDNS0SUBNET
-	if clientSubnet.Addr().Is4() {
-		subnetOption.Family = 1
-	} else {
-		subnetOption.Family = 2
-	}
-	subnetOption.SourceNetmask = uint8(clientSubnet.Bits())
-	subnetOption.Address = clientSubnet.Addr().AsSlice()
-	return message
-}
--- a/dns/rcode.go
+++ b/dns/rcode.go
@@ -1,33 +0,0 @@
-package dns
-
-import F "github.com/sagernet/sing/common/format"
-
-const (
-	RCodeSuccess        RCodeError = 0 // NoError
-	RCodeFormatError    RCodeError = 1 // FormErr
-	RCodeServerFailure  RCodeError = 2 // ServFail
-	RCodeNameError      RCodeError = 3 // NXDomain
-	RCodeNotImplemented RCodeError = 4 // NotImp
-	RCodeRefused        RCodeError = 5 // Refused
-)
-
-type RCodeError uint16
-
-func (e RCodeError) Error() string {
-	switch e {
-	case RCodeSuccess:
-		return "success"
-	case RCodeFormatError:
-		return "format error"
-	case RCodeServerFailure:
-		return "server failure"
-	case RCodeNameError:
-		return "name error"
-	case RCodeNotImplemented:
-		return "not implemented"
-	case RCodeRefused:
-		return "refused"
-	default:
-		return F.ToString("unknown error: ", uint16(e))
-	}
-}
--- a/dns/router.go
+++ b/dns/router.go
@@ -1,436 +0,0 @@
-package dns
-
-import (
-	"context"
-	"errors"
-	"net/netip"
-	"strings"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/taskmonitor"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/experimental/libbox/platform"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	R "github.com/sagernet/sing-box/route/rule"
-	"github.com/sagernet/sing-tun"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	F "github.com/sagernet/sing/common/format"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	"github.com/sagernet/sing/contrab/freelru"
-	"github.com/sagernet/sing/contrab/maphash"
-	"github.com/sagernet/sing/service"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSRouter = (*Router)(nil)
-
-type Router struct {
-	ctx                   context.Context
-	logger                logger.ContextLogger
-	transport             adapter.DNSTransportManager
-	outbound              adapter.OutboundManager
-	client                adapter.DNSClient
-	rules                 []adapter.DNSRule
-	defaultDomainStrategy C.DomainStrategy
-	dnsReverseMapping     freelru.Cache[netip.Addr, string]
-	platformInterface     platform.Interface
-}
-
-func NewRouter(ctx context.Context, logFactory log.Factory, options option.DNSOptions) *Router {
-	router := &Router{
-		ctx:                   ctx,
-		logger:                logFactory.NewLogger("dns"),
-		transport:             service.FromContext[adapter.DNSTransportManager](ctx),
-		outbound:              service.FromContext[adapter.OutboundManager](ctx),
-		rules:                 make([]adapter.DNSRule, 0, len(options.Rules)),
-		defaultDomainStrategy: C.DomainStrategy(options.Strategy),
-	}
-	router.client = NewClient(ClientOptions{
-		DisableCache:     options.DNSClientOptions.DisableCache,
-		DisableExpire:    options.DNSClientOptions.DisableExpire,
-		IndependentCache: options.DNSClientOptions.IndependentCache,
-		CacheCapacity:    options.DNSClientOptions.CacheCapacity,
-		RDRC: func() adapter.RDRCStore {
-			cacheFile := service.FromContext[adapter.CacheFile](ctx)
-			if cacheFile == nil {
-				return nil
-			}
-			if !cacheFile.StoreRDRC() {
-				return nil
-			}
-			return cacheFile
-		},
-		Logger: router.logger,
-	})
-	if options.ReverseMapping {
-		router.dnsReverseMapping = common.Must1(freelru.NewSharded[netip.Addr, string](1024, maphash.NewHasher[netip.Addr]().Hash32))
-	}
-	return router
-}
-
-func (r *Router) Initialize(rules []option.DNSRule) error {
-	for i, ruleOptions := range rules {
-		dnsRule, err := R.NewDNSRule(r.ctx, r.logger, ruleOptions, true)
-		if err != nil {
-			return E.Cause(err, "parse dns rule[", i, "]")
-		}
-		r.rules = append(r.rules, dnsRule)
-	}
-	return nil
-}
-
-func (r *Router) Start(stage adapter.StartStage) error {
-	monitor := taskmonitor.New(r.logger, C.StartTimeout)
-	switch stage {
-	case adapter.StartStateStart:
-		monitor.Start("initialize DNS client")
-		r.client.Start()
-		monitor.Finish()
-
-		for i, rule := range r.rules {
-			monitor.Start("initialize DNS rule[", i, "]")
-			err := rule.Start()
-			monitor.Finish()
-			if err != nil {
-				return E.Cause(err, "initialize DNS rule[", i, "]")
-			}
-		}
-	}
-	return nil
-}
-
-func (r *Router) Close() error {
-	monitor := taskmonitor.New(r.logger, C.StopTimeout)
-	var err error
-	for i, rule := range r.rules {
-		monitor.Start("close dns rule[", i, "]")
-		err = E.Append(err, rule.Close(), func(err error) error {
-			return E.Cause(err, "close dns rule[", i, "]")
-		})
-		monitor.Finish()
-	}
-	return err
-}
-
-func (r *Router) matchDNS(ctx context.Context, allowFakeIP bool, ruleIndex int, isAddressQuery bool, options *adapter.DNSQueryOptions) (adapter.DNSTransport, adapter.DNSRule, int) {
-	metadata := adapter.ContextFrom(ctx)
-	if metadata == nil {
-		panic("no context")
-	}
-	var currentRuleIndex int
-	if ruleIndex != -1 {
-		currentRuleIndex = ruleIndex + 1
-	}
-	for ; currentRuleIndex < len(r.rules); currentRuleIndex++ {
-		currentRule := r.rules[currentRuleIndex]
-		if currentRule.WithAddressLimit() && !isAddressQuery {
-			continue
-		}
-		metadata.ResetRuleCache()
-		if currentRule.Match(metadata) {
-			displayRuleIndex := currentRuleIndex
-			if displayRuleIndex != -1 {
-				displayRuleIndex += displayRuleIndex + 1
-			}
-			ruleDescription := currentRule.String()
-			if ruleDescription != "" {
-				r.logger.DebugContext(ctx, "match[", displayRuleIndex, "] ", currentRule, " => ", currentRule.Action())
-			} else {
-				r.logger.DebugContext(ctx, "match[", displayRuleIndex, "] => ", currentRule.Action())
-			}
-			switch action := currentRule.Action().(type) {
-			case *R.RuleActionDNSRoute:
-				transport, loaded := r.transport.Transport(action.Server)
-				if !loaded {
-					r.logger.ErrorContext(ctx, "transport not found: ", action.Server)
-					continue
-				}
-				isFakeIP := transport.Type() == C.DNSTypeFakeIP
-				if isFakeIP && !allowFakeIP {
-					continue
-				}
-				if action.Strategy != C.DomainStrategyAsIS {
-					options.Strategy = action.Strategy
-				}
-				if isFakeIP || action.DisableCache {
-					options.DisableCache = true
-				}
-				if action.RewriteTTL != nil {
-					options.RewriteTTL = action.RewriteTTL
-				}
-				if action.ClientSubnet.IsValid() {
-					options.ClientSubnet = action.ClientSubnet
-				}
-				if legacyTransport, isLegacy := transport.(adapter.LegacyDNSTransport); isLegacy {
-					if options.Strategy == C.DomainStrategyAsIS {
-						options.Strategy = legacyTransport.LegacyStrategy()
-					}
-					if !options.ClientSubnet.IsValid() {
-						options.ClientSubnet = legacyTransport.LegacyClientSubnet()
-					}
-				}
-				r.logger.DebugContext(ctx, "match[", displayRuleIndex, "] => ", currentRule.Action())
-				return transport, currentRule, currentRuleIndex
-			case *R.RuleActionDNSRouteOptions:
-				if action.Strategy != C.DomainStrategyAsIS {
-					options.Strategy = action.Strategy
-				}
-				if action.DisableCache {
-					options.DisableCache = true
-				}
-				if action.RewriteTTL != nil {
-					options.RewriteTTL = action.RewriteTTL
-				}
-				if action.ClientSubnet.IsValid() {
-					options.ClientSubnet = action.ClientSubnet
-				}
-				r.logger.DebugContext(ctx, "match[", displayRuleIndex, "] => ", currentRule.Action())
-			case *R.RuleActionReject:
-				r.logger.DebugContext(ctx, "match[", displayRuleIndex, "] => ", currentRule.Action())
-				return nil, currentRule, currentRuleIndex
-			}
-		}
-	}
-	return r.transport.Default(), nil, -1
-}
-
-func (r *Router) Exchange(ctx context.Context, message *mDNS.Msg, options adapter.DNSQueryOptions) (*mDNS.Msg, error) {
-	if len(message.Question) != 1 {
-		r.logger.WarnContext(ctx, "bad question size: ", len(message.Question))
-		responseMessage := mDNS.Msg{
-			MsgHdr: mDNS.MsgHdr{
-				Id:       message.Id,
-				Response: true,
-				Rcode:    mDNS.RcodeFormatError,
-			},
-			Question: message.Question,
-		}
-		return &responseMessage, nil
-	}
-	r.logger.DebugContext(ctx, "exchange ", FormatQuestion(message.Question[0].String()))
-	var (
-		transport adapter.DNSTransport
-		err       error
-	)
-	response, cached := r.client.ExchangeCache(ctx, message)
-	if !cached {
-		var metadata *adapter.InboundContext
-		ctx, metadata = adapter.ExtendContext(ctx)
-		metadata.Destination = M.Socksaddr{}
-		metadata.QueryType = message.Question[0].Qtype
-		switch metadata.QueryType {
-		case mDNS.TypeA:
-			metadata.IPVersion = 4
-		case mDNS.TypeAAAA:
-			metadata.IPVersion = 6
-		}
-		metadata.Domain = FqdnToDomain(message.Question[0].Name)
-		if options.Transport != nil {
-			transport = options.Transport
-			if legacyTransport, isLegacy := transport.(adapter.LegacyDNSTransport); isLegacy {
-				if options.Strategy == C.DomainStrategyAsIS {
-					options.Strategy = legacyTransport.LegacyStrategy()
-				}
-				if !options.ClientSubnet.IsValid() {
-					options.ClientSubnet = legacyTransport.LegacyClientSubnet()
-				}
-			}
-			if options.Strategy == C.DomainStrategyAsIS {
-				options.Strategy = r.defaultDomainStrategy
-			}
-			response, err = r.client.Exchange(ctx, transport, message, options, nil)
-		} else {
-			var (
-				rule      adapter.DNSRule
-				ruleIndex int
-			)
-			ruleIndex = -1
-			for {
-				dnsCtx := adapter.OverrideContext(ctx)
-				transport, rule, ruleIndex = r.matchDNS(ctx, true, ruleIndex, isAddressQuery(message), &options)
-				if rule != nil {
-					switch action := rule.Action().(type) {
-					case *R.RuleActionReject:
-						switch action.Method {
-						case C.RuleActionRejectMethodDefault:
-							return FixedResponse(message.Id, message.Question[0], nil, 0), nil
-						case C.RuleActionRejectMethodDrop:
-							return nil, tun.ErrDrop
-						}
-					}
-				}
-				var responseCheck func(responseAddrs []netip.Addr) bool
-				if rule != nil && rule.WithAddressLimit() {
-					responseCheck = func(responseAddrs []netip.Addr) bool {
-						metadata.DestinationAddresses = responseAddrs
-						return rule.MatchAddressLimit(metadata)
-					}
-				}
-				if options.Strategy == C.DomainStrategyAsIS {
-					options.Strategy = r.defaultDomainStrategy
-				}
-				response, err = r.client.Exchange(dnsCtx, transport, message, options, responseCheck)
-				var rejected bool
-				if err != nil {
-					if errors.Is(err, ErrResponseRejectedCached) {
-						rejected = true
-						r.logger.DebugContext(ctx, E.Cause(err, "response rejected for ", FormatQuestion(message.Question[0].String())), " (cached)")
-					} else if errors.Is(err, ErrResponseRejected) {
-						rejected = true
-						r.logger.DebugContext(ctx, E.Cause(err, "response rejected for ", FormatQuestion(message.Question[0].String())))
-					} else if len(message.Question) > 0 {
-						r.logger.ErrorContext(ctx, E.Cause(err, "exchange failed for ", FormatQuestion(message.Question[0].String())))
-					} else {
-						r.logger.ErrorContext(ctx, E.Cause(err, "exchange failed for <empty query>"))
-					}
-				}
-				if responseCheck != nil && rejected {
-					continue
-				}
-				break
-			}
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-	if r.dnsReverseMapping != nil && len(message.Question) > 0 && response != nil && len(response.Answer) > 0 {
-		if transport.Type() != C.DNSTypeFakeIP {
-			for _, answer := range response.Answer {
-				switch record := answer.(type) {
-				case *mDNS.A:
-					r.dnsReverseMapping.AddWithLifetime(M.AddrFromIP(record.A), FqdnToDomain(record.Hdr.Name), time.Duration(record.Hdr.Ttl)*time.Second)
-				case *mDNS.AAAA:
-					r.dnsReverseMapping.AddWithLifetime(M.AddrFromIP(record.AAAA), FqdnToDomain(record.Hdr.Name), time.Duration(record.Hdr.Ttl)*time.Second)
-				}
-			}
-		}
-	}
-	return response, nil
-}
-
-func (r *Router) Lookup(ctx context.Context, domain string, options adapter.DNSQueryOptions) ([]netip.Addr, error) {
-	var (
-		responseAddrs []netip.Addr
-		cached        bool
-		err           error
-	)
-	printResult := func() {
-		if err != nil {
-			if errors.Is(err, ErrResponseRejectedCached) {
-				r.logger.DebugContext(ctx, "response rejected for ", domain, " (cached)")
-			} else if errors.Is(err, ErrResponseRejected) {
-				r.logger.DebugContext(ctx, "response rejected for ", domain)
-			} else {
-				r.logger.ErrorContext(ctx, E.Cause(err, "lookup failed for ", domain))
-			}
-		} else if len(responseAddrs) == 0 {
-			r.logger.ErrorContext(ctx, "lookup failed for ", domain, ": empty result")
-			err = RCodeNameError
-		}
-	}
-	responseAddrs, cached = r.client.LookupCache(domain, options.Strategy)
-	if cached {
-		if len(responseAddrs) == 0 {
-			return nil, RCodeNameError
-		}
-		return responseAddrs, nil
-	}
-	r.logger.DebugContext(ctx, "lookup domain ", domain)
-	ctx, metadata := adapter.ExtendContext(ctx)
-	metadata.Destination = M.Socksaddr{}
-	metadata.Domain = domain
-	if options.Transport != nil {
-		transport := options.Transport
-		if legacyTransport, isLegacy := transport.(adapter.LegacyDNSTransport); isLegacy {
-			if options.Strategy == C.DomainStrategyAsIS {
-				options.Strategy = r.defaultDomainStrategy
-			}
-			if !options.ClientSubnet.IsValid() {
-				options.ClientSubnet = legacyTransport.LegacyClientSubnet()
-			}
-		}
-		if options.Strategy == C.DomainStrategyAsIS {
-			options.Strategy = r.defaultDomainStrategy
-		}
-		responseAddrs, err = r.client.Lookup(ctx, transport, domain, options, nil)
-	} else {
-		var (
-			transport adapter.DNSTransport
-			rule      adapter.DNSRule
-			ruleIndex int
-		)
-		ruleIndex = -1
-		for {
-			dnsCtx := adapter.OverrideContext(ctx)
-			transport, rule, ruleIndex = r.matchDNS(ctx, false, ruleIndex, true, &options)
-			if rule != nil {
-				switch action := rule.Action().(type) {
-				case *R.RuleActionReject:
-					switch action.Method {
-					case C.RuleActionRejectMethodDefault:
-						return nil, nil
-					case C.RuleActionRejectMethodDrop:
-						return nil, tun.ErrDrop
-					}
-				}
-			}
-			var responseCheck func(responseAddrs []netip.Addr) bool
-			if rule != nil && rule.WithAddressLimit() {
-				responseCheck = func(responseAddrs []netip.Addr) bool {
-					metadata.DestinationAddresses = responseAddrs
-					return rule.MatchAddressLimit(metadata)
-				}
-			}
-			if options.Strategy == C.DomainStrategyAsIS {
-				options.Strategy = r.defaultDomainStrategy
-			}
-			responseAddrs, err = r.client.Lookup(dnsCtx, transport, domain, options, responseCheck)
-			if responseCheck == nil || err == nil {
-				break
-			}
-			printResult()
-		}
-	}
-	printResult()
-	if len(responseAddrs) > 0 {
-		r.logger.InfoContext(ctx, "lookup succeed for ", domain, ": ", strings.Join(F.MapToString(responseAddrs), " "))
-	}
-	return responseAddrs, err
-}
-
-func isAddressQuery(message *mDNS.Msg) bool {
-	for _, question := range message.Question {
-		if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA || question.Qtype == mDNS.TypeHTTPS {
-			return true
-		}
-	}
-	return false
-}
-
-func (r *Router) ClearCache() {
-	r.client.ClearCache()
-	if r.platformInterface != nil {
-		r.platformInterface.ClearDNSCache()
-	}
-}
-
-func (r *Router) LookupReverseMapping(ip netip.Addr) (string, bool) {
-	if r.dnsReverseMapping == nil {
-		return "", false
-	}
-	domain, loaded := r.dnsReverseMapping.Get(ip)
-	return domain, loaded
-}
-
-func (r *Router) ResetNetwork() {
-	r.ClearCache()
-	for _, transport := range r.transport.Transports() {
-		transport.Reset()
-	}
-}
--- a/dns/transport/fakeip/fakeip.go
+++ b/dns/transport/fakeip/fakeip.go
@@ -1,56 +0,0 @@
-package fakeip
-
-import (
-	"context"
-	"net/netip"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-
-	mDNS "github.com/miekg/dns"
-)
-
-func RegisterTransport(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.FakeIPDNSServerOptions](registry, C.DNSTypeFakeIP, NewTransport)
-}
-
