dns_conf: add bootstrap-dns option for server.

ReadMe.md

@@ -603,10 +603,10 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
 | audit-num | 审计归档个数 | 2 | 大于等于 0 的数字 | audit-num 2 |
 | audit-file-mode | 审计归档文件权限 | 0640 | 文件权限 | log-file-mode 644 |
 | conf-file | 附加配置文件 | 无 | 合法路径字符串 | conf-file /etc/smartdns/smartdns.more.conf |
-| server | 上游 UDP DNS | 无 | 可重复。<br />[ip][:port]\|URL：服务器 IP:端口（可选）或 URL <br />[-blacklist-ip]：配置 IP 过滤结果。<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server 8.8.8.8:53 -blacklist-ip -group g1 -proxy proxy<br /> server tls://8.8.8.8|
-| server-tcp | 上游 TCP DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选）<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tcp 8.8.8.8:53 |
-| server-tls | 上游 TLS DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选)<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-tls 8.8.8.8:853 |
-| server-https | 上游 HTTPS DNS | 无 | 可重复。<br /><https://[host>][:port]/path：服务器 IP:端口（可选）<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称<br />[-http-host]：http 协议头主机名<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 | server-https <https://cloudflare-dns.com/dns-query> |
+| server | 上游 UDP DNS | 无 | 可重复。<br />[ip][:port]\|URL：服务器 IP:端口（可选）或 URL <br />[-blacklist-ip]：配置 IP 过滤结果。<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 <br />[-bootstrap-dns]：标记此服务器为bootstrap服务器。| server 8.8.8.8:53 -blacklist-ip -group g1 -proxy proxy<br /> server tls://8.8.8.8|
+| server-tcp | 上游 TCP DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选）<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 <br />[-bootstrap-dns]：标记此服务器为bootstrap服务器。| server-tcp 8.8.8.8:53 |
+| server-tls | 上游 TLS DNS | 无 | 可重复。<br />[ip][:port]：服务器 IP:端口（可选)<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 <br />[-bootstrap-dns]：标记此服务器为bootstrap服务器。| server-tls 8.8.8.8:853 |
+| server-https | 上游 HTTPS DNS | 无 | 可重复。<br /><https://[host>][:port]/path：服务器 IP:端口（可选）<br />[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br />[-host-name]：TLS SNI 名称<br />[-http-host]：http 协议头主机名<br />[-tls-host-verify]：TLS 证书主机名校验<br /> [-no-check-certificate]：跳过证书校验<br />[-blacklist-ip]：配置 IP 过滤结果<br />[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br />[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br />[-exclude-default-group]：将 DNS 服务器从默认组中排除。<br />[-set-mark]：设置数据包标记so-mark。<br />[-proxy name]：设置代理服务器。 <br />[-bootstrap-dns]：标记此服务器为bootstrap服务器。| server-https <https://cloudflare-dns.com/dns-query> |
 | proxy-server | 代理服务器 | 无 | 可重复。<br />proxy-server URL <br />[URL]: [socks5\|http]://[username:password@]host:port<br />[-name]: 代理服务器名称。 |proxy-server socks5://user:[email protected]:1080 -name proxy|
 | speed-check-mode | 测速模式选择 | 无 | [ping\|tcp:[80]\|none] | speed-check-mode ping,tcp:80,tcp:443 |
 | response-mode | 首次查询响应模式 | first-ping |模式：[first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: 最快ping响应地址模式，DNS上游最快查询时延+ping时延最短，查询等待与链接体验最佳;<br />[fastest-ip]: 最快IP地址模式，查询到的所有IP地址中ping最短的IP。需等待IP测速; <br />[fastest-response]: 最快响应的DNS结果，DNS查询等待时间最短，返回的IP地址可能不是最快。| response-mode first-ping |
@@ -769,6 +769,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
    ```
 
 1. DoT 的 SPKI 如何获取？
+
     SPKI 可以通过 DNS 服务商发布的页面获取，如果没有发布，可以通过如下命令获取，其中将对应IP地址更换为要获取 SPKI 的 IP 地址。
 
     ```shell
@@ -776,6 +777,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
     ```
 
