DNS Tunneling on Documentation

DNSTT

Mon, 01 Jan 0001 00:00:00 +0000

DNSTT Configuration#

DNSTT uses the vaydns library with DNSTT-compatible framing (DNS-over-TXT with legacy framing). The tunnel stack is: DNS packet channel → KCP → Noise encryption → smux multiplexing.

Connection Settings#

Field	Default	Range	Description
`Domain`	(required)	valid domain	Zone delegated to your DNSTT server
`PubKey`	(required)	64 hex chars	Server public key
`ResolverType`	`"udp"`	`udp`, `tcp`, `dot`	Transport to resolver
`ResolverPort`	`53`	> 0	Resolver port
`Fingerprint`	`"Chrome"`	see below	uTLS ClientHello fingerprint
`RPS`	`0`	0-500	Rate limit (queries/sec); 0 = unlimited

Proxy and Authentication#

Field	Default	Description
`ProxyType`	`"socks"`	Proxy type: `socks` or `ssh`
`ProxyPort`	`1080`	Proxy port
`AuthMethod`	`"none"`	Auth: `none`, `password`, or `key`
`Username`	`""`	Required for password/key auth
`Password`	`""`	Required for password auth
`PrivateKey`	`""`	PEM-encoded SSH private key (required for key auth)
`KnownHostsFile`	`""`	Path to SSH known_hosts file (optional, key auth only)

Proxy rules:

VayDNS

Mon, 01 Jan 0001 00:00:00 +0000

VayDNS Configuration#

VayDNS is the native vaydns protocol. It uses the same tunnel stack as DNSTT (DNS → KCP → Noise → smux) but with native framing and additional tuning parameters for QNAME structure, MTU, and record type.

Connection Settings#

Field	Default	Range	Description
`Domain`	(required)	valid domain	Zone delegated to your VayDNS server
`PubKey`	(required)	64 hex chars	Server public key
`ResolverType`	`"udp"`	`udp`, `tcp`, `dot`	Transport to resolver
`ResolverPort`	`53`	> 0	Resolver port
`Fingerprint`	`"Chrome"`	see DNSTT fingerprints	uTLS ClientHello fingerprint
`RecordType`	`"TXT"`	see below	DNS record type for tunnel queries
`RPS`	`0`	0-500	Rate limit (queries/sec); 0 = unlimited

Advanced Settings#

Field	Default	Range	Description
`ClientIDSize`	`2`	1-8	Client ID byte size
`MaxQnameLen`	`101`	0-253	Max QNAME length in DNS packets (0 = auto)
`MaxNumLabels`	`0`	0-4	Max number of labels in QNAME (0 = auto)
`MTU`	`0`	0-1452	Max transmission unit (0 = auto)

DNS Record Types#

Supported RecordType values: A, AAAA, CNAME, NS, MX, TXT, SRV, NULL, CAA.

Slipstream

Mon, 01 Jan 0001 00:00:00 +0000

Slipstream Configuration#

Slipstream runs as an external process (slipstream-client binary), not an in-process Go tunnel. It communicates through a local SOCKS5 port allocated per probe.

Connection Settings#

Field	Default	Range	Description
`Domain`	(required)	valid domain	Zone served by your Slipstream server
`ResolverPort`	`53`	> 0	Resolver port
`CertPath`	`""`	path	Optional TLS certificate (passed as `--cert`)

Proxy and Authentication#

Same fields as DNSTT (see Proxy and Authentication).

Binary Location#

bgscan searches for the slipstream-client binary in the following locations:

MasterDNS

Mon, 01 Jan 0001 00:00:00 +0000

MasterDNS Configuration#

MasterDNS runs in-process through a vendored client library. The tunnel negotiates MTU sizes automatically and protects traffic with a configurable encryption method. There are no proxy settings; the probe dials the resolver directly.

Connection Settings#

Field	Default	Description
`Domain`	(required)	Zone served by your MasterDNS server
`DataEncMethod`	`1`	Encryption: `0` = None, `1` = XOR (default), `2` = ChaCha20, `3` = AES-128-GCM, `4` = AES-192-GCM, `5` = AES-256-GCM
`EncryptionKey`	(required unless method is None)	32 hex characters, must match the server
`ResolverPort`	`53`	Resolver port

MTU and Session Tuning#

Field	Default	Description
`MTUTestTimeoutSec`	`3.0`	Seconds to wait per MTU probe packet
`MTUTestRetries`	`2`	Retries per MTU size before trying the next
`SessionInitRetryMaxSec`	`2.0`	Retry window for session init before restarting
`SessionInitRacingCount`	`1`	Parallel session init attempts
`MinUploadMTU` / `MaxUploadMTU`	`38` / `150`	Upload MTU range in bytes
`MinDownloadMTU` / `MaxDownloadMTU`	`100` / `500`	Download MTU range in bytes
`MTUParallelism`	`1`	Parallel MTU test workers
`RxTxWorkers`	`4`	Concurrent tunnel data streams