-var _ adapter.FakeIPTransport = (*Transport)(nil)
-
-type Transport struct {
-	dns.TransportAdapter
-	logger logger.ContextLogger
-	store  adapter.FakeIPStore
-}
-
-func NewTransport(ctx context.Context, logger log.ContextLogger, tag string, options option.FakeIPDNSServerOptions) (adapter.DNSTransport, error) {
-	store := NewStore(ctx, logger, options.Inet4Range.Build(netip.Prefix{}), options.Inet6Range.Build(netip.Prefix{}))
-	return &Transport{
-		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeFakeIP, tag, nil),
-		logger:           logger,
-		store:            store,
-	}, nil
-}
-
-func (t *Transport) Reset() {
-}
-
-func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	question := message.Question[0]
-	if question.Qtype != mDNS.TypeA && question.Qtype != mDNS.TypeAAAA {
-		return nil, E.New("only IP queries are supported by fakeip")
-	}
-	address, err := t.store.Create(question.Name, question.Qtype == mDNS.TypeAAAA)
-	if err != nil {
-		return nil, err
-	}
-	return dns.FixedResponse(message.Id, question, []netip.Addr{address}, C.DefaultDNSTTL), nil
-}
-
-func (t *Transport) Store() adapter.FakeIPStore {
-	return t.store
-}
--- a/dns/transport/hosts/hosts.go
+++ b/dns/transport/hosts/hosts.go
@@ -1,63 +0,0 @@
-package hosts
-
-import (
-	"context"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-
-	mDNS "github.com/miekg/dns"
-)
-
-func RegisterTransport(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.HostsDNSServerOptions](registry, C.DNSTypeHosts, NewTransport)
-}
-
-var _ adapter.DNSTransport = (*Transport)(nil)
-
-type Transport struct {
-	dns.TransportAdapter
-	files []*File
-}
-
-func NewTransport(ctx context.Context, logger log.ContextLogger, tag string, options option.HostsDNSServerOptions) (adapter.DNSTransport, error) {
-	var files []*File
-	if len(options.Path) == 0 {
-		files = append(files, NewFile(DefaultPath))
-	} else {
-		for _, path := range options.Path {
-			files = append(files, NewFile(path))
-		}
-	}
-	return &Transport{
-		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHosts, tag, nil),
-		files:            files,
-	}, nil
-}
-
-func (t *Transport) Reset() {
-}
-
-func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	question := message.Question[0]
-	domain := dns.FqdnToDomain(question.Name)
-	if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA {
-		for _, file := range t.files {
-			addresses := file.Lookup(domain)
-			if len(addresses) > 0 {
-				return dns.FixedResponse(message.Id, question, addresses, C.DefaultDNSTTL), nil
-			}
-		}
-	}
-	return &mDNS.Msg{
-		MsgHdr: mDNS.MsgHdr{
-			Id:       message.Id,
-			Rcode:    mDNS.RcodeNameError,
-			Response: true,
-		},
-		Question: []mDNS.Question{question},
-	}, nil
-}
--- a/dns/transport/hosts/hosts_file.go
+++ b/dns/transport/hosts/hosts_file.go
@@ -1,102 +0,0 @@
-package hosts
-
-import (
-	"bufio"
-	"errors"
-	"io"
-	"net/netip"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/miekg/dns"
-)
-
-const cacheMaxAge = 5 * time.Second
-
-type File struct {
-	path    string
-	access  sync.Mutex
-	byName  map[string][]netip.Addr
-	expire  time.Time
-	modTime time.Time
-	size    int64
-}
-
-func NewFile(path string) *File {
-	return &File{
-		path: path,
-	}
-}
-
-func (f *File) Lookup(name string) []netip.Addr {
-	f.access.Lock()
-	defer f.access.Unlock()
-	f.update()
-	return f.byName[name]
-}
-
-func (f *File) update() {
-	now := time.Now()
-	if now.Before(f.expire) && len(f.byName) > 0 {
-		return
-	}
-	stat, err := os.Stat(f.path)
-	if err != nil {
-		return
-	}
-	if f.modTime.Equal(stat.ModTime()) && f.size == stat.Size() {
-		f.expire = now.Add(cacheMaxAge)
-		return
-	}
-	byName := make(map[string][]netip.Addr)
-	file, err := os.Open(f.path)
-	if err != nil {
-		return
-	}
-	defer file.Close()
-	reader := bufio.NewReader(file)
-	var (
-		prefix   []byte
-		line     []byte
-		isPrefix bool
-	)
-	for {
-		line, isPrefix, err = reader.ReadLine()
-		if err != nil {
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			return
-		}
-		if isPrefix {
-			prefix = append(prefix, line...)
-			continue
-		} else if len(prefix) > 0 {
-			line = append(prefix, line...)
-			prefix = nil
-		}
-		commentIndex := strings.IndexRune(string(line), '#')
-		if commentIndex != -1 {
-			line = line[:commentIndex]
-		}
-		fields := strings.Fields(string(line))
-		if len(fields) < 2 {
-			continue
-		}
-		var addr netip.Addr
-		addr, err = netip.ParseAddr(fields[0])
-		if err != nil {
-			continue
-		}
-		for index := 1; index < len(fields); index++ {
-			canonicalName := dns.CanonicalName(fields[index])
-			byName[canonicalName] = append(byName[canonicalName], addr)
-		}
-	}
-	f.expire = now.Add(cacheMaxAge)
-	f.modTime = stat.ModTime()
-	f.size = stat.Size()
-	f.byName = byName
-}
--- a/dns/transport/hosts/hosts_test.go
+++ b/dns/transport/hosts/hosts_test.go
@@ -1,15 +0,0 @@
-package hosts_test
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/sagernet/sing-box/dns/transport/hosts"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestHosts(t *testing.T) {
-	require.Equal(t, []netip.Addr{netip.AddrFrom4([4]byte{127, 0, 0, 1}), netip.IPv6Loopback()}, hosts.NewFile("testdata/hosts").Lookup("localhost."))
-	require.NotEmpty(t, hosts.NewFile(hosts.DefaultPath).Lookup("localhost."))
-}
--- a/dns/transport/hosts/hosts_unix.go
+++ b/dns/transport/hosts/hosts_unix.go
@@ -1,5 +0,0 @@
-//go:build !windows
-
-package hosts
-
-var DefaultPath = "/etc/hosts"
--- a/dns/transport/hosts/hosts_windows.go
+++ b/dns/transport/hosts/hosts_windows.go
@@ -1,8 +0,0 @@
-package hosts
-
-import _ "unsafe"
-
-var DefaultPath = getSystemDirectory() + "/Drivers/etc/hosts"
-
-//go:linkname getSystemDirectory internal/syscall/windows.GetSystemDirectory
-func getSystemDirectory() string
--- a/dns/transport/hosts/testdata/hosts
+++ b/dns/transport/hosts/testdata/hosts
@@ -1,2 +0,0 @@
-127.0.0.1       localhost
-::1             localhost
--- a/dns/transport/https.go
+++ b/dns/transport/https.go
@@ -1,204 +0,0 @@
-package transport
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/tls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-	aTLS "github.com/sagernet/sing/common/tls"
-	sHTTP "github.com/sagernet/sing/protocol/http"
-
-	mDNS "github.com/miekg/dns"
-	"golang.org/x/net/http2"
-)
-
-const MimeType = "application/dns-message"
-
-var _ adapter.DNSTransport = (*HTTPSTransport)(nil)
-
-func RegisterHTTPS(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteHTTPSDNSServerOptions](registry, C.DNSTypeHTTPS, NewHTTPS)
-}
-
-type HTTPSTransport struct {
-	dns.TransportAdapter
-	logger      logger.ContextLogger
-	dialer      N.Dialer
-	destination *url.URL
-	headers     http.Header
-	transport   *http.Transport
-}
-
-func NewHTTPS(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteHTTPSDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options.RemoteDNSServerOptions)
-	if err != nil {
-		return nil, err
-	}
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	tlsOptions.Enabled = true
-	tlsConfig, err := tls.NewClient(ctx, options.Server, tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-	if common.Error(tlsConfig.Config()) == nil && !common.Contains(tlsConfig.NextProtos(), http2.NextProtoTLS) {
-		tlsConfig.SetNextProtos(append(tlsConfig.NextProtos(), http2.NextProtoTLS))
-	}
-	if !common.Contains(tlsConfig.NextProtos(), "http/1.1") {
-		tlsConfig.SetNextProtos(append(tlsConfig.NextProtos(), "http/1.1"))
-	}
-	headers := options.Headers.Build()
-	host := headers.Get("Host")
-	if host != "" {
-		headers.Del("Host")
-	} else {
-		if tlsConfig.ServerName() != "" {
-			host = tlsConfig.ServerName()
-		} else {
-			host = options.Server
-		}
-	}
-	destinationURL := url.URL{
-		Scheme: "https",
-		Host:   host,
-	}
-	if destinationURL.Host == "" {
-		destinationURL.Host = options.Server
-	}
-	if options.ServerPort != 0 && options.ServerPort != 443 {
-		destinationURL.Host = net.JoinHostPort(destinationURL.Host, strconv.Itoa(int(options.ServerPort)))
-	}
-	path := options.Path
-	if path == "" {
-		path = "/dns-query"
-	}
-	err = sHTTP.URLSetPath(&destinationURL, path)
-	if err != nil {
-		return nil, err
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 443
-	}
-	return NewHTTPSRaw(
-		dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeHTTPS, tag, options.RemoteDNSServerOptions),
-		logger,
-		transportDialer,
-		&destinationURL,
-		headers,
-		serverAddr,
-		tlsConfig,
-	), nil
-}
-
-func NewHTTPSRaw(
-	adapter dns.TransportAdapter,
-	logger log.ContextLogger,
-	dialer N.Dialer,
-	destination *url.URL,
-	headers http.Header,
-	serverAddr M.Socksaddr,
-	tlsConfig tls.Config,
-) *HTTPSTransport {
-	var transport *http.Transport
-	if tlsConfig != nil {
-		transport = &http.Transport{
-			ForceAttemptHTTP2: true,
-			DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-				tcpConn, hErr := dialer.DialContext(ctx, network, serverAddr)
-				if hErr != nil {
-					return nil, hErr
-				}
-				tlsConn, hErr := aTLS.ClientHandshake(ctx, tcpConn, tlsConfig)
-				if hErr != nil {
-					tcpConn.Close()
-					return nil, hErr
-				}
-				return tlsConn, nil
-			},
-		}
-	} else {
-		transport = &http.Transport{
-			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-				return dialer.DialContext(ctx, network, serverAddr)
-			},
-		}
-	}
-	return &HTTPSTransport{
-		TransportAdapter: adapter,
-		logger:           logger,
-		dialer:           dialer,
-		destination:      destination,
-		headers:          headers,
-		transport:        transport,
-	}
-}
-
-func (t *HTTPSTransport) Reset() {
-	t.transport.CloseIdleConnections()
-	t.transport = t.transport.Clone()
-}
-
-func (t *HTTPSTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	exMessage := *message
-	exMessage.Id = 0
-	exMessage.Compress = true
-	requestBuffer := buf.NewSize(1 + message.Len())
-	rawMessage, err := exMessage.PackBuffer(requestBuffer.FreeBytes())
-	if err != nil {
-		requestBuffer.Release()
-		return nil, err
-	}
-	request, err := http.NewRequestWithContext(ctx, http.MethodPost, t.destination.String(), bytes.NewReader(rawMessage))
-	if err != nil {
-		requestBuffer.Release()
-		return nil, err
-	}
-	request.Header = t.headers.Clone()
-	request.Header.Set("Content-Type", MimeType)
-	request.Header.Set("Accept", MimeType)
-	response, err := t.transport.RoundTrip(request)
-	requestBuffer.Release()
-	if err != nil {
-		return nil, err
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
-		return nil, E.New("unexpected status: ", response.Status)
-	}
-	var responseMessage mDNS.Msg
-	if response.ContentLength > 0 {
-		responseBuffer := buf.NewSize(int(response.ContentLength))
-		_, err = responseBuffer.ReadFullFrom(response.Body, int(response.ContentLength))
-		if err != nil {
-			return nil, err
-		}
-		err = responseMessage.Unpack(responseBuffer.Bytes())
-		responseBuffer.Release()
-	} else {
-		rawMessage, err = io.ReadAll(response.Body)
-		if err != nil {
-			return nil, err
-		}
-		err = responseMessage.Unpack(rawMessage)
-	}
-	if err != nil {
-		return nil, err
-	}
-	return &responseMessage, nil
-}
--- a/dns/transport/local/local.go
+++ b/dns/transport/local/local.go
@@ -1,194 +0,0 @@
-package local
-
-import (
-	"context"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/dns/transport/hosts"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common/buf"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-
-	mDNS "github.com/miekg/dns"
-)
-
-func RegisterTransport(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.LocalDNSServerOptions](registry, C.DNSTypeLocal, NewTransport)
-}
-
-var _ adapter.DNSTransport = (*Transport)(nil)
-
-type Transport struct {
-	dns.TransportAdapter
-	hosts  *hosts.File
-	dialer N.Dialer
-}
-
-func NewTransport(ctx context.Context, logger log.ContextLogger, tag string, options option.LocalDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewLocalDialer(ctx, options)
-	if err != nil {
-		return nil, err
-	}
-	return &Transport{
-		TransportAdapter: dns.NewTransportAdapterWithLocalOptions(C.DNSTypeLocal, tag, options),
-		hosts:            hosts.NewFile(hosts.DefaultPath),
-		dialer:           transportDialer,
-	}, nil
-}
-
-func (t *Transport) Reset() {
-}
-
-func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	question := message.Question[0]
-	domain := dns.FqdnToDomain(question.Name)
-	if question.Qtype == mDNS.TypeA || question.Qtype == mDNS.TypeAAAA {
-		addresses := t.hosts.Lookup(domain)
-		if len(addresses) > 0 {
-			return dns.FixedResponse(message.Id, question, addresses, C.DefaultDNSTTL), nil
-		}
-	}
-	systemConfig := getSystemDNSConfig()
-	if systemConfig.singleRequest || !(message.Question[0].Qtype == mDNS.TypeA || message.Question[0].Qtype == mDNS.TypeAAAA) {
-		return t.exchangeSingleRequest(ctx, systemConfig, message, domain)
-	} else {
-		return t.exchangeParallel(ctx, systemConfig, message, domain)
-	}
-}
-
-func (t *Transport) exchangeSingleRequest(ctx context.Context, systemConfig *dnsConfig, message *mDNS.Msg, domain string) (*mDNS.Msg, error) {
-	var lastErr error
-	for _, fqdn := range systemConfig.nameList(domain) {
-		response, err := t.tryOneName(ctx, systemConfig, fqdn, message)
-		if err != nil {
-			lastErr = err
-			continue
-		}
-		return response, nil
-	}
-	return nil, lastErr
-}
-
-func (t *Transport) exchangeParallel(ctx context.Context, systemConfig *dnsConfig, message *mDNS.Msg, domain string) (*mDNS.Msg, error) {
-	returned := make(chan struct{})
-	defer close(returned)
-	type queryResult struct {
-		response *mDNS.Msg
-		err      error
-	}
-	results := make(chan queryResult)
-	startRacer := func(ctx context.Context, fqdn string) {
-		response, err := t.tryOneName(ctx, systemConfig, fqdn, message)
-		addresses, _ := dns.MessageToAddresses(response)
-		if len(addresses) == 0 {
-			err = E.New(fqdn, ": empty result")
-		}
-		select {
-		case results <- queryResult{response, err}:
-		case <-returned:
-		}
-	}
-	queryCtx, queryCancel := context.WithCancel(ctx)
-	defer queryCancel()
-	var nameCount int
-	for _, fqdn := range systemConfig.nameList(domain) {
-		nameCount++
-		go startRacer(queryCtx, fqdn)
-	}
-	var errors []error
-	for {
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case result := <-results:
-			if result.err == nil {
-				return result.response, nil
-			}
-			errors = append(errors, result.err)
-			if len(errors) == nameCount {
-				return nil, E.Errors(errors...)
-			}
-		}
-	}
-}
-
-func (t *Transport) tryOneName(ctx context.Context, config *dnsConfig, fqdn string, message *mDNS.Msg) (*mDNS.Msg, error) {
-	serverOffset := config.serverOffset()
-	sLen := uint32(len(config.servers))
-	var lastErr error
-	for i := 0; i < config.attempts; i++ {
-		for j := uint32(0); j < sLen; j++ {
-			server := config.servers[(serverOffset+j)%sLen]
-			question := message.Question[0]
-			question.Name = fqdn
-			response, err := t.exchangeOne(ctx, M.ParseSocksaddr(server), question, config.timeout, config.useTCP, config.trustAD)
-			if err != nil {
-				lastErr = err
-				continue
-			}
-			return response, nil
-		}
-	}
-	return nil, E.Cause(lastErr, fqdn)
-}
-
-func (t *Transport) exchangeOne(ctx context.Context, server M.Socksaddr, question mDNS.Question, timeout time.Duration, useTCP, ad bool) (*mDNS.Msg, error) {
-	var networks []string
-	if useTCP {
-		networks = []string{N.NetworkTCP}
-	} else {
-		networks = []string{N.NetworkUDP, N.NetworkTCP}
-	}
-	request := &mDNS.Msg{
-		MsgHdr: mDNS.MsgHdr{
-			Id:                uint16(randInt()),
-			RecursionDesired:  true,
-			AuthenticatedData: ad,
-		},
-		Question: []mDNS.Question{question},
-		Compress: true,
-	}
-	request.SetEdns0(maxDNSPacketSize, false)
-	buffer := buf.Get(buf.UDPBufferSize)
-	defer buf.Put(buffer)
-	for _, network := range networks {
-		ctx, cancel := context.WithDeadline(ctx, time.Now().Add(timeout))
-		defer cancel()
-		conn, err := t.dialer.DialContext(ctx, network, server)