 1. iOS系统解析缓慢问题怎么解决？  
+
     IOS14开始，苹果支持了DNS HTTPS(TYPE65)记录的解析，此功能用于快速DNS查询和解决HTTPS链接相关的问题，但当前还是草案，另外会导致广告屏蔽等功能失效，建议通过如下配置关闭TYPE65记录查询。
 
     ```shell
@@ -783,6 +785,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
     ```
 
 1. 如何解析本地主机名称？  
+
     smartdns可以配合DNSMASQ的dhcp lease文件支持本地主机名->IP地址的解析，可以配置smartdns读取dnsmasq的lease文件，并支持解析。具体配置参数如下，（注意，DNSMASQ lease文件每个系统可能不一样，需要按实际情况配置）
 
     ```shell
@@ -794,6 +797,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
     - Windows系统默认使用mDNS解析地址，如需要在windows下用使用smartdns解析，则需要在主机名后面增加`.`，表示使用DNS解析。如`ping smartdns.`
 
 1. 域名集合如何使用？  
+
     为方便按集合配置域名，对于有/domain/的配置，可以指定域名集合，方便维护。具体方法为：
 
     - 使用`domain-set`配置集合文件，如
@@ -819,6 +823,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
     ```
 
 1. 如何使用ipset和nftset  
+
     和Dnsmasq类似，smartdns支持ipset和nftset，可以将特定的域名通过TPROXY进行透明转发，透明转发涉工具模式对比如下：
 
     1. 工具：iptable，nftable
@@ -834,7 +839,7 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
 
     1. 配置REDIRECT或TPROXY转发规则
 
-        - 在smartdns.conf中设置需要透明转发的域名列表，比如要将`example.com`进行透明转发。则使用ipset选项，设置`example.com`的ipset规则为`proxy`。
+        在smartdns.conf中设置需要透明转发的域名列表，比如要将`example.com`进行透明转发。则使用ipset选项，设置`example.com`的ipset规则为`proxy`。
 
         ```shell
         # 设置规则
@@ -903,6 +908,29 @@ entware|ipkg update<br />ipkg install smartdns|软件源路径：<https://bin.en
 
     如果使用openwrt的luci界面，可以直接在界面配置相关的域名分流规则。
 
+1. BootStrap DNS  
+
+    对于域名类的上游服务器，SmartDNS会使用其他IP地址类的服务器进行解析，所以一般情况下无需配置BootStrap DNS，但如果有特殊需求，需要指定BootStrap DNS。则可以通过如下方式配置：
+    
+    1. nameserver指定上游服务器  
+    
+        使用nameserver参数指定特定域名使用指定DNS解析。
+        
+        ```
+        server dns.server # 此服务器将使用1.2.3.4解析。
+        server 1.2.3.4 -group bootstrap
+        nameserver /dns.server/bootstrap
+        ```
+
+    1. 对所有服务器指定bootstrap DNS。  
+
+        使用`-bootstrap-dns`参数，指定特定的server为bootstrap DNS。  
+
+        ```
+        server 1.2.3.4 -bootstrap-dns
+        server dns.server
+        ```
+
 1. 更多问题  
     如有更多问题，请查阅或提交issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)
 

