Core Concepts: Public DNS, Encrypted DNS (DoH/DoT) & FakeIP
DNS (Domain Name System) translates domain names like claude.ai into routable IP addresses before any TCP/TLS connection begins. Public DNS resolvers are open recursive services operated by global providers as reliable alternatives to local ISP resolvers.
In proxy and cross-border environments, three mechanisms matter: (1) DNS Leak—when queries meant for the remote proxy leak out of your local ISP interface; (2) Encrypted DNS (DoH / DoT)—sending DNS over HTTPS (RFC 8484) or TLS to prevent plaintext UDP port 53 hijacking; and (3) FakeIP (198.18.0.0/15)—returning an instant placeholder IP locally so the proxy tunnel forwards the raw domain name for remote resolution.
International Public DNS Reference (Verify on Your Network)
These endpoints and settings are references, not claims of connectivity testing from every region or network. Verify resolution and connection paths on the device that runs the application, recording timestamps and errors. A working setting does not establish the absence of DNS leaks.
| Provider | IPv4 Address | IPv6 Address | DoH (HTTPS) / DoT Endpoint | Characteristics & Use Case |
|---|---|---|---|---|
| Cloudflare DNS | 1.1.1.11.0.0.1 | 2606:4700:4700::11112606:4700:4700::1001 | https://cloudflare-dns.com/dns-queryDoT: one.one.one.one | Does not forward EDNS Client Subnet (No ECS); strong privacy and fast global Anycast—ideal as default remote proxy DNS |
| Google Public DNS | 8.8.8.88.8.4.4 | 2001:4860:4860::88882001:4860:4860::8844 | https://dns.google/dns-queryJSON: https://dns.google/resolve · DoT: dns.google | Broad global coverage with EDNS Client Subnet (ECS) support for accurate CDN edge routing |
| Quad9 DNS | 9.9.9.9149.112.112.112 | 2620:fe::fe2620:fe::9 | https://dns.quad9.net/dns-queryDoT: dns.quad9.net | Swiss non-profit cybersecurity foundation; blocks known phishing/malware domains and never logs personal IPs |
| Cisco OpenDNS | 208.67.222.222208.67.220.220 | 2620:119:35::352620:119:53::53 | https://doh.opendns.com/dns-queryDoT: dns.opendns.com | Established enterprise recursive resolver (Cisco) with stable North American and European backbone peering |
| AdGuard DNS | 94.140.14.1494.140.15.15 | 2a10:50c0::ad1:ff2a10:50c0::ad2:ff | https://dns.adguard-dns.com/dns-queryDoT: dns.adguard-dns.com | Supports ad/tracker filtering; use the unfiltered standard endpoint when troubleshooting OAuth or auth redirects |
Domestic Public DNS Reference (Verify on Your Network)
Domestic public DNS resolvers are ideal for direct domestic traffic (e.g., direct-nameserver or CN nameserver-policy in Clash/Mihomo/sing-box) for optimal domestic CDN routing. Never use domestic DNS resolvers to resolve Claude or Anthropic domains directly:
| Provider | IPv4 Address | IPv6 Address | Encrypted DoH / DoT Endpoint | Verification Status & Notes |
|---|---|---|---|---|
| Alibaba Public DNS (AliDNS) | 223.5.5.5223.6.6.6 | 2400:3200::12400:3200:baba::1 | https://dns.alidns.com/dns-queryJSON: https://dns.alidns.com/resolve · DoT: dns.alidns.com | Verified working on both UDP 53 and HTTPS DoH (HTTP 200) with full domestic IPv4/IPv6 dual-stack support |
| Tencent DNSPod Public DNS+ | 119.29.29.29 | 2402:4e00:: | https://doh.pub/dns-queryDoT: dot.pub | Verified working on UDP 53 and DoH; supports ECS for accurate domestic CDN scheduling |
| 114DNS | 114.114.114.114114.114.115.115 | No general public IPv6 | No public DoH / DoT | Plaintext UDP/TCP 53 only; lacks DoH/DoT encryption and is vulnerable to ISP transparent hijacking—use only as fallback |
Why Do DNS Leaks Happen Even With a Proxy Enabled?
The most common cause of DNS leaks is fallback local resolution inside proxy rule engines: when a domain is not matched by top-level DOMAIN-SUFFIX rules and reaches a GEOIP or IP-CIDR rule without no-resolve, the proxy client resolves the domain locally to check its IP country—leaking the query on your local network.
Additionally, browser QUIC (HTTP/3 over UDP 443) or custom browser DoH settings that bypass the proxy tunnel can send DNS requests outside your proxy route.
4-Step Best Practices to Prevent DNS Leaks and Hijacking
1. Prefer TUN Virtual Adapter + FakeIP Mode: Let local applications connect to 198.18.x.x placeholder IPs so raw domain names are resolved remotely by the proxy exit.
2. Domain-First Rules + no-resolve on IP Rules: Place claude.ai, anthropic.com, claude.com, and claudeusercontent.com DOMAIN-SUFFIX rules at the top, and append no-resolve to all fallback IP-CIDR and GEOIP rules.
3. Separate Domestic and Remote Resolvers (nameserver-policy): Route domestic direct domains to AliDNS (223.5.5.5 DoH) or DNSPod (doh.pub), and route overseas/Claude domains through the proxy tunnel to Cloudflare (1.1.1.1 DoH) or Google (8.8.8.8 DoH).
4. Verify DNS Resolution Locally: Run Resolve-DnsName -Name claude.ai -Server 1.1.1.1 in PowerShell or query https://cloudflare-dns.com/dns-query?name=claude.ai&type=A via DoH to verify clean public IP responses.
Common Real-World Scenario
For example, manually setting 8.8.8.8 on a local adapter still sends plaintext UDP 53 queries that can be transparently intercepted. Switching to DoH inside the proxy tunnel with TUN + FakeIP and no-resolve eliminates plaintext leaks.
References & Freshness
The above is independent diagnostic guidance with no access to Anthropic internal risk controls. Policies, UIs, and support workflows may change—always verify against official effective dates and your account portal.