-		if err != nil {
-			return nil, err
-		}
-		defer conn.Close()
-		if deadline, loaded := ctx.Deadline(); loaded && !deadline.IsZero() {
-			conn.SetDeadline(deadline)
-		}
-		rawMessage, err := request.PackBuffer(buffer)
-		if err != nil {
-			return nil, E.Cause(err, "pack request")
-		}
-		_, err = conn.Write(rawMessage)
-		if err != nil {
-			return nil, E.Cause(err, "write request")
-		}
-		n, err := conn.Read(buffer)
-		if err != nil {
-			return nil, E.Cause(err, "read response")
-		}
-		var response mDNS.Msg
-		err = response.Unpack(buffer[:n])
-		if err != nil {
-			return nil, E.Cause(err, "unpack response")
-		}
-		if response.Truncated && network == N.NetworkUDP {
-			continue
-		}
-		return &response, nil
-	}
-	panic("unexpected")
-}
--- a/dns/transport/local/resolv.go
+++ b/dns/transport/local/resolv.go
@@ -1,154 +0,0 @@
-package local
-
-import (
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-	_ "unsafe"
-)
-
-const (
-	// net.maxDNSPacketSize
-	maxDNSPacketSize = 1232
-)
-
-type resolverConfig struct {
-	initOnce    sync.Once
-	ch          chan struct{}
-	lastChecked time.Time
-	dnsConfig   atomic.Pointer[dnsConfig]
-}
-
-var resolvConf resolverConfig
-
-func getSystemDNSConfig() *dnsConfig {
-	resolvConf.tryUpdate("/etc/resolv.conf")
-	return resolvConf.dnsConfig.Load()
-}
-
-func (conf *resolverConfig) init() {
-	conf.dnsConfig.Store(dnsReadConfig("/etc/resolv.conf"))
-	conf.lastChecked = time.Now()
-	conf.ch = make(chan struct{}, 1)
-}
-
-func (conf *resolverConfig) tryUpdate(name string) {
-	conf.initOnce.Do(conf.init)
-
-	if conf.dnsConfig.Load().noReload {
-		return
-	}
-	if !conf.tryAcquireSema() {
-		return
-	}
-	defer conf.releaseSema()
-
-	now := time.Now()
-	if conf.lastChecked.After(now.Add(-5 * time.Second)) {
-		return
-	}
-	conf.lastChecked = now
-	if runtime.GOOS != "windows" {
-		var mtime time.Time
-		if fi, err := os.Stat(name); err == nil {
-			mtime = fi.ModTime()
-		}
-		if mtime.Equal(conf.dnsConfig.Load().mtime) {
-			return
-		}
-	}
-	dnsConf := dnsReadConfig(name)
-	conf.dnsConfig.Store(dnsConf)
-}
-
-func (conf *resolverConfig) tryAcquireSema() bool {
-	select {
-	case conf.ch <- struct{}{}:
-		return true
-	default:
-		return false
-	}
-}
-
-func (conf *resolverConfig) releaseSema() {
-	<-conf.ch
-}
-
-type dnsConfig struct {
-	servers       []string
-	search        []string
-	ndots         int
-	timeout       time.Duration
-	attempts      int
-	rotate        bool
-	unknownOpt    bool
-	lookup        []string
-	err           error
-	mtime         time.Time
-	soffset       uint32
-	singleRequest bool
-	useTCP        bool
-	trustAD       bool
-	noReload      bool
-}
-
-func (c *dnsConfig) serverOffset() uint32 {
-	if c.rotate {
-		return atomic.AddUint32(&c.soffset, 1) - 1 // return 0 to start
-	}
-	return 0
-}
-
-func (conf *dnsConfig) nameList(name string) []string {
-	l := len(name)
-	rooted := l > 0 && name[l-1] == '.'
-	if l > 254 || l == 254 && !rooted {
-		return nil
-	}
-
-	if rooted {
-		if avoidDNS(name) {
-			return nil
-		}
-		return []string{name}
-	}
-
-	hasNdots := strings.Count(name, ".") >= conf.ndots
-	name += "."
-	l++
-
-	names := make([]string, 0, 1+len(conf.search))
-	if hasNdots && !avoidDNS(name) {
-		names = append(names, name)
-	}
-	for _, suffix := range conf.search {
-		fqdn := name + suffix
-		if !avoidDNS(fqdn) && len(fqdn) <= 254 {
-			names = append(names, fqdn)
-		}
-	}
-	if !hasNdots && !avoidDNS(name) {
-		names = append(names, name)
-	}
-	return names
-}
-
-//go:linkname runtime_rand runtime.rand
-func runtime_rand() uint64
-
-func randInt() int {
-	return int(uint(runtime_rand()) >> 1) // clear sign bit
-}
-
-func avoidDNS(name string) bool {
-	if name == "" {
-		return true
-	}
-	if name[len(name)-1] == '.' {
-		name = name[:len(name)-1]
-	}
-	return strings.HasSuffix(name, ".onion")
-}
--- a/dns/transport/local/resolv_unix.go
+++ b/dns/transport/local/resolv_unix.go
@@ -1,175 +0,0 @@
-//go:build !windows
-
-package local
-
-import (
-	"bufio"
-	"net"
-	"net/netip"
-	"os"
-	"strings"
-	"time"
-	_ "unsafe"
-)
-
-func dnsReadConfig(name string) *dnsConfig {
-	conf := &dnsConfig{
-		ndots:    1,
-		timeout:  5 * time.Second,
-		attempts: 2,
-	}
-	file, err := os.Open(name)
-	if err != nil {
-		conf.servers = defaultNS
-		conf.search = dnsDefaultSearch()
-		conf.err = err
-		return conf
-	}
-	defer file.Close()
-	fi, err := file.Stat()
-	if err == nil {
-		conf.mtime = fi.ModTime()
-	} else {
-		conf.servers = defaultNS
-		conf.search = dnsDefaultSearch()
-		conf.err = err
-		return conf
-	}
-	reader := bufio.NewReader(file)
-	var (
-		prefix   []byte
-		line     []byte
-		isPrefix bool
-	)
-	for {
-		line, isPrefix, err = reader.ReadLine()
-		if err != nil {
-			break
-		}
-		if isPrefix {
-			prefix = append(prefix, line...)
-			continue
-		} else if len(prefix) > 0 {
-			line = append(prefix, line...)
-			prefix = nil
-		}
-		if len(line) > 0 && (line[0] == ';' || line[0] == '#') {
-			continue
-		}
-		f := strings.Fields(string(line))
-		if len(f) < 1 {
-			continue
-		}
-		switch f[0] {
-		case "nameserver":
-			if len(f) > 1 && len(conf.servers) < 3 {
-				if _, err := netip.ParseAddr(f[1]); err == nil {
-					conf.servers = append(conf.servers, net.JoinHostPort(f[1], "53"))
-				}
-			}
-		case "domain":
-			if len(f) > 1 {
-				conf.search = []string{ensureRooted(f[1])}
-			}
-
-		case "search":
-			conf.search = make([]string, 0, len(f)-1)
-			for i := 1; i < len(f); i++ {
-				name := ensureRooted(f[i])
-				if name == "." {
-					continue
-				}
-				conf.search = append(conf.search, name)
-			}
-
-		case "options":
-			for _, s := range f[1:] {
-				switch {
-				case strings.HasPrefix(s, "ndots:"):
-					n, _, _ := dtoi(s[6:])
-					if n < 0 {
-						n = 0
-					} else if n > 15 {
-						n = 15
-					}
-					conf.ndots = n
-				case strings.HasPrefix(s, "timeout:"):
-					n, _, _ := dtoi(s[8:])
-					if n < 1 {
-						n = 1
-					}
-					conf.timeout = time.Duration(n) * time.Second
-				case strings.HasPrefix(s, "attempts:"):
-					n, _, _ := dtoi(s[9:])
-					if n < 1 {
-						n = 1
-					}
-					conf.attempts = n
-				case s == "rotate":
-					conf.rotate = true
-				case s == "single-request" || s == "single-request-reopen":
-					conf.singleRequest = true
-				case s == "use-vc" || s == "usevc" || s == "tcp":
-					conf.useTCP = true
-				case s == "trust-ad":
-					conf.trustAD = true
-				case s == "edns0":
-				case s == "no-reload":
-					conf.noReload = true
-				default:
-					conf.unknownOpt = true
-				}
-			}
-
-		case "lookup":
-			conf.lookup = f[1:]
-
-		default:
-			conf.unknownOpt = true
-		}
-	}
-	if len(conf.servers) == 0 {
-		conf.servers = defaultNS
-	}
-	if len(conf.search) == 0 {
-		conf.search = dnsDefaultSearch()
-	}
-	return conf
-}
-
-//go:linkname defaultNS net.defaultNS
-var defaultNS []string
-
-func dnsDefaultSearch() []string {
-	hn, err := os.Hostname()
-	if err != nil {
-		return nil
-	}
-	if i := strings.IndexRune(hn, '.'); i >= 0 && i < len(hn)-1 {
-		return []string{ensureRooted(hn[i+1:])}
-	}
-	return nil
-}
-
-func ensureRooted(s string) string {
-	if len(s) > 0 && s[len(s)-1] == '.' {
-		return s
-	}
-	return s + "."
-}
-
-const big = 0xFFFFFF
-
-func dtoi(s string) (n int, i int, ok bool) {
-	n = 0
-	for i = 0; i < len(s) && '0' <= s[i] && s[i] <= '9'; i++ {
-		n = n*10 + int(s[i]-'0')
-		if n >= big {
-			return big, i, false
-		}
-	}
-	if i == 0 {
-		return 0, 0, false
-	}
-	return n, i, true
-}
--- a/dns/transport/local/resolv_windows.go
+++ b/dns/transport/local/resolv_windows.go
@@ -1,100 +0,0 @@
-package local
-
-import (
-	"net"
-	"net/netip"
-	"os"
-	"syscall"
-	"time"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-func dnsReadConfig(_ string) *dnsConfig {
-	conf := &dnsConfig{
-		ndots:    1,
-		timeout:  5 * time.Second,
-		attempts: 2,
-	}
-	defer func() {
-		if len(conf.servers) == 0 {
-			conf.servers = defaultNS
-		}
-	}()
-	aas, err := adapterAddresses()
-	if err != nil {
-		return nil
-	}
-
-	for _, aa := range aas {
-		// Only take interfaces whose OperStatus is IfOperStatusUp(0x01) into DNS configs.
-		if aa.OperStatus != windows.IfOperStatusUp {
-			continue
-		}
-
-		// Only take interfaces which have at least one gateway
-		if aa.FirstGatewayAddress == nil {
-			continue
-		}
-
-		for dns := aa.FirstDnsServerAddress; dns != nil; dns = dns.Next {
-			sa, err := dns.Address.Sockaddr.Sockaddr()
-			if err != nil {
-				continue
-			}
-			var ip netip.Addr
-			switch sa := sa.(type) {
-			case *syscall.SockaddrInet4:
-				ip = netip.AddrFrom4([4]byte{sa.Addr[0], sa.Addr[1], sa.Addr[2], sa.Addr[3]})
-			case *syscall.SockaddrInet6:
-				var addr16 [16]byte
-				copy(addr16[:], sa.Addr[:])
-				if addr16[0] == 0xfe && addr16[1] == 0xc0 {
-					// fec0/10 IPv6 addresses are site local anycast DNS
-					// addresses Microsoft sets by default if no other
-					// IPv6 DNS address is set. Site local anycast is
-					// deprecated since 2004, see
-					// https://datatracker.ietf.org/doc/html/rfc3879
-					continue
-				}
-				ip = netip.AddrFrom16(addr16)
-			default:
-				// Unexpected type.
-				continue
-			}
-			conf.servers = append(conf.servers, net.JoinHostPort(ip.String(), "53"))
-		}
-	}
-	return conf
-}
-
-//go:linkname defaultNS net.defaultNS
-var defaultNS []string
-
-func adapterAddresses() ([]*windows.IpAdapterAddresses, error) {
-	var b []byte
-	l := uint32(15000) // recommended initial size
-	for {
-		b = make([]byte, l)
-		const flags = windows.GAA_FLAG_INCLUDE_PREFIX | windows.GAA_FLAG_INCLUDE_GATEWAYS
-		err := windows.GetAdaptersAddresses(syscall.AF_UNSPEC, flags, 0, (*windows.IpAdapterAddresses)(unsafe.Pointer(&b[0])), &l)
-		if err == nil {
-			if l == 0 {
-				return nil, nil
-			}
-			break
-		}
-		if err.(syscall.Errno) != syscall.ERROR_BUFFER_OVERFLOW {
-			return nil, os.NewSyscallError("getadaptersaddresses", err)
-		}
-		if l <= uint32(len(b)) {
-			return nil, os.NewSyscallError("getadaptersaddresses", err)
-		}
-	}
-	var aas []*windows.IpAdapterAddresses
-	for aa := (*windows.IpAdapterAddresses)(unsafe.Pointer(&b[0])); aa != nil; aa = aa.Next {
-		aas = append(aas, aa)
-	}
-	return aas, nil
-}
--- a/dns/transport/predefined.go
+++ b/dns/transport/predefined.go
@@ -1,82 +0,0 @@
-package transport
-
-import (
-	"context"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*PredefinedTransport)(nil)
-
-func RegisterPredefined(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.PredefinedDNSServerOptions](registry, C.DNSTypePreDefined, NewPredefined)
-}
-
-type PredefinedTransport struct {
-	dns.TransportAdapter
-	responses []*predefinedResponse
-}
-
-type predefinedResponse struct {
-	questions []mDNS.Question
-	answer    *mDNS.Msg
-}
-
-func NewPredefined(ctx context.Context, logger log.ContextLogger, tag string, options option.PredefinedDNSServerOptions) (adapter.DNSTransport, error) {
-	var responses []*predefinedResponse
-	for _, response := range options.Responses {
-		questions, msg, err := response.Build()
-		if err != nil {
-			return nil, err
-		}
-		responses = append(responses, &predefinedResponse{
-			questions: questions,
-			answer:    msg,
-		})
-	}
-	if len(responses) == 0 {
-		return nil, E.New("empty predefined responses")
-	}
-	return &PredefinedTransport{
-		TransportAdapter: dns.NewTransportAdapter(C.DNSTypePreDefined, tag, nil),
-		responses:        responses,
-	}, nil
-}
-
-func (t *PredefinedTransport) Reset() {
-}
-
-func (t *PredefinedTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	for _, response := range t.responses {
-		for _, question := range response.questions {
-			if func() bool {
-				if question.Name == "" && question.Qtype == mDNS.TypeNone {
-					return true
-				} else if question.Name == "" {
-					return common.Any(message.Question, func(it mDNS.Question) bool {
-						return it.Qtype == question.Qtype
-					})
-				} else if question.Qtype == mDNS.TypeNone {
-					return common.Any(message.Question, func(it mDNS.Question) bool {
-						return it.Name == question.Name
-					})
-				} else {
-					return common.Contains(message.Question, question)
-				}
-			}() {
-				copyAnswer := *response.answer
-				copyAnswer.Id = message.Id
-				return &copyAnswer, nil
-			}
-		}
-	}
-	return nil, dns.RCodeNameError
-}
--- a/dns/transport/quic/http3.go
+++ b/dns/transport/quic/http3.go
@@ -1,167 +0,0 @@
-package quic
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-
-	"github.com/sagernet/quic-go"
-	"github.com/sagernet/quic-go/http3"
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/tls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/dns/transport"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	"github.com/sagernet/sing/common/bufio"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-	sHTTP "github.com/sagernet/sing/protocol/http"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*HTTP3Transport)(nil)
-
-func RegisterHTTP3Transport(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteHTTPSDNSServerOptions](registry, C.DNSTypeHTTP3, NewHTTP3)
-}
-
-type HTTP3Transport struct {
-	dns.TransportAdapter
-	logger      logger.ContextLogger
-	dialer      N.Dialer
-	destination *url.URL
-	headers     http.Header
-	transport   *http3.Transport
-}
-
-func NewHTTP3(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteHTTPSDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options.RemoteDNSServerOptions)
-	if err != nil {
-		return nil, err
-	}
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	tlsOptions.Enabled = true
-	tlsConfig, err := tls.NewClient(ctx, options.Server, tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-	stdConfig, err := tlsConfig.Config()
-	if err != nil {
-		return nil, err
-	}
-	headers := options.Headers.Build()
-	host := headers.Get("Host")
-	if host != "" {
-		headers.Del("Host")
-	} else {
-		if tlsConfig.ServerName() != "" {
-			host = tlsConfig.ServerName()
-		} else {
-			host = options.Server
-		}
-	}
-	destinationURL := url.URL{
-		Scheme: "HTTP3",
-		Host:   host,
-	}
-	if destinationURL.Host == "" {
-		destinationURL.Host = options.Server
-	}
-	if options.ServerPort != 0 && options.ServerPort != 443 {
-		destinationURL.Host = net.JoinHostPort(destinationURL.Host, strconv.Itoa(int(options.ServerPort)))
-	}
-	path := options.Path
-	if path == "" {
-		path = "/dns-query"
-	}
-	err = sHTTP.URLSetPath(&destinationURL, path)
-	if err != nil {
-		return nil, err
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 443
-	}
-	return &HTTP3Transport{
-		TransportAdapter: dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeHTTP3, tag, options.RemoteDNSServerOptions),
-		logger:           logger,
-		dialer:           transportDialer,
-		destination:      &destinationURL,
-		headers:          headers,
-		transport: &http3.Transport{
-			Dial: func(ctx context.Context, addr string, tlsCfg *tls.STDConfig, cfg *quic.Config) (quic.EarlyConnection, error) {
-				destinationAddr := M.ParseSocksaddr(addr)
-				conn, dialErr := transportDialer.DialContext(ctx, N.NetworkUDP, destinationAddr)
-				if dialErr != nil {
-					return nil, dialErr
-				}
-				return quic.DialEarly(ctx, bufio.NewUnbindPacketConn(conn), conn.RemoteAddr(), tlsCfg, cfg)
-			},
-			TLSClientConfig: stdConfig,
-		},
-	}, nil
-}
-
-func (t *HTTP3Transport) Reset() {
-	t.transport.Close()
-}
-
-func (t *HTTP3Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	exMessage := *message
-	exMessage.Id = 0
-	exMessage.Compress = true
-	requestBuffer := buf.NewSize(1 + message.Len())
-	rawMessage, err := exMessage.PackBuffer(requestBuffer.FreeBytes())
-	if err != nil {
-		requestBuffer.Release()
-		return nil, err
-	}
-	request, err := http.NewRequestWithContext(ctx, http.MethodPost, t.destination.String(), bytes.NewReader(rawMessage))
-	if err != nil {
-		requestBuffer.Release()
-		return nil, err
-	}
-	request.Header = t.headers.Clone()