ReadMe_en.md

@@ -567,10 +567,10 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |audit-num|archived audit log number|2|Integer, 0 means turn off the log|audit-num 2
 |audit-file-mode|archived audit log file mode|0640|Integer|audit-file-mode 644
 |conf-file|additional conf file|None|File path|conf-file /etc/smartdns/smartdns.more.conf
-|server|Upstream UDP DNS server|None|Repeatable <br />`[ip][:port]\|URL`: Server IP, port optional OR URL. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group. <br />`[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server| server 8.8.8.8:53 -blacklist-ip<br />server tls://8.8.8.8
-|server-tcp|Upstream TCP DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br />`[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server| server-tcp 8.8.8.8:53
-|server-tls|Upstream TLS DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name. `-` to disable SNI name.<br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server| server-tls 8.8.8.8:853
-|server-https|Upstream HTTPS DNS server|None|Repeatable <br />`https://[host][:port]/path`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name<br />`[-http-host]`: http header host. <br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server| server-https <https://cloudflare-dns.com/dns-query>
+|server|Upstream UDP DNS server|None|Repeatable <br />`[ip][:port]\|URL`: Server IP, port optional OR URL. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group. <br />`[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server <br /> `[-bootstrap-dns]`: set as bootstrap dns server | server 8.8.8.8:53 -blacklist-ip<br />server tls://8.8.8.8
+|server-tcp|Upstream TCP DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br />`[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server <br /> `[-bootstrap-dns]`: set as bootstrap dns server | server-tcp 8.8.8.8:53
+|server-tls|Upstream TLS DNS server|None|Repeatable <br />`[ip][:port]`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name. `-` to disable SNI name.<br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server <br /> `[-bootstrap-dns]`: set as bootstrap dns server | server-tls 8.8.8.8:853
+|server-https|Upstream HTTPS DNS server|None|Repeatable <br />`https://[host][:port]/path`: Server IP, port optional. <br />`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br />`[-host-name]`:TLS Server name<br />`[-http-host]`: http header host. <br />`[-tls-host-verify]`: TLS cert hostname to verify. <br />`-no-check-certificate:`: No check certificate. <br />`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br />`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br />`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br />`[-exclude-default-group]`: Exclude DNS servers from the default group <br /> `[-set-mark mark]`: set mark on packets <br /> `[-proxy name]`: set proxy server <br /> `[-bootstrap-dns]`: set as bootstrap dns server | server-https <https://cloudflare-dns.com/dns-query>
 |proxy-server| proxy server | None | Repeatable. <br />`proxy-server URL` <br />[URL]: `[socks5\|http]://[username:password@]host:port`<br />[-name]:  proxy server name. |proxy-server socks5://user:[email protected]:1080 -name proxy|
 |speed-check-mode|Speed ​​mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:80,tcp:443
 |response-mode|First query response mode|first-ping|Mode: [first-ping\|fastest-ip\|fastest-response]<br /> [first-ping]: The fastest dns + ping response mode, DNS query delay + ping delay is the shortest;<br />[fastest-ip]: The fastest IP address mode, return the fastest ip address, may take some time to test speed. <br />[fastest-response]: The fastest response DNS result mode, the DNS query waiting time is the shortest. | response-mode first-ping |
@@ -609,6 +609,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 ## FAQ
 
 1. What is the difference between SmartDNS and DNSMASQ?  
+
     Smartdns is not designed to replace DNSMASQ. The main function of Smartdns is focused on DNS resolution enhancement, the difference are:  
     - Multiple upstream server concurrent requests, after the results are measured, return the best results;
     - `address`, `ipset` domain name matching uses efficient algorithms, query matching is faster and more efficient, and router devices are still efficient.
@@ -627,6 +628,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     - The second DNS supports customizing more behavior.
 
 1. What is the best practices for upstream server configuration?  
+
     Smartdns has a speed measurement mechanism. When configuring an upstream server, it is recommended to configure multiple upstream DNS servers, including servers in different regions, but the total number is recommended to be around 10. Recommended configuration
     - Carrier DNS.
     - Public DNS, such as `8.8.8.8`, `8.8.4.4`, `1.1.1.1`.
@@ -634,15 +636,18 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     For specific domain names, if there is a pollution, you can enable the anti-pollution mechanism.
 
 1. How to enable the audit log  
+
     The audit log records the domain name requested by the client. The record information includes the request time, the request IP address, the request domain name, and the request type. If you want to enable the audit log, configure `audit-enable yes` in the configuration file, `audit-size`, `Audit-file`, `audit-num` configure the audit log file size, the audit log file path, and the number of audit log files. The audit log file will be compressed to save space.
 