Example Config#

domain = 'example.com'
data_enc_method = 1
encryption_key = 'cd6d78e954f48f62cb74cdcf8a2459d3'
resolver_port = 53
mtu_test_timeout_sec = 2.0
mtu_test_retries = 2
session_init_retry_max_sec = 60.0
session_init_racing_count = 3
min_upload_mtu = 38
max_upload_mtu = 150
min_download_mtu = 100
max_download_mtu = 500
mtu_parallelism = 3
rx_tx_workers = 2

DNS Tunneling — Protocol overview and scan flow
StormDNS — Same model with its own defaults and query type selection

StormDNS

Mon, 01 Jan 0001 00:00:00 +0000

StormDNS Configuration#

StormDNS runs in-process through a vendored client library. It works like MasterDNS with its own defaults, plus a selectable DNS query type used to carry the tunnel traffic. There are no proxy settings.

Connection Settings#

Field	Default	Description
`Domain`	(required)	Zone served by your StormDNS server
`DataEncMethod`	`1`	Encryption: `0` = None, `1` = XOR (default), `2` = ChaCha20, `3` = AES-128-GCM, `4` = AES-192-GCM, `5` = AES-256-GCM
`EncryptionKey`	(required unless method is None)	32 hex characters, must match the server
`ResolverPort`	`53`	Resolver port
`DNSQueryType`	`'TXT'`	Query type carrying the tunnel: `TXT`, `NS`, `CNAME`, or `ROTATE` (empty means TXT)

MTU and Session Tuning#

Field	Default	Description
`MTUTestTimeoutSec`	`2.0`	Seconds to wait per MTU probe packet
`MTUTestRetries`	`3`	Retries per MTU size before trying the next
`SessionInitRetryMaxSec`	`60.0`	Retry window for session init before restarting
`MinUploadMTU` / `MaxUploadMTU`	`100` / `200`	Upload MTU range in bytes
`MinDownloadMTU` / `MaxDownloadMTU`	`1000` / `4000`	Download MTU range in bytes
`MTUParallelism`	`16`	Parallel MTU test workers
`RxTxWorkers`	`4`	Concurrent tunnel data streams

Example Config#

domain = 'example.com'
data_enc_method = 1
encryption_key = 'cd6d78e954f48f62cb74cdcf8a2459d3'
resolver_port = 53
dns_query_type = 'TXT'
mtu_test_timeout_sec = 2.0
mtu_test_retries = 3
session_init_retry_max_sec = 60.0
min_upload_mtu = 100
max_upload_mtu = 200
min_download_mtu = 1000
max_download_mtu = 4000
mtu_parallelism = 16
rx_tx_workers = 4

DNS Tunneling — Protocol overview and scan flow
MasterDNS — Same model with its own defaults

TheFeed

Mon, 01 Jan 0001 00:00:00 +0000

TheFeed Configuration#

TheFeed runs in-process through a vendored client library. Queries and responses are encrypted with AES-256 keys derived from a shared passphrase. There are no proxy settings. The probe timeout comes from the global DNS tunnel settings (dns_settings.toml, dns_tunneling.timeout), not from this file.

Connection Settings#

Field	Default	Description
`Domain`	(required)	DNS subdomain that answers feed queries (for example `t.example.com`)
`Passphrase`	(required)	Same passphrase as the server; used to derive the AES-256 keys
`ResolverPort`	`53`	Resolver port (TheFeed servers often use 5300)
`ResolverType`	`'udp'`	Transport: `udp`, `tcp`, or `dot`
`QueryMode`	`'single'`	Query encoding: `single` (one base32 label) or `double` (multi-label hex)

Example Config#

domain = 't.example.com'
passphrase = 'your-passphrase'
resolver_port = 53
resolver_type = 'udp'
query_mode = 'single'

DNS Tunneling — Protocol overview and scan flow
DNS Settings — Global tunnel timeout and resolver pre-scan

DNS Tunneling on Documentation

DNSTT

DNSTT Configuration#

Connection Settings#

Proxy and Authentication#

VayDNS

VayDNS Configuration#

Connection Settings#

Advanced Settings#

DNS Record Types#

Slipstream

Slipstream Configuration#

Connection Settings#

Proxy and Authentication#

Binary Location#

MasterDNS

MasterDNS Configuration#

Connection Settings#

MTU and Session Tuning#

Example Config#

Related Topics#

StormDNS

StormDNS Configuration#

Connection Settings#

MTU and Session Tuning#

Example Config#

Related Topics#

TheFeed

TheFeed Configuration#

Connection Settings#

Example Config#

Related Topics#