-	request.Header.Set("Content-Type", transport.MimeType)
-	request.Header.Set("Accept", transport.MimeType)
-	response, err := t.transport.RoundTrip(request)
-	requestBuffer.Release()
-	if err != nil {
-		return nil, err
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
-		return nil, E.New("unexpected status: ", response.Status)
-	}
-	var responseMessage mDNS.Msg
-	if response.ContentLength > 0 {
-		responseBuffer := buf.NewSize(int(response.ContentLength))
-		_, err = responseBuffer.ReadFullFrom(response.Body, int(response.ContentLength))
-		if err != nil {
-			return nil, err
-		}
-		err = responseMessage.Unpack(responseBuffer.Bytes())
-		responseBuffer.Release()
-	} else {
-		rawMessage, err = io.ReadAll(response.Body)
-		if err != nil {
-			return nil, err
-		}
-		err = responseMessage.Unpack(rawMessage)
-	}
-	if err != nil {
-		return nil, err
-	}
-	return &responseMessage, nil
-}
--- a/dns/transport/quic/quic.go
+++ b/dns/transport/quic/quic.go
@@ -1,174 +0,0 @@
-package quic
-
-import (
-	"context"
-	"errors"
-	"sync"
-
-	"github.com/sagernet/quic-go"
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/tls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/dns/transport"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	sQUIC "github.com/sagernet/sing-quic"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/bufio"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*Transport)(nil)
-
-func RegisterTransport(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteTLSDNSServerOptions](registry, C.DNSTypeQUIC, NewQUIC)
-}
-
-type Transport struct {
-	dns.TransportAdapter
-	ctx        context.Context
-	logger     logger.ContextLogger
-	dialer     N.Dialer
-	serverAddr M.Socksaddr
-	tlsConfig  tls.Config
-	access     sync.Mutex
-	connection quic.EarlyConnection
-}
-
-func NewQUIC(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteTLSDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options.RemoteDNSServerOptions)
-	if err != nil {
-		return nil, err
-	}
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	tlsOptions.Enabled = true
-	tlsConfig, err := tls.NewClient(ctx, options.Server, tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-	if len(tlsConfig.NextProtos()) == 0 {
-		tlsConfig.SetNextProtos([]string{"doq"})
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 853
-	}
-	return &Transport{
-		TransportAdapter: dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeQUIC, tag, options.RemoteDNSServerOptions),
-		ctx:              ctx,
-		logger:           logger,
-		dialer:           transportDialer,
-		serverAddr:       serverAddr,
-		tlsConfig:        tlsConfig,
-	}, nil
-}
-
-func (t *Transport) Reset() {
-	t.access.Lock()
-	defer t.access.Unlock()
-	connection := t.connection
-	if connection != nil {
-		connection.CloseWithError(0, "")
-	}
-}
-
-func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	var (
-		conn     quic.Connection
-		err      error
-		response *mDNS.Msg
-	)
-	for i := 0; i < 2; i++ {
-		conn, err = t.openConnection()
-		if err != nil {
-			return nil, err
-		}
-		response, err = t.exchange(ctx, message, conn)
-		if err == nil {
-			return response, nil
-		} else if !isQUICRetryError(err) {
-			return nil, err
-		} else {
-			conn.CloseWithError(quic.ApplicationErrorCode(0), "")
-			continue
-		}
-	}
-	return nil, err
-}
-
-func (t *Transport) openConnection() (quic.EarlyConnection, error) {
-	connection := t.connection
-	if connection != nil && !common.Done(connection.Context()) {
-		return connection, nil
-	}
-	t.access.Lock()
-	defer t.access.Unlock()
-	connection = t.connection
-	if connection != nil && !common.Done(connection.Context()) {
-		return connection, nil
-	}
-	conn, err := t.dialer.DialContext(t.ctx, N.NetworkUDP, t.serverAddr)
-	if err != nil {
-		return nil, err
-	}
-	earlyConnection, err := sQUIC.DialEarly(
-		t.ctx,
-		bufio.NewUnbindPacketConn(conn),
-		t.serverAddr.UDPAddr(),
-		t.tlsConfig,
-		nil,
-	)
-	if err != nil {
-		return nil, err
-	}
-	t.connection = earlyConnection
-	return earlyConnection, nil
-}
-
-func (t *Transport) exchange(ctx context.Context, message *mDNS.Msg, conn quic.Connection) (*mDNS.Msg, error) {
-	stream, err := conn.OpenStreamSync(ctx)
-	if err != nil {
-		return nil, err
-	}
-	defer stream.Close()
-	defer stream.CancelRead(0)
-	err = transport.WriteMessage(stream, 0, message)
-	if err != nil {
-		return nil, err
-	}
-	return transport.ReadMessage(stream)
-}
-
-// https://github.com/AdguardTeam/dnsproxy/blob/fd1868577652c639cce3da00e12ca548f421baf1/upstream/upstream_quic.go#L394
-func isQUICRetryError(err error) (ok bool) {
-	var qAppErr *quic.ApplicationError
-	if errors.As(err, &qAppErr) && qAppErr.ErrorCode == 0 {
-		return true
-	}
-
-	var qIdleErr *quic.IdleTimeoutError
-	if errors.As(err, &qIdleErr) {
-		return true
-	}
-
-	var resetErr *quic.StatelessResetError
-	if errors.As(err, &resetErr) {
-		return true
-	}
-
-	var qTransportError *quic.TransportError
-	if errors.As(err, &qTransportError) && qTransportError.ErrorCode == quic.NoError {
-		return true
-	}
-
-	if errors.Is(err, quic.Err0RTTRejected) {
-		return true
-	}
-
-	return false
-}
--- a/dns/transport/tcp.go
+++ b/dns/transport/tcp.go
@@ -1,99 +0,0 @@
-package transport
-
-import (
-	"context"
-	"encoding/binary"
-	"io"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	"github.com/sagernet/sing/common/buf"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*TCPTransport)(nil)
-
-func RegisterTCP(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteDNSServerOptions](registry, C.DNSTypeTCP, NewTCP)
-}
-
-type TCPTransport struct {
-	dns.TransportAdapter
-	dialer     N.Dialer
-	serverAddr M.Socksaddr
-}
-
-func NewTCP(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options)
-	if err != nil {
-		return nil, err
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 53
-	}
-	return &TCPTransport{
-		TransportAdapter: dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeTCP, tag, options),
-		dialer:           transportDialer,
-		serverAddr:       serverAddr,
-	}, nil
-}
-
-func (t *TCPTransport) Reset() {
-}
-
-func (t *TCPTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	conn, err := t.dialer.DialContext(ctx, N.NetworkTCP, t.serverAddr)
-	if err != nil {
-		return nil, err
-	}
-	defer conn.Close()
-	err = WriteMessage(conn, 0, message)
-	if err != nil {
-		return nil, err
-	}
-	return ReadMessage(conn)
-}
-
-func ReadMessage(reader io.Reader) (*mDNS.Msg, error) {
-	var responseLen uint16
-	err := binary.Read(reader, binary.BigEndian, &responseLen)
-	if err != nil {
-		return nil, err
-	}
-	if responseLen < 10 {
-		return nil, mDNS.ErrShortRead
-	}
-	buffer := buf.NewSize(int(responseLen))
-	defer buffer.Release()
-	_, err = buffer.ReadFullFrom(reader, int(responseLen))
-	if err != nil {
-		return nil, err
-	}
-	var message mDNS.Msg
-	err = message.Unpack(buffer.Bytes())
-	return &message, err
-}
-
-func WriteMessage(writer io.Writer, messageId uint16, message *mDNS.Msg) error {
-	requestLen := message.Len()
-	buffer := buf.NewSize(3 + requestLen)
-	defer buffer.Release()
-	common.Must(binary.Write(buffer, binary.BigEndian, uint16(requestLen)))
-	exMessage := *message
-	exMessage.Id = messageId
-	exMessage.Compress = true
-	rawMessage, err := exMessage.PackBuffer(buffer.FreeBytes())
-	if err != nil {
-		return err
-	}
-	buffer.Truncate(2 + len(rawMessage))
-	return common.Error(writer.Write(buffer.Bytes()))
-}
--- a/dns/transport/tls.go
+++ b/dns/transport/tls.go
@@ -1,115 +0,0 @@
-package transport
-
-import (
-	"context"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/tls"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/common/x/list"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*TLSTransport)(nil)
-
-func RegisterTLS(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteTLSDNSServerOptions](registry, C.DNSTypeTLS, NewTLS)
-}
-
-type TLSTransport struct {
-	dns.TransportAdapter
-	logger      logger.ContextLogger
-	dialer      N.Dialer
-	serverAddr  M.Socksaddr
-	tlsConfig   tls.Config
-	access      sync.Mutex
-	connections list.List[*tlsDNSConn]
-}
-
-type tlsDNSConn struct {
-	tls.Conn
-	queryId uint16
-}
-
-func NewTLS(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteTLSDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options.RemoteDNSServerOptions)
-	if err != nil {
-		return nil, err
-	}
-	tlsOptions := common.PtrValueOrDefault(options.TLS)
-	tlsOptions.Enabled = true
-	tlsConfig, err := tls.NewClient(ctx, options.Server, tlsOptions)
-	if err != nil {
-		return nil, err
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 853
-	}
-	return &TLSTransport{
-		TransportAdapter: dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeTLS, tag, options.RemoteDNSServerOptions),
-		logger:           logger,
-		dialer:           transportDialer,
-		serverAddr:       serverAddr,
-		tlsConfig:        tlsConfig,
-	}, nil
-}
-
-func (t *TLSTransport) Reset() {
-	t.access.Lock()
-	defer t.access.Unlock()
-	for connection := t.connections.Front(); connection != nil; connection = connection.Next() {
-		connection.Value.Close()
-	}
-	t.connections.Init()
-}
-
-func (t *TLSTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	t.access.Lock()
-	conn := t.connections.PopFront()
-	t.access.Unlock()
-	if conn != nil {
-		response, err := t.exchange(message, conn)
-		if err == nil {
-			return response, nil
-		}
-	}
-	tcpConn, err := t.dialer.DialContext(ctx, N.NetworkTCP, t.serverAddr)
-	if err != nil {
-		return nil, err
-	}
-	tlsConn, err := tls.ClientHandshake(ctx, tcpConn, t.tlsConfig)
-	if err != nil {
-		tcpConn.Close()
-		return nil, err
-	}
-	return t.exchange(message, &tlsDNSConn{Conn: tlsConn})
-}
-
-func (t *TLSTransport) exchange(message *mDNS.Msg, conn *tlsDNSConn) (*mDNS.Msg, error) {
-	conn.queryId++
-	err := WriteMessage(conn, conn.queryId, message)
-	if err != nil {
-		conn.Close()
-		return nil, E.Cause(err, "write request")
-	}
-	response, err := ReadMessage(conn)
-	if err != nil {
-		conn.Close()
-		return nil, E.Cause(err, "read response")
-	}
-	t.access.Lock()
-	t.connections.PushBack(conn)
-	t.access.Unlock()
-	return response, nil
-}
--- a/dns/transport/udp.go
+++ b/dns/transport/udp.go
@@ -1,217 +0,0 @@
-package transport
-
-import (
-	"context"
-	"net"
-	"os"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing/common/buf"
-	"github.com/sagernet/sing/common/logger"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-
-	mDNS "github.com/miekg/dns"
-)
-
-var _ adapter.DNSTransport = (*UDPTransport)(nil)
-
-func RegisterUDP(registry *dns.TransportRegistry) {
-	dns.RegisterTransport[option.RemoteDNSServerOptions](registry, C.DNSTypeUDP, NewUDP)
-}
-
-type UDPTransport struct {
-	dns.TransportAdapter
-	logger       logger.ContextLogger
-	dialer       N.Dialer
-	serverAddr   M.Socksaddr
-	udpSize      int
-	tcpTransport *TCPTransport
-	access       sync.Mutex
-	conn         *dnsConnection
-	done         chan struct{}
-}
-
-func NewUDP(ctx context.Context, logger log.ContextLogger, tag string, options option.RemoteDNSServerOptions) (adapter.DNSTransport, error) {
-	transportDialer, err := dns.NewRemoteDialer(ctx, options)
-	if err != nil {
-		return nil, err
-	}
-	serverAddr := options.ServerOptions.Build()
-	if serverAddr.Port == 0 {
-		serverAddr.Port = 53
-	}
-	return NewUDPRaw(logger, dns.NewTransportAdapterWithRemoteOptions(C.DNSTypeUDP, tag, options), transportDialer, serverAddr), nil
-}
-
-func NewUDPRaw(logger logger.ContextLogger, adapter dns.TransportAdapter, dialer N.Dialer, serverAddr M.Socksaddr) *UDPTransport {
-	return &UDPTransport{
-		TransportAdapter: adapter,
-		logger:           logger,
-		dialer:           dialer,
-		serverAddr:       serverAddr,
-		udpSize:          512,
-		tcpTransport: &TCPTransport{
-			dialer:     dialer,
-			serverAddr: serverAddr,
-		},
-		done: make(chan struct{}),
-	}
-}
-
-func (t *UDPTransport) Reset() {
-	t.access.Lock()
-	defer t.access.Unlock()
-	close(t.done)
-	t.done = make(chan struct{})
-}
-
-func (t *UDPTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	response, err := t.exchange(ctx, message)
-	if err != nil {
-		return nil, err
-	}
-	if response.Truncated {
-		t.logger.InfoContext(ctx, "response truncated, retrying with TCP")
-		return t.tcpTransport.Exchange(ctx, message)
-	}
-	return response, nil
-}
-
-func (t *UDPTransport) exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
-	conn, err := t.open(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if edns0Opt := message.IsEdns0(); edns0Opt != nil {
-		if udpSize := int(edns0Opt.UDPSize()); udpSize > t.udpSize {
-			t.udpSize = udpSize
-		}
-	}
-	buffer := buf.NewSize(1 + message.Len())
-	defer buffer.Release()
-	exMessage := *message
-	exMessage.Compress = true
-	messageId := message.Id
-	callback := &dnsCallback{
-		done: make(chan struct{}),
-	}
-	conn.access.Lock()
-	conn.queryId++
-	exMessage.Id = conn.queryId
-	conn.callbacks[exMessage.Id] = callback
-	conn.access.Unlock()
-	defer func() {
-		conn.access.Lock()
-		delete(conn.callbacks, messageId)
-		conn.access.Unlock()
-		callback.access.Lock()
-		select {
-		case <-callback.done:
-		default:
-			close(callback.done)
-		}
-		callback.access.Unlock()
-	}()
-	rawMessage, err := exMessage.PackBuffer(buffer.FreeBytes())
-	if err != nil {
-		return nil, err
-	}
-	_, err = conn.Write(rawMessage)
-	if err != nil {
-		conn.Close(err)
-		return nil, err
-	}
-	select {
-	case <-callback.done:
-		callback.message.Id = messageId
-		return callback.message, nil
-	case <-conn.done:
-		return nil, conn.err
-	case <-t.done:
-		return nil, os.ErrClosed
-	case <-ctx.Done():
-		conn.Close(ctx.Err())
-		return nil, ctx.Err()
-	}
-}
-
-func (t *UDPTransport) open(ctx context.Context) (*dnsConnection, error) {
-	t.access.Lock()
-	defer t.access.Unlock()
-	conn, err := t.dialer.DialContext(ctx, N.NetworkUDP, t.serverAddr)
-	if err != nil {
-		return nil, err
-	}
-	dnsConn := &dnsConnection{
-		Conn:      conn,
-		done:      make(chan struct{}),
-		callbacks: make(map[uint16]*dnsCallback),
-	}
-	go t.recvLoop(dnsConn)
-	return dnsConn, nil
-}
-
-func (t *UDPTransport) recvLoop(conn *dnsConnection) {
-	for {
-		buffer := buf.NewSize(t.udpSize)
-		_, err := buffer.ReadOnceFrom(conn)
-		if err != nil {
-			buffer.Release()
-			conn.Close(err)
-			return
-		}
-		var message mDNS.Msg
-		err = message.Unpack(buffer.Bytes())
-		buffer.Release()
-		if err != nil {
-			conn.Close(err)
-			return
-		}
-		conn.access.RLock()
-		callback, loaded := conn.callbacks[message.Id]
-		conn.access.RUnlock()
-		if !loaded {
-			continue
-		}
-		callback.access.Lock()
-		select {
-		case <-callback.done:
-		default:
-			callback.message = &message
-			close(callback.done)
-		}
-		callback.access.Unlock()
-	}
-}
-
-type dnsConnection struct {
-	net.Conn
-	access    sync.RWMutex
-	done      chan struct{}
-	closeOnce sync.Once
-	err       error
-	queryId   uint16
-	callbacks map[uint16]*dnsCallback
-}
-
-func (c *dnsConnection) Close(err error) {
-	c.access.Lock()
-	defer c.access.Unlock()
-	c.closeOnce.Do(func() {
-		close(c.done)
-		c.err = err
-	})
-	c.Conn.Close()
-}
-
-type dnsCallback struct {
-	access  sync.Mutex
-	message *mDNS.Msg
-	done    chan struct{}
-}
--- a/dns/transport_adapter.go
+++ b/dns/transport_adapter.go
@@ -1,70 +0,0 @@
-package dns
-
-import (
-	"net/netip"
-
-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-)
-
-var _ adapter.LegacyDNSTransport = (*TransportAdapter)(nil)
-
-type TransportAdapter struct {
-	transportType string
-	transportTag  string
-	dependencies  []string
-	strategy      C.DomainStrategy
-	clientSubnet  netip.Prefix
-}
-
-func NewTransportAdapter(transportType string, transportTag string, dependencies []string) TransportAdapter {
-	return TransportAdapter{
-		transportType: transportType,
-		transportTag:  transportTag,
-		dependencies:  dependencies,
-	}
-}
-
-func NewTransportAdapterWithLocalOptions(transportType string, transportTag string, localOptions option.LocalDNSServerOptions) TransportAdapter {
-	return TransportAdapter{
-		transportType: transportType,
-		transportTag:  transportTag,
-		strategy:      C.DomainStrategy(localOptions.LegacyStrategy),
-		clientSubnet:  localOptions.LegacyClientSubnet,
-	}
-}
-
-func NewTransportAdapterWithRemoteOptions(transportType string, transportTag string, remoteOptions option.RemoteDNSServerOptions) TransportAdapter {
-	var dependencies []string
-	if remoteOptions.AddressResolver != "" {
-		dependencies = []string{remoteOptions.AddressResolver}
-	}
-	return TransportAdapter{
-		transportType: transportType,
-		transportTag:  transportTag,
-		dependencies:  dependencies,
-		strategy:      C.DomainStrategy(remoteOptions.LegacyStrategy),
-		clientSubnet:  remoteOptions.LegacyClientSubnet,
-	}
-}
-
-func (a *TransportAdapter) Type() string {
-	return a.transportType
-}
-
-func (a *TransportAdapter) Tag() string {
-	return a.transportTag
-}
-
-func (a *TransportAdapter) Dependencies() []string {
-	return a.dependencies
-}
-
-func (a *TransportAdapter) LegacyStrategy() C.DomainStrategy {
-	return a.strategy
-}
-
-func (a *TransportAdapter) LegacyClientSubnet() netip.Prefix {
-	return a.clientSubnet
-}
--- a/dns/transport_dialer.go
+++ b/dns/transport_dialer.go
@@ -1,101 +0,0 @@
-package dns
-
-import (
-	"context"
-	"net"
-	"time"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/dialer"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/option"
-	E "github.com/sagernet/sing/common/exceptions"
-	M "github.com/sagernet/sing/common/metadata"
-	N "github.com/sagernet/sing/common/network"
-	"github.com/sagernet/sing/service"
-)
-
-func NewLocalDialer(ctx context.Context, options option.LocalDNSServerOptions) (N.Dialer, error) {
-	if options.LegacyDefaultDialer {
-		return dialer.NewDefaultOutbound(ctx), nil
-	} else {
-		return dialer.New(ctx, options.DialerOptions, false)
-	}
-}
-
-func NewRemoteDialer(ctx context.Context, options option.RemoteDNSServerOptions) (N.Dialer, error) {
-	var (
-		transportDialer N.Dialer
-		err             error
-	)
-	if options.LegacyDefaultDialer {
-		transportDialer = dialer.NewDefaultOutbound(ctx)
-	} else {
-		transportDialer, err = dialer.New(ctx, options.DialerOptions, options.ServerIsDomain())
-	}
-	if err != nil {
-		return nil, err
-	}
-	if options.AddressResolver != "" {
-		transport := service.FromContext[adapter.DNSTransportManager](ctx)
-		resolverTransport, loaded := transport.Transport(options.AddressResolver)
-		if !loaded {
-			return nil, E.New("address resolver not found: ", options.AddressResolver)
-		}
-		transportDialer = NewTransportDialer(transportDialer, service.FromContext[adapter.DNSRouter](ctx), resolverTransport, C.DomainStrategy(options.AddressStrategy), time.Duration(options.AddressFallbackDelay))
-	} else if options.ServerIsDomain() {
-		return nil, E.New("missing address resolver for server: ", options.Server)
-	}
-	return transportDialer, nil
-}
-
-type TransportDialer struct {
-	dialer        N.Dialer
-	dnsRouter     adapter.DNSRouter
-	transport     adapter.DNSTransport
-	strategy      C.DomainStrategy
-	fallbackDelay time.Duration
-}
-
-func NewTransportDialer(dialer N.Dialer, dnsRouter adapter.DNSRouter, transport adapter.DNSTransport, strategy C.DomainStrategy, fallbackDelay time.Duration) *TransportDialer {
-	return &TransportDialer{
-		dialer,
-		dnsRouter,
-		transport,
-		strategy,
-		fallbackDelay,
-	}
-}
-
-func (d *TransportDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
-	if destination.IsIP() {
-		return d.dialer.DialContext(ctx, network, destination)
-	}
-	addresses, err := d.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{
-		Transport: d.transport,
-		Strategy:  d.strategy,
-	})
-	if err != nil {
-		return nil, err
-	}
-	return N.DialParallel(ctx, d.dialer, network, destination, addresses, d.strategy == C.DomainStrategyPreferIPv6, d.fallbackDelay)
-}
-
-func (d *TransportDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
-	if destination.IsIP() {
-		return d.dialer.ListenPacket(ctx, destination)
-	}
-	addresses, err := d.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{
-		Transport: d.transport,
-		Strategy:  d.strategy,
-	})
-	if err != nil {
-		return nil, err
-	}
-	conn, _, err := N.ListenSerial(ctx, d.dialer, destination, addresses)
-	return conn, err
-}
-
-func (d *TransportDialer) Upstream() any {
-	return d.dialer
-}
--- a/dns/transport_manager.go
+++ b/dns/transport_manager.go
@@ -1,288 +0,0 @@
-package dns
-
-import (
-	"context"
-	"io"
-	"os"
-	"strings"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/taskmonitor"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-	"github.com/sagernet/sing/common/logger"
-)
-
-var _ adapter.DNSTransportManager = (*TransportManager)(nil)
-
-type TransportManager struct {
-	logger                   log.ContextLogger
-	registry                 adapter.DNSTransportRegistry
-	outbound                 adapter.OutboundManager
-	defaultTag               string
-	access                   sync.RWMutex
-	started                  bool
-	stage                    adapter.StartStage
-	transports               []adapter.DNSTransport
-	transportByTag           map[string]adapter.DNSTransport
-	dependByTag              map[string][]string
-	defaultTransport         adapter.DNSTransport
-	defaultTransportFallback adapter.DNSTransport
-	fakeIPTransport          adapter.FakeIPTransport
-}
-
-func NewTransportManager(logger logger.ContextLogger, registry adapter.DNSTransportRegistry, outbound adapter.OutboundManager, defaultTag string) *TransportManager {
-	return &TransportManager{
-		logger:         logger,
-		registry:       registry,
-		outbound:       outbound,
-		defaultTag:     defaultTag,
-		transportByTag: make(map[string]adapter.DNSTransport),
-		dependByTag:    make(map[string][]string),
-	}
-}
-
-func (m *TransportManager) Initialize(defaultTransportFallback adapter.DNSTransport) {
-	m.defaultTransportFallback = defaultTransportFallback
-}
-
-func (m *TransportManager) Start(stage adapter.StartStage) error {
-	m.access.Lock()
-	if m.started && m.stage >= stage {
-		panic("already started")
-	}
-	m.started = true
-	m.stage = stage
-	outbounds := m.transports
-	m.access.Unlock()
-	if stage == adapter.StartStateStart {
-		return m.startTransports(m.transports)
-	} else {
-		for _, outbound := range outbounds {
-			err := adapter.LegacyStart(outbound, stage)
-			if err != nil {
-				return E.Cause(err, stage, " dns/", outbound.Type(), "[", outbound.Tag(), "]")
-			}
-		}
-	}
-	return nil
-}
-
-func (m *TransportManager) startTransports(transports []adapter.DNSTransport) error {
-	monitor := taskmonitor.New(m.logger, C.StartTimeout)
-	started := make(map[string]bool)
-	for {
-		canContinue := false
-	startOne:
-		for _, transportToStart := range transports {
-			transportTag := transportToStart.Tag()
-			if started[transportTag] {
-				continue
-			}
-			dependencies := transportToStart.Dependencies()
-			for _, dependency := range dependencies {
-				if !started[dependency] {
-					continue startOne
-				}
-			}
-			started[transportTag] = true
-			canContinue = true
-			if starter, isStarter := transportToStart.(adapter.Lifecycle); isStarter {
-				monitor.Start("start dns/", transportToStart.Type(), "[", transportTag, "]")
-				err := starter.Start(adapter.StartStateStart)
-				monitor.Finish()
-				if err != nil {
-					return E.Cause(err, "start dns/", transportToStart.Type(), "[", transportTag, "]")
-				}
-			}
-		}
-		if len(started) == len(transports) {
-			break
-		}
-		if canContinue {
-			continue
-		}
-		currentTransport := common.Find(transports, func(it adapter.DNSTransport) bool {
-			return !started[it.Tag()]
-		})
-		var lintTransport func(oTree []string, oCurrent adapter.DNSTransport) error
-		lintTransport = func(oTree []string, oCurrent adapter.DNSTransport) error {
-			problemTransportTag := common.Find(oCurrent.Dependencies(), func(it string) bool {
-				return !started[it]
-			})
-			if common.Contains(oTree, problemTransportTag) {
-				return E.New("circular server dependency: ", strings.Join(oTree, " -> "), " -> ", problemTransportTag)
-			}
-			m.access.Lock()
-			problemTransport := m.transportByTag[problemTransportTag]
-			m.access.Unlock()
-			if problemTransport == nil {
-				return E.New("dependency[", problemTransportTag, "] not found for server[", oCurrent.Tag(), "]")
-			}
-			return lintTransport(append(oTree, problemTransportTag), problemTransport)
-		}
-		return lintTransport([]string{currentTransport.Tag()}, currentTransport)
-	}
-	return nil
-}
-
-func (m *TransportManager) Close() error {
-	monitor := taskmonitor.New(m.logger, C.StopTimeout)
-	m.access.Lock()
-	if !m.started {
-		m.access.Unlock()
-		return nil
-	}
-	m.started = false
-	transports := m.transports
-	m.transports = nil
-	m.access.Unlock()
-	var err error
-	for _, transport := range transports {
-		if closer, isCloser := transport.(io.Closer); isCloser {
-			monitor.Start("close server/", transport.Type(), "[", transport.Tag(), "]")
-			err = E.Append(err, closer.Close(), func(err error) error {
-				return E.Cause(err, "close server/", transport.Type(), "[", transport.Tag(), "]")
-			})
-			monitor.Finish()
-		}
-	}
-	return nil
-}
-
-func (m *TransportManager) Transports() []adapter.DNSTransport {
-	m.access.RLock()
-	defer m.access.RUnlock()
-	return m.transports
-}
-
-func (m *TransportManager) Transport(tag string) (adapter.DNSTransport, bool) {
-	m.access.RLock()
-	outbound, found := m.transportByTag[tag]
-	m.access.RUnlock()
-	return outbound, found
-}
-
-func (m *TransportManager) Default() adapter.DNSTransport {
-	m.access.RLock()
-	defer m.access.RUnlock()
-	if m.defaultTransport != nil {
-		return m.defaultTransport
-	} else {
-		return m.defaultTransportFallback
-	}
-}
-
-func (m *TransportManager) FakeIP() adapter.FakeIPTransport {
-	m.access.RLock()
-	defer m.access.RUnlock()
-	return m.fakeIPTransport
-}
-
-func (m *TransportManager) Remove(tag string) error {
-	m.access.Lock()
-	defer m.access.Unlock()
-	transport, found := m.transportByTag[tag]
-	if !found {
-		return os.ErrInvalid
-	}
-	delete(m.transportByTag, tag)
-	index := common.Index(m.transports, func(it adapter.DNSTransport) bool {
-		return it == transport
-	})
-	if index == -1 {
-		panic("invalid inbound index")
-	}
-	m.transports = append(m.transports[:index], m.transports[index+1:]...)
-	started := m.started
-	if m.defaultTransport == transport {
-		if len(m.transports) > 0 {
-			nextTransport := m.transports[0]
-			if nextTransport.Type() != C.DNSTypeFakeIP {
-				return E.New("default server cannot be fakeip")
-			}
-			m.defaultTransport = nextTransport
-			m.logger.Info("updated default server to ", m.defaultTransport.Tag())
-		} else {
-			m.defaultTransport = nil
-		}
-	}
-	dependBy := m.dependByTag[tag]
-	if len(dependBy) > 0 {
-		return E.New("server[", tag, "] is depended by ", strings.Join(dependBy, ", "))
-	}
-	dependencies := transport.Dependencies()
-	for _, dependency := range dependencies {
-		if len(m.dependByTag[dependency]) == 1 {
-			delete(m.dependByTag, dependency)
-		} else {
-			m.dependByTag[dependency] = common.Filter(m.dependByTag[dependency], func(it string) bool {
-				return it != tag
-			})
-		}
-	}
-	if started {
-		transport.Reset()
-	}
-	return nil
-}
-
-func (m *TransportManager) Create(ctx context.Context, logger log.ContextLogger, tag string, transportType string, options any) error {
-	if tag == "" {
-		return os.ErrInvalid
-	}
-	transport, err := m.registry.CreateDNSTransport(ctx, logger, tag, transportType, options)
-	if err != nil {
-		return err
-	}
-	m.access.Lock()
-	defer m.access.Unlock()
-	if m.started {
-		for _, stage := range adapter.ListStartStages {
-			err = adapter.LegacyStart(transport, stage)
-			if err != nil {
-				return E.Cause(err, stage, " dns/", transport.Type(), "[", transport.Tag(), "]")
-			}
-		}
-	}
-	if existsTransport, loaded := m.transportByTag[tag]; loaded {
-		if m.started {
-			err = common.Close(existsTransport)
-			if err != nil {
-				return E.Cause(err, "close dns/", existsTransport.Type(), "[", existsTransport.Tag(), "]")
-			}
-		}
-		existsIndex := common.Index(m.transports, func(it adapter.DNSTransport) bool {
-			return it == existsTransport
-		})
-		if existsIndex == -1 {
-			panic("invalid inbound index")
-		}
-		m.transports = append(m.transports[:existsIndex], m.transports[existsIndex+1:]...)
-	}
-	m.transports = append(m.transports, transport)
-	m.transportByTag[tag] = transport
-	dependencies := transport.Dependencies()
-	for _, dependency := range dependencies {
-		m.dependByTag[dependency] = append(m.dependByTag[dependency], tag)
-	}
-	if tag == m.defaultTag || (m.defaultTag == "" && m.defaultTransport == nil) {
-		if transport.Type() == C.DNSTypeFakeIP {
-			return E.New("default server cannot be fakeip")
-		}
-		m.defaultTransport = transport
-		if m.started {
-			m.logger.Info("updated default server to ", transport.Tag())
-		}
-	}
-	if transport.Type() == C.DNSTypeFakeIP {
-		if m.fakeIPTransport != nil {
-			return E.New("multiple fakeip server are not supported")
-		}
-		m.fakeIPTransport = transport.(adapter.FakeIPTransport)
-	}
-	return nil
-}
--- a/dns/transport_registry.go
+++ b/dns/transport_registry.go
@@ -1,72 +0,0 @@
-package dns
-
-import (
-	"context"
-	"sync"
-
-	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/log"
-	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
-)
-
-type TransportConstructorFunc[T any] func(ctx context.Context, logger log.ContextLogger, tag string, options T) (adapter.DNSTransport, error)
-
-func RegisterTransport[Options any](registry *TransportRegistry, transportType string, constructor TransportConstructorFunc[Options]) {
-	registry.register(transportType, func() any {
-		return new(Options)
-	}, func(ctx context.Context, logger log.ContextLogger, tag string, rawOptions any) (adapter.DNSTransport, error) {
-		var options *Options
-		if rawOptions != nil {
-			options = rawOptions.(*Options)
-		}
-		return constructor(ctx, logger, tag, common.PtrValueOrDefault(options))
-	})
-}
-
-var _ adapter.DNSTransportRegistry = (*TransportRegistry)(nil)
-
-type (
-	optionsConstructorFunc func() any
-	constructorFunc        func(ctx context.Context, logger log.ContextLogger, tag string, options any) (adapter.DNSTransport, error)
-)
-
-type TransportRegistry struct {
-	access       sync.Mutex
-	optionsType  map[string]optionsConstructorFunc
-	constructors map[string]constructorFunc
-}
-
-func NewTransportRegistry() *TransportRegistry {
-	return &TransportRegistry{
-		optionsType:  make(map[string]optionsConstructorFunc),
-		constructors: make(map[string]constructorFunc),
-	}
-}
-
-func (r *TransportRegistry) CreateOptions(transportType string) (any, bool) {
-	r.access.Lock()
-	defer r.access.Unlock()
-	optionsConstructor, loaded := r.optionsType[transportType]
-	if !loaded {
-		return nil, false
-	}
-	return optionsConstructor(), true
-}
-
-func (r *TransportRegistry) CreateDNSTransport(ctx context.Context, logger log.ContextLogger, tag string, transportType string, options any) (adapter.DNSTransport, error) {
-	r.access.Lock()
-	defer r.access.Unlock()
-	constructor, loaded := r.constructors[transportType]
-	if !loaded {
-		return nil, E.New("transport type not found: " + transportType)
-	}
-	return constructor(ctx, logger, tag, options)
-}
-
-func (r *TransportRegistry) register(transportType string, optionsConstructor optionsConstructorFunc, constructor constructorFunc) {
-	r.access.Lock()
-	defer r.access.Unlock()
-	r.optionsType[transportType] = optionsConstructor
-	r.constructors[transportType] = constructor
-}
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -2,56 +2,10 @@
 icon: material/alert-decagram
 ---

-#### 1.11.0-beta.24
+#### 1.11.0-beta.9

 * Fixes and improvements

-### 1.10.7
-
-* Fixes and improvements
-
-#### 1.11.0-beta.20
-
-* Hysteria2 `ignore_client_bandwidth` behavior update **1**
-* Fixes and improvements
-
-**1**:
-
-When `up_mbps` and `down_mbps` are set, `ignore_client_bandwidth` instead denies clients from using BBR CC.
-
-See [Hysteria2](/configuration/inbound/hysteria2/#ignore_client_bandwidth).
-
-#### 1.11.0-beta.17
-
-* Add port hopping support for Hysteria2 **1**
-* Fixes and improvements
-
-**1**:
-
-See [Hysteria2](/configuration/outbound/hysteria2/).
-
-#### 1.11.0-beta.14
-
-* Allow adding route (exclude) address sets to routes **1**
-* Fixes and improvements
-
-**1**:
-
-When `auto_redirect` is not enabled, directly add `route[_exclude]_address_set`
-to tun routes (equivalent to `route[_exclude]_address`).
-
-Note that it **doesn't work on the Android graphical client** due to
-the Android VpnService not being able to handle a large number of routes (DeadSystemException),
-but otherwise it works fine on all command line clients and Apple platforms.
-
-See [route_address_set](/configuration/inbound/tun/#route_address_set) and
-[route_exclude_address_set](/configuration/inbound/tun/#route_exclude_address_set).
-
-#### 1.11.0-beta.12
-
-* Add `rule-set merge` command
-* Fixes and improvements
-
 #### 1.11.0-beta.3

 * Add more masquerade options for hysteria2 **1**
@@ -61,6 +15,10 @@ See [route_address_set](/configuration/inbound/tun/#route_address_set) and

 See [Hysteria2](/configuration/inbound/hysteria2/#masquerade).

+### 1.10.3
+
+* Fixes and improvements
+
 #### 1.11.0-alpha.25

 * Update quic-go to v0.48.2
--- a/docs/configuration/inbound/hysteria2.md
+++ b/docs/configuration/inbound/hysteria2.md
@@ -4,8 +4,7 @@ icon: material/alert-decagram

 !!! quote "Changes in sing-box 1.11.0"

-    :material-alert: [masquerade](#masquerade)  
-    :material-alert: [ignore_client_bandwidth](#ignore_client_bandwidth)
+    :material-alert: [masquerade](#masquerade)

 ### Structure

@@ -76,13 +75,9 @@ Authentication password

 #### ignore_client_bandwidth

-*When `up_mbps` and `down_mbps` are not set*:
+Commands the client to use the BBR flow control algorithm instead of Hysteria CC.

-Commands clients to use the BBR CC instead of Hysteria CC.
-
-*When `up_mbps` and `down_mbps` are set*:
-
-Deny clients to use the BBR CC.
+Conflict with `up_mbps` and `down_mbps`.

 #### tls

--- a/docs/configuration/inbound/hysteria2.zh.md
+++ b/docs/configuration/inbound/hysteria2.zh.md
@@ -4,8 +4,7 @@ icon: material/alert-decagram

 !!! quote "sing-box 1.11.0 中的更改"

-    :material-alert: [masquerade](#masquerade)  
-    :material-alert: [ignore_client_bandwidth](#ignore_client_bandwidth)
+    :material-alert: [masquerade](#masquerade)

 ### 结构

@@ -73,13 +72,9 @@ Hysteria 用户

 #### ignore_client_bandwidth

-*当 `up_mbps` 和 `down_mbps` 未设定时*:
-
 命令客户端使用 BBR 拥塞控制算法而不是 Hysteria CC。

-*当 `up_mbps` 和 `down_mbps` 已设定时*:
-
-禁止客户端使用 BBR 拥塞控制算法。
+与 `up_mbps` 和 `down_mbps` 冲突。

 #### tls

--- a/docs/configuration/inbound/tun.md
+++ b/docs/configuration/inbound/tun.md
@@ -4,9 +4,7 @@ icon: material/alert-decagram

 !!! quote "Changes in sing-box 1.11.0"

-    :material-delete-alert: [gso](#gso)  
-    :material-alert-decagram: [route_address_set](#stack)  
-    :material-alert-decagram: [route_exclude_address_set](#stack)
+    :material-delete-alert: [gso](#gso)

 !!! quote "Changes in sing-box 1.10.0"

@@ -90,13 +88,13 @@ icon: material/alert-decagram
    0
  ],
  "include_uid_range": [
-    "1000:99999"
+    "1000-99999"
  ],
  "exclude_uid": [
    1000
  ],
  "exclude_uid_range": [
-    "1000:99999"
+    "1000-99999"
  ],
  "include_android_user": [
    0,
@@ -250,7 +248,7 @@ use [VPNHotspot](https://github.com/Mygod/VPNHotspot).

 !!! question "Since sing-box 1.10.0"

-Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`.
+Connection input mark used by `route_address_set` and `route_exclude_address_set`.

 `0x2023` is used by default.

@@ -258,7 +256,7 @@ Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`

 !!! question "Since sing-box 1.10.0"

-Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`.
+Connection output mark used by `route_address_set` and `route_exclude_address_set`.

 `0x2024` is used by default.

@@ -331,55 +329,29 @@ Exclude custom routes when `auto_route` is enabled.

 #### route_address_set

-=== "With `auto_redirect` enabled"
+!!! question "Since sing-box 1.10.0"

-    !!! question "Since sing-box 1.10.0"
-
-    !!! quote ""
-    
-        Only supported on Linux with nftables and requires `auto_route` and `auto_redirect` enabled.
-    
-    Add the destination IP CIDR rules in the specified rule-sets to the firewall.
-    Unmatched traffic will bypass the sing-box routes.
-    
-    Conflict with `route.default_mark` and `[dialOptions].routing_mark`.
-
-=== "Without `auto_redirect` enabled"
-
-    !!! question "Since sing-box 1.11.0"
-    
-    Add the destination IP CIDR rules in the specified rule-sets to routes, equivalent to adding to `route_address`.
-    Unmatched traffic will bypass the sing-box routes.
-
-    Note that it **doesn't work on the Android graphical client** due to
-    the Android VpnService not being able to handle a large number of routes (DeadSystemException),
-    but otherwise it works fine on all command line clients and Apple platforms.
-
-#### route_exclude_address_set
-
-=== "With `auto_redirect` enabled"
-
-    !!! question "Since sing-box 1.10.0"
-
-    !!! quote ""
+!!! quote ""

    Only supported on Linux with nftables and requires `auto_route` and `auto_redirect` enabled.

-    Add the destination IP CIDR rules in the specified rule-sets to the firewall.
-    Matched traffic will bypass the sing-box routes.
-    
-    Conflict with `route.default_mark` and `[dialOptions].routing_mark`.
+Add the destination IP CIDR rules in the specified rule-sets to the firewall.
+Unmatched traffic will bypass the sing-box routes.

-=== "Without `auto_redirect` enabled"
+Conflict with `route.default_mark` and `[dialOptions].routing_mark`.

-    !!! question "Since sing-box 1.11.0"
-    
-    Add the destination IP CIDR rules in the specified rule-sets to routes, equivalent to adding to `route_exclude_address`.
-    Matched traffic will bypass the sing-box routes.
+#### route_exclude_address_set

-    Note that it **doesn't work on the Android graphical client** due to
-    the Android VpnService not being able to handle a large number of routes (DeadSystemException),
-    but otherwise it works fine on all command line clients and Apple platforms.
+!!! question "Since sing-box 1.10.0"
+
+!!! quote ""
+
+    Only supported on Linux with nftables and requires `auto_route` and `auto_redirect` enabled.
+
+Add the destination IP CIDR rules in the specified rule-sets to the firewall.
+Matched traffic will bypass the sing-box routes.
+
+Conflict with `route.default_mark` and `[dialOptions].routing_mark`.

 #### endpoint_independent_nat

--- a/docs/configuration/inbound/tun.zh.md
+++ b/docs/configuration/inbound/tun.zh.md
@@ -4,9 +4,7 @@ icon: material/alert-decagram

 !!! quote "sing-box 1.11.0 中的更改"

-    :material-delete-alert: [gso](#gso)  
-    :material-alert-decagram: [route_address_set](#stack)  
-    :material-alert-decagram: [route_exclude_address_set](#stack)
+    :material-delete-alert: [gso](#gso)

 !!! quote "sing-box 1.10.0 中的更改"

@@ -90,13 +88,13 @@ icon: material/alert-decagram
    0
  ],
  "include_uid_range": [
-    "1000:99999"
+    "1000-99999"
  ],
  "exclude_uid": [
    1000
  ],
  "exclude_uid_range": [
-    "1000:99999"
+    "1000-99999"
  ],
  "include_android_user": [
    0,
@@ -331,53 +329,29 @@ tun 接口的 IPv6 前缀。

 #### route_address_set

-=== "`auto_redirect` 已启用"
+!!! question "自 sing-box 1.10.0 起"

-    !!! question "自 sing-box 1.10.0 起"
-    
-    !!! quote ""
-    
-        仅支持 Linux，且需要 nftables，`auto_route` 和 `auto_redirect` 已启用。 
-    
-    将指定规则集中的目标 IP CIDR 规则添加到防火墙。
-    不匹配的流量将绕过 sing-box 路由。
-    
-    与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。
+!!! quote ""

-=== "`auto_redirect` 未启用"
+    仅支持 Linux，且需要 nftables，`auto_route` 和 `auto_redirect` 已启用。 

-    !!! question "自 sing-box 1.11.0 起"
+将指定规则集中的目标 IP CIDR 规则添加到防火墙。
+不匹配的流量将绕过 sing-box 路由。

-    将指定规则集中的目标 IP CIDR 规则添加到路由，相当于添加到 `route_address`。
-    不匹配的流量将绕过 sing-box 路由。
-
-    请注意，由于 Android VpnService 无法处理大量路由（DeadSystemException），
-    因此它**在 Android 图形客户端上不起作用**，但除此之外，它在所有命令行客户端和 Apple 平台上都可以正常工作。
+与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。

 #### route_exclude_address_set

-=== "`auto_redirect` 已启用"
+!!! question "自 sing-box 1.10.0 起"

-    !!! question "自 sing-box 1.10.0 起"
-    
-    !!! quote ""
-    
-        仅支持 Linux，且需要 nftables，`auto_route` 和 `auto_redirect` 已启用。 
+!!! quote ""

-    将指定规则集中的目标 IP CIDR 规则添加到防火墙。
-    匹配的流量将绕过 sing-box 路由。
+    仅支持 Linux，且需要 nftables，`auto_route` 和 `auto_redirect` 已启用。

-    与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。
+将指定规则集中的目标 IP CIDR 规则添加到防火墙。
+匹配的流量将绕过 sing-box 路由。

-=== "`auto_redirect` 未启用"
-
-    !!! question "自 sing-box 1.11.0 起"
-
-    将指定规则集中的目标 IP CIDR 规则添加到路由，相当于添加到 `route_exclude_address`。
-    匹配的流量将绕过 sing-box 路由。
-
-    请注意，由于 Android VpnService 无法处理大量路由（DeadSystemException），
-    因此它**在 Android 图形客户端上不起作用**，但除此之外，它在所有命令行客户端和 Apple 平台上都可以正常工作。
+与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。

 #### endpoint_independent_nat

--- a/docs/configuration/outbound/hysteria2.md
+++ b/docs/configuration/outbound/hysteria2.md
@@ -1,12 +1,3 @@
---
-icon: material/new-box
---
-
-!!! quote "Changes in sing-box 1.11.0"
-
-    :material-plus: [server_ports](#server_ports)  
-    :material-plus: [hop_interval](#hop_interval)
-
 ### Structure

 ```json
@@ -16,10 +7,6 @@ icon: material/new-box
  
  "server": "127.0.0.1",
  "server_port": 1080,
-  "server_ports": [
-    "2080:3000"
-  ],
-  "hop_interval": "",
  "up_mbps": 100,
  "down_mbps": 100,
  "obfs": {
@@ -35,10 +22,6 @@ icon: material/new-box
 }
 ```

-!!! note ""
-
-    You can ignore the JSON Array [] tag when the content is only one item
-
 !!! warning "Difference from official Hysteria2"

    The official Hysteria2 supports an authentication method called **userpass**,
@@ -61,24 +44,6 @@ The server address.

 The server port.

-Ignored if `server_ports` is set.
-
-#### server_ports
-
-!!! question "Since sing-box 1.11.0"
-
-Server port range list.
-
-Conflicts with `server_port`.
-
-#### hop_interval
-
-!!! question "Since sing-box 1.11.0"
-
-Port hopping interval.
-
-`30s` is used by default.
-
 #### up_mbps, down_mbps

 Max bandwidth, in Mbps.
--- a/docs/configuration/outbound/hysteria2.zh.md
+++ b/docs/configuration/outbound/hysteria2.zh.md
@@ -1,12 +1,3 @@
---
-icon: material/new-box
---
-
-!!! quote "sing-box 1.11.0 中的更改"
-
-    :material-plus: [server_ports](#server_ports)  
-    :material-plus: [hop_interval](#hop_interval)
-
 ### 结构

 ```json
@@ -16,10 +7,6 @@ icon: material/new-box

  "server": "127.0.0.1",
  "server_port": 1080,
-  "server_ports": [
-    "2080:3000"
-  ],
-  "hop_interval": "",
  "up_mbps": 100,
  "down_mbps": 100,
  "obfs": {
@@ -35,10 +22,6 @@ icon: material/new-box
 }
 ```

-!!! note ""
-
-    当内容只有一项时，可以忽略 JSON 数组 [] 标签
-
 !!! warning "与官方 Hysteria2 的区别"

    官方程序支持一种名为 **userpass** 的验证方式，
@@ -59,24 +42,6 @@ icon: material/new-box

 服务器端口。

-如果设置了 `server_ports`，则忽略此项。
-
-#### server_ports
-
-!!! question "自 sing-box 1.11.0 起"
-
-服务器端口范围列表。
-
-与 `server_port` 冲突。
-
-#### hop_interval
-
-!!! question "自 sing-box 1.11.0 起"
-
-端口跳跃间隔。
-
-默认使用 `30s`。
-
 #### up_mbps, down_mbps

 最大带宽。
--- a/experimental/clashapi/dns.go
+++ b/experimental/clashapi/dns.go
@@ -13,13 +13,13 @@ import (
 	"github.com/miekg/dns"
 )

-func dnsRouter(router adapter.DNSRouter) http.Handler {
+func dnsRouter(router adapter.Router) http.Handler {
 	r := chi.NewRouter()
 	r.Get("/query", queryDNS(router))
 	return r
 }

-func queryDNS(router adapter.DNSRouter) func(w http.ResponseWriter, r *http.Request) {
+func queryDNS(router adapter.Router) func(w http.ResponseWriter, r *http.Request) {
 	return func(w http.ResponseWriter, r *http.Request) {
 		name := r.URL.Query().Get("name")
 		qTypeStr := r.URL.Query().Get("type")
@@ -39,7 +39,7 @@ func queryDNS(router adapter.DNSRouter) func(w http.ResponseWriter, r *http.Requ

 		msg := dns.Msg{}
 		msg.SetQuestion(dns.Fqdn(name), qType)
-		resp, err := router.Exchange(ctx, &msg, adapter.DNSQueryOptions{})
+		resp, err := router.Exchange(ctx, &msg)
 		if err != nil {
 			render.Status(r, http.StatusInternalServerError)
 			render.JSON(w, r, newError(err.Error()))
--- a/experimental/clashapi/server.go
+++ b/experimental/clashapi/server.go
@@ -42,7 +42,6 @@ var _ adapter.ClashServer = (*Server)(nil)
 type Server struct {
 	ctx            context.Context
 	router         adapter.Router
-	dnsRouter      adapter.DNSRouter
 	outbound       adapter.OutboundManager
 	endpoint       adapter.EndpointManager
 	logger         log.Logger
@@ -63,12 +62,11 @@ func NewServer(ctx context.Context, logFactory log.ObservableFactory, options op
 	trafficManager := trafficontrol.NewManager()
 	chiRouter := chi.NewRouter()
 	s := &Server{
-		ctx:       ctx,
-		router:    service.FromContext[adapter.Router](ctx),
-		dnsRouter: service.FromContext[adapter.DNSRouter](ctx),
-		outbound:  service.FromContext[adapter.OutboundManager](ctx),
-		endpoint:  service.FromContext[adapter.EndpointManager](ctx),
-		logger:    logFactory.NewLogger("clash-api"),
+		ctx:      ctx,
+		router:   service.FromContext[adapter.Router](ctx),
+		outbound: service.FromContext[adapter.OutboundManager](ctx),
+		endpoint: service.FromContext[adapter.EndpointManager](ctx),
+		logger:   logFactory.NewLogger("clash-api"),
 		httpServer: &http.Server{
 			Addr:    options.ExternalController,
 			Handler: chiRouter,
@@ -123,15 +121,18 @@ func NewServer(ctx context.Context, logFactory log.ObservableFactory, options op
 		r.Mount("/script", scriptRouter())
 		r.Mount("/profile", profileRouter())
 		r.Mount("/cache", cacheRouter(ctx))
-		r.Mount("/dns", dnsRouter(s.dnsRouter))
+		r.Mount("/dns", dnsRouter(s.router))

 		s.setupMetaAPI(r)
 	})
 	if options.ExternalUI != "" {
 		s.externalUI = filemanager.BasePath(ctx, os.ExpandEnv(options.ExternalUI))
 		chiRouter.Group(func(r chi.Router) {
-			r.Get("/ui", http.RedirectHandler("/ui/", http.StatusMovedPermanently).ServeHTTP)
-			r.Handle("/ui/*", http.StripPrefix("/ui/", http.FileServer(http.Dir(s.externalUI))))
+			fs := http.StripPrefix("/ui", http.FileServer(http.Dir(s.externalUI)))
+			r.Get("/ui", http.RedirectHandler("/ui/", http.StatusTemporaryRedirect).ServeHTTP)
+			r.Get("/ui/*", func(w http.ResponseWriter, r *http.Request) {
+				fs.ServeHTTP(w, r)
+			})
 		})
 	}
 	return s, nil
@@ -223,7 +224,7 @@ func (s *Server) SetMode(newMode string) {
 		default:
 		}
 	}
-	s.dnsRouter.ClearCache()
+	s.router.ClearDNSCache()
 	cacheFile := service.FromContext[adapter.CacheFile](s.ctx)
 	if cacheFile != nil {
 		err := cacheFile.StoreMode(newMode)
--- a/experimental/deprecated/constants.go
+++ b/experimental/deprecated/constants.go
@@ -1,11 +1,8 @@
 package deprecated

 import (
-	"fmt"
-
 	"github.com/sagernet/sing-box/common/badversion"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/experimental/locale"
 	F "github.com/sagernet/sing/common/format"

 	"golang.org/x/mod/semver"
@@ -37,9 +34,15 @@ func (n Note) Impending() bool {

 func (n Note) Message() string {
 	if n.MigrationLink != "" {
-		return fmt.Sprintf(locale.Current().DeprecatedMessage, n.Description, n.DeprecatedVersion, n.ScheduledVersion)
+		return F.ToString(
+			n.Description, " is deprecated in sing-box ", n.DeprecatedVersion,
+			" and will be removed in sing-box ", n.ScheduledVersion, ", please checkout documentation for migration.",
+		)
 	} else {
-		return fmt.Sprintf(locale.Current().DeprecatedMessageNoLink, n.Description, n.DeprecatedVersion, n.ScheduledVersion)
+		return F.ToString(
+			n.Description, " is deprecated in sing-box ", n.DeprecatedVersion,
+			" and will be removed in sing-box ", n.ScheduledVersion, ".",
+		)
 	}
 }

@@ -146,35 +149,6 @@ var OptionTUNGSO = Note{
 	EnvName:           "TUN_GSO",
 }

-var OptionLegacyDNSTransport = Note{
-	Name:              "legacy-dns-transport",
-	Description:       "legacy DNS transport",
-	DeprecatedVersion: "1.12.0",
-	ScheduledVersion:  "1.14.0",
-	EnvName:           "LEGACY_DNS_TRANSPORT",
-}
-
-var OptionLegacyDNSFakeIPOptions = Note{
-	Name:              "legacy-dns-fakeip-options",
-	Description:       "legacy DNS fakeip options",
-	DeprecatedVersion: "1.12.0",
-	ScheduledVersion:  "1.14.0",
-}
-
-var OptionOutboundDNSRuleItem = Note{
-	Name:              "outbound-dns-rule-item",
-	Description:       "outbound DNS rule item",
-	DeprecatedVersion: "1.12.0",
-	ScheduledVersion:  "1.14.0",
-}
-
-var OptionMissingDomainResolverInDialOptions = Note{
-	Name:              "missing-domain-resolver-in-dial-options",
-	Description:       "missing domain resolver in dial options",
-	DeprecatedVersion: "1.12.0",
-	ScheduledVersion:  "1.14.0",
-}
-
 var Options = []Note{
 	OptionBadMatchSource,
 	OptionGEOIP,
@@ -186,8 +160,4 @@ var Options = []Note{
 	OptionWireGuardOutbound,
 	OptionWireGuardGSO,
 	OptionTUNGSO,
-	OptionLegacyDNSTransport,
-	OptionLegacyDNSFakeIPOptions,
-	OptionOutboundDNSRuleItem,
-	OptionMissingDomainResolverInDialOptions,
 }
--- a/experimental/libbox/command_client.go
+++ b/experimental/libbox/command_client.go
@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"time"

+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 )
@@ -113,7 +114,7 @@ func (c *CommandClient) Connect() error {
 		if err != nil {
 			return err
 		}
-		if sFixAndroidStack {
+		if C.FixAndroidStack {
 			go func() {
 				c.handler.Connected()
 				c.handler.InitializeClashMode(newIterator(modeList), currentMode)
--- a/experimental/libbox/config.go
+++ b/experimental/libbox/config.go
@@ -9,11 +9,8 @@ import (
 	"github.com/sagernet/sing-box"
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing-box/common/process"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
 	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	"github.com/sagernet/sing-box/include"
-	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common/control"
@@ -24,18 +21,6 @@ import (
 	"github.com/sagernet/sing/service"
 )

-func BaseContext(platformInterface PlatformInterface) context.Context {
-	dnsRegistry := include.DNSTransportRegistry()
-	if platformInterface != nil {
-		if localTransport := platformInterface.LocalDNSTransport(); localTransport != nil {
-			dns.RegisterTransport[option.LocalDNSServerOptions](dnsRegistry, C.DNSTypeLocal, func(ctx context.Context, logger log.ContextLogger, tag string, options option.LocalDNSServerOptions) (adapter.DNSTransport, error) {
-				return newPlatformTransport(localTransport, tag, options), nil
-			})
-		}
-	}
-	return box.Context(context.Background(), include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry(), dnsRegistry)
-}
-
 func parseConfig(ctx context.Context, configContent string) (option.Options, error) {
 	options, err := json.UnmarshalExtendedContext[option.Options](ctx, []byte(configContent))
 	if err != nil {
@@ -45,7 +30,7 @@ func parseConfig(ctx context.Context, configContent string) (option.Options, err
 }

 func CheckConfig(configContent string) error {
-	ctx := BaseContext(nil)
+	ctx := box.Context(context.Background(), include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry())
 	options, err := parseConfig(ctx, configContent)
 	if err != nil {
 		return err
@@ -81,10 +66,6 @@ func (s *platformInterfaceStub) OpenTun(options *tun.Options, platformOptions op
 	return nil, os.ErrInvalid
 }

-func (s *platformInterfaceStub) UpdateRouteOptions(options *tun.Options, platformInterface option.TunPlatformOptions) error {
-	return os.ErrInvalid
-}
-
 func (s *platformInterfaceStub) UsePlatformDefaultInterfaceMonitor() bool {
 	return true
 }
@@ -150,7 +131,7 @@ func (s *platformInterfaceStub) SendNotification(notification *platform.Notifica
 }

 func FormatConfig(configContent string) (*StringBox, error) {
-	options, err := parseConfig(BaseContext(nil), configContent)
+	options, err := parseConfig(box.Context(context.Background(), include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry()), configContent)
 	if err != nil {
 		return nil, err
 	}
--- a/experimental/libbox/dns.go
+++ b/experimental/libbox/dns.go
@@ -6,10 +6,7 @@ import (
 	"strings"
 	"syscall"

-	"github.com/sagernet/sing-box/adapter"
-	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/dns"
-	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-dns"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
 	M "github.com/sagernet/sing/common/metadata"
@@ -24,80 +21,118 @@ type LocalDNSTransport interface {
 	Exchange(ctx *ExchangeContext, message []byte) error
 }

-var _ adapter.DNSTransport = (*platformTransport)(nil)
+func RegisterLocalDNSTransport(transport LocalDNSTransport) {
+	if transport == nil {
+		dns.RegisterTransport([]string{"local"}, func(options dns.TransportOptions) (dns.Transport, error) {
+			return dns.NewLocalTransport(options), nil
+		})
+	} else {
+		dns.RegisterTransport([]string{"local"}, func(options dns.TransportOptions) (dns.Transport, error) {
+			return &platformLocalDNSTransport{
+				iif: transport,
+			}, nil
+		})
+	}
+}

-type platformTransport struct {
-	dns.TransportAdapter
+var _ dns.Transport = (*platformLocalDNSTransport)(nil)
+
+type platformLocalDNSTransport struct {
 	iif LocalDNSTransport
 }

-func newPlatformTransport(iif LocalDNSTransport, tag string, options option.LocalDNSServerOptions) *platformTransport {
-	return &platformTransport{
-		TransportAdapter: dns.NewTransportAdapterWithLocalOptions(C.DNSTypeLocal, tag, options),
-		iif:              iif,
+func (p *platformLocalDNSTransport) Name() string {
+	return "local"
+}
+
+func (p *platformLocalDNSTransport) Start() error {
+	return nil
+}
+
+func (p *platformLocalDNSTransport) Reset() {
+}
+
+func (p *platformLocalDNSTransport) Close() error {
+	return nil
+}
+
+func (p *platformLocalDNSTransport) Raw() bool {
+	return p.iif.Raw()
+}
+
+func (p *platformLocalDNSTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
+	messageBytes, err := message.Pack()
+	if err != nil {
+		return nil, err
 	}
-}
-
-func (p *platformTransport) Reset() {
-}
-
-func (p *platformTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
 	response := &ExchangeContext{
 		context: ctx,
 	}
-	if p.iif.Raw() {
-		messageBytes, err := message.Pack()
+	var responseMessage *mDNS.Msg
+	var group task.Group
+	group.Append0(func(ctx context.Context) error {
+		err = p.iif.Exchange(response, messageBytes)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		var responseMessage *mDNS.Msg
-		var group task.Group
-		group.Append0(func(ctx context.Context) error {
-			err = p.iif.Exchange(response, messageBytes)
-			if err != nil {
-				return err
-			}
-			if response.error != nil {
-				return response.error
-			}
-			responseMessage = &response.message
-			return nil
-		})
-		err = group.Run(ctx)
-		if err != nil {
-			return nil, err
+		if response.error != nil {
+			return response.error
 		}
-		return responseMessage, nil
-	} else {
-		question := message.Question[0]
-		var network string
-		switch question.Qtype {
-		case mDNS.TypeA:
-			network = "ip4"
-		case mDNS.TypeAAAA:
-			network = "ip6"
-		default:
-			return nil, E.New("only IP queries are supported by current version of Android")
-		}
-		var responseAddrs []netip.Addr
-		var group task.Group
-		group.Append0(func(ctx context.Context) error {
-			err := p.iif.Lookup(response, network, question.Name)
-			if err != nil {
-				return err
-			}
-			if response.error != nil {
-				return response.error
-			}
-			responseAddrs = response.addresses
-			return nil
-		})
-		err := group.Run(ctx)
-		if err != nil {
-			return nil, err
-		}
-		return dns.FixedResponse(message.Id, question, responseAddrs, C.DefaultDNSTTL), nil
+		responseMessage = &response.message
+		return nil
+	})
+	err = group.Run(ctx)
+	if err != nil {
+		return nil, err
 	}
+	return responseMessage, nil
+}
+
+func (p *platformLocalDNSTransport) Lookup(ctx context.Context, domain string, strategy dns.DomainStrategy) ([]netip.Addr, error) {
+	var network string
+	switch strategy {
+	case dns.DomainStrategyUseIPv4:
+		network = "ip4"
+	case dns.DomainStrategyPreferIPv6:
+		network = "ip6"
+	default:
+		network = "ip"
+	}
+	response := &ExchangeContext{
+		context: ctx,
+	}
+	var responseAddr []netip.Addr
+	var group task.Group
+	group.Append0(func(ctx context.Context) error {
+		err := p.iif.Lookup(response, network, domain)
+		if err != nil {
+			return err
+		}
+		if response.error != nil {
+			return response.error
+		}
+		switch strategy {
+		case dns.DomainStrategyUseIPv4:
+			responseAddr = common.Filter(response.addresses, func(it netip.Addr) bool {
+				return it.Is4()
+			})
+		case dns.DomainStrategyPreferIPv6:
+			responseAddr = common.Filter(response.addresses, func(it netip.Addr) bool {
+				return it.Is6()
+			})
+		default:
+			responseAddr = response.addresses
+		}
+		/*if len(responseAddr) == 0 {
+			response.error = dns.RCodeSuccess
+		}*/
+		return nil
+	})
+	err := group.Run(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return responseAddr, nil
 }

 type Func interface {
--- a/experimental/libbox/monitor.go
+++ b/experimental/libbox/monitor.go
@@ -1,6 +1,7 @@
 package libbox

 import (
+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common/control"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -55,7 +56,7 @@ func (m *platformDefaultInterfaceMonitor) UnregisterCallback(element *list.Eleme
 }

 func (m *platformDefaultInterfaceMonitor) UpdateDefaultInterface(interfaceName string, interfaceIndex32 int32, isExpensive bool, isConstrained bool) {
-	if sFixAndroidStack {
+	if C.FixAndroidStack {
 		go m.updateDefaultInterface(interfaceName, interfaceIndex32, isExpensive, isConstrained)
 	} else {
 		m.updateDefaultInterface(interfaceName, interfaceIndex32, isExpensive, isConstrained)
--- a/experimental/libbox/platform.go
+++ b/experimental/libbox/platform.go
@@ -6,11 +6,9 @@ import (
 )

 type PlatformInterface interface {
-	LocalDNSTransport() LocalDNSTransport
 	UsePlatformAutoDetectInterfaceControl() bool
 	AutoDetectInterfaceControl(fd int32) error
 	OpenTun(options TunOptions) (int32, error)
-	UpdateRouteOptions(options TunOptions) error
 	WriteLog(message string)
 	UseProcFS() bool
 	FindConnectionOwner(ipProtocol int32, sourceAddress string, sourcePort int32, destinationAddress string, destinationPort int32) (int32, error)
--- a/experimental/libbox/platform/interface.go
+++ b/experimental/libbox/platform/interface.go
@@ -13,7 +13,6 @@ type Interface interface {
 	UsePlatformAutoDetectInterfaceControl() bool
 	AutoDetectInterfaceControl(fd int) error
 	OpenTun(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error)
-	UpdateRouteOptions(options *tun.Options, platformOptions option.TunPlatformOptions) error
 	CreateDefaultInterfaceMonitor(logger logger.Logger) tun.DefaultInterfaceMonitor
 	Interfaces() ([]adapter.NetworkInterface, error)
 	UnderNetworkExtension() bool
--- a/experimental/libbox/service.go
+++ b/experimental/libbox/service.go
@@ -18,6 +18,7 @@ import (
 	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/experimental/libbox/internal/procfs"
 	"github.com/sagernet/sing-box/experimental/libbox/platform"
+	"github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing-tun"
@@ -43,7 +44,7 @@ type BoxService struct {
 }

 func NewService(configContent string, platformInterface PlatformInterface) (*BoxService, error) {
-	ctx := BaseContext(platformInterface)
+	ctx := box.Context(context.Background(), include.InboundRegistry(), include.OutboundRegistry(), include.EndpointRegistry())
 	ctx = filemanager.WithDefault(ctx, sWorkingPath, sTempPath, sUserID, sGroupID)
 	service.MustRegister[deprecated.Manager](ctx, new(deprecatedManager))
 	options, err := parseConfig(ctx, configContent)
@@ -80,7 +81,7 @@ func NewService(configContent string, platformInterface PlatformInterface) (*Box
 }

 func (s *BoxService) Start() error {
-	if sFixAndroidStack {
+	if C.FixAndroidStack {
 		var err error
 		done := make(chan struct{})
 		go func() {
@@ -147,10 +148,10 @@ func (w *platformInterfaceWrapper) AutoDetectInterfaceControl(fd int) error {

 func (w *platformInterfaceWrapper) OpenTun(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error) {
 	if len(options.IncludeUID) > 0 || len(options.ExcludeUID) > 0 {
-		return nil, E.New("platform: unsupported uid options")
+		return nil, E.New("android: unsupported uid options")
 	}
 	if len(options.IncludeAndroidUser) > 0 {
-		return nil, E.New("platform: unsupported android_user option")
+		return nil, E.New("android: unsupported android_user option")
 	}
 	routeRanges, err := options.BuildAutoRouteRanges(true)
 	if err != nil {
@@ -173,20 +174,6 @@ func (w *platformInterfaceWrapper) OpenTun(options *tun.Options, platformOptions
 	return tun.New(*options)
 }

-func (w *platformInterfaceWrapper) UpdateRouteOptions(options *tun.Options, platformOptions option.TunPlatformOptions) error {
-	if len(options.IncludeUID) > 0 || len(options.ExcludeUID) > 0 {
-		return E.New("android: unsupported uid options")
-	}
-	if len(options.IncludeAndroidUser) > 0 {
-		return E.New("android: unsupported android_user option")
-	}
-	routeRanges, err := options.BuildAutoRouteRanges(true)
-	if err != nil {
-		return err
-	}
-	return w.iif.UpdateRouteOptions(&tunOptions{options, routeRanges, platformOptions})
-}
-
 func (w *platformInterfaceWrapper) CreateDefaultInterfaceMonitor(logger logger.Logger) tun.DefaultInterfaceMonitor {
 	return &platformDefaultInterfaceMonitor{
 		platformInterfaceWrapper: w,
@@ -205,9 +192,6 @@ func (w *platformInterfaceWrapper) Interfaces() ([]adapter.NetworkInterface, err
 			continue
 		}
 		w.defaultInterfaceAccess.Lock()
-		// (GOOS=windows) SA4006: this value of `isDefault` is never used
-		// Why not used?
-		//nolint:staticcheck
 		isDefault := w.defaultInterface != nil && int(netInterface.Index) == w.defaultInterface.Index
 		w.defaultInterfaceAccess.Unlock()
 		interfaces = append(interfaces, adapter.NetworkInterface{
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
世界	658d4a180b	Use stdlib ech	2024-12-11 19:33:53 +08:00
世界	93966bdd36	documentation: Bump version	2024-12-10 21:38:13 +08:00
世界	14a4b0f922	Fix socks5 UDP implementation	2024-12-10 21:38:04 +08:00
世界	919b08e64c	clash-api: Fix missing endpoints	2024-12-10 21:37:36 +08:00
世界	bdd2472065	hysteria2: Add more masquerade options	2024-12-10 21:37:36 +08:00
世界	705c23866a	Improve timeouts	2024-12-10 21:37:36 +08:00
世界	ec310170cc	Add UDP timeout route option	2024-12-10 21:37:35 +08:00
世界	7405b22dc8	Make GSO adaptive	2024-12-10 21:37:35 +08:00
世界	cd2cf2450e	Fix tests	2024-12-10 21:37:35 +08:00
世界	a525f139dc	Fix lint	2024-12-10 21:37:34 +08:00
世界	cc8ba050dd	refactor: WireGuard endpoint	2024-12-10 21:37:34 +08:00
世界	987556fd3d	refactor: connection manager	2024-12-10 21:37:33 +08:00
世界	e6dd7d279d	documentation: Fix typo	2024-12-10 21:37:32 +08:00
世界	b1cbf141c7	Add override destination to route options	2024-12-10 21:37:32 +08:00
世界	ab616d8510	Add `dns.cache_capacity`	2024-12-10 21:37:32 +08:00
世界	097818dfef	Refactor multi networks strategy	2024-12-10 21:37:31 +08:00
世界	47af425e45	documentation: Remove unused titles	2024-12-10 21:37:31 +08:00
世界	5d49685683	Add multi network dialing	2024-12-10 21:37:30 +08:00
世界	15624a648c	documentation: Merge route options to route actions	2024-12-10 21:37:30 +08:00
世界	1bfedf5332	Add `network_[type/is_expensive/is_constrained]` rule items	2024-12-10 21:37:30 +08:00
世界	10d15259b6	Merge route options to route actions	2024-12-10 21:37:29 +08:00
世界	ee11ca4935	refactor: Platform Interfaces	2024-12-10 21:37:28 +08:00
世界	e83331c2d9	refactor: Extract services form router	2024-12-10 21:37:28 +08:00
世界	b74df53a9c	refactor: Modular network manager	2024-12-10 21:37:27 +08:00
世界	f64107f040	refactor: Modular inbound/outbound manager	2024-12-10 21:37:26 +08:00
世界	7db0e712b6	documentation: Add rule action	2024-12-10 21:37:26 +08:00
世界	edfdf1d4f3	documentation: Update the scheduled removal time of deprecated features	2024-12-10 21:37:25 +08:00
世界	eb3023d66c	documentation: Remove outdated icons	2024-12-10 21:37:25 +08:00
世界	2c39c4d19c	Migrate bad options to library	2024-12-10 21:37:25 +08:00
世界	aa3fcefb72	Implement udp connect	2024-12-10 21:37:25 +08:00
世界	ce503fd682	Implement new deprecated warnings	2024-12-10 21:37:24 +08:00
世界	017fa5e298	Improve rule actions	2024-12-10 21:37:23 +08:00
世界	94d187397d	Remove unused reject methods	2024-12-10 21:37:23 +08:00
世界	1d497b08d7	refactor: Modular inbounds/outbounds	2024-12-10 21:37:23 +08:00
世界	e52ab781bb	Implement dns-hijack	2024-12-10 21:37:23 +08:00
世界	2c1e398c78	Implement resolve(server)	2024-12-10 21:37:22 +08:00
世界	d4ad7ff638	Implement TCP and ICMP rejects	2024-12-10 21:37:22 +08:00
世界	ee0f3ba739	Crazy sekai overturns the small pond	2024-12-10 21:37:01 +08:00
世界	b365b1369d	Fix play release	2024-12-10 20:44:08 +08:00
世界	69f8d7fa72	Add workaround for `bulkBarrierPreWrite: unaligned arguments` panic	2024-12-10 20:36:32 +08:00
世界	746f63a9ac	Update debug iOS library build	2024-12-10 20:36:32 +08:00