 1. How to avoid DNS privacy leaks  
+
     By default, smartdns will send requests to all configured DNS servers. If the upstream DNS servers record DNS logs, it will result in a DNS privacy leak. To avoid privacy leaks, try the following steps:
     - Use trusted DNS servers.
     - Use TLS servers.
     - Set up an upstream DNS server group.
 
 1. How to block ads  
+
     Smartdns has a high-performance domain name matching algorithm. It is very efficient to filter advertisements by domain name. To block ads, you only need to configure records like the following configure. For example, if you block `*.ad.com`, configure as follows:
 
     ```shell
@@ -656,6 +661,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ```
 
 1. DNS query diversion  
+
     In some cases, some domain names need to be queried using a specific DNS server to do DNS diversion. such as.
 
     ```shell
@@ -687,9 +693,11 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ```
 
 1. How to use the IPV4, IPV6 dual stack IP optimization feature  
+
     At present, IPV6 network is not as fast as IPV4 in some cases. In order to get a better experience in the dual-stack network, SmartDNS provides a dual-stack IP optimization mechanism, the same domain name, and the speed of IPV4. Far faster than IPV6, then SmartDNS will block the resolution of IPV6, let the PC use IPV4, the feature is enabled by `dualstack-ip-selection yes`, `dualstack-ip-selection-threshold [time]` is for threshold. if you want to disable IPV6 AAAA record complete, please try `force-AAAA-SOA yes`.
 
 1. How to improve cache performance  
+
     Smartdns provides a domain name caching mechanism to cache the queried domain name, and the caching time is in accordance with the DNS TTL specification. To increase the cache hit rate, the following configuration can be taken:
     - Increase the number of cache records appropriately  
     Set the number of cache records by `cache-size`.
@@ -708,6 +716,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     This feature will return TTL = 0 to the client after the TTL timeout, and send a new query request again at the same time, and cache the new results for later query.
 
 1. How does the second DNS customize more behavior?  
+
     The second DNS can be used as the upstream of other DNS servers to provide more query behaviors. Bind configuration support can bind multiple ports. Different ports can be set with different flags to implement different functions, such as
 
     ```shell
@@ -716,6 +725,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ```
 
 1. How to get SPKI of DOT  
+
     The SPKI can be obtained from the page published by the DNS service provider. If it is not published, it can be obtained by the following command, replace IP with your own IP.
 
     ```shell
@@ -723,6 +733,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ```
 
 1. How to solve the problem of slow DNS resolution in iOS system?
+
     Since iOS14, Apple has supported the resolution of DNS HTTPS (TYPE65) records. This function is used for solving problems related to HTTPS connections, but it is still a draft, and it will cause some functions such as adblocking fail. It is recommended to disable it through the following configuration.
 
     ```shell
@@ -730,6 +741,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ```
 
 1. How to resolve localhost ip by hostname?  
+
     smartdns can cooperate with the dhcp server of DNSMASQ to support the resolution of local host name to IP address. You can configure smartdns to read the lease file of dnsmasq and support the resolution. The specific configuration parameters are as follows, (note that the DNSMASQ lease file may be different for each system and needs to be configured according to the actual situation)
 
     ```shell
@@ -741,6 +753,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     - Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`
 
 1. How to use the domain set?  
+
     To facilitate configuring domain names by set, for configurations with /domain/, you can specify a domain name set for easy maintenance. The specific method is:
 
     - Use `domain-set` configuration domain set file:
@@ -766,6 +779,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     ````
 
 1. How to use ipset and nftset?  
+
     Similar to Dnsmasq, smartdns supports ipset and nftset, and can transparently forward specific domain names through TPROXY. The comparison of transparent forwarding and tool modes is as follows:
 
     1. Tools: iptable, nftable
@@ -801,6 +815,29 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 
     - Open the forwarding program of REDIRECT mode on port 1081 of this machine.
 
+1. Bootstrap DNS  
+
+    For upstream servers with domain name, smartdns will use servers with IP address types for resolution, so there is no need to configure bootstrap DNS, but if there are special needs, you can specify bootstrap DNS . The steps are as follows:
+    
+    1. nameserver server upstream server  
+    
+        use nameserver set upstream server for domain name  
+        
+        ```
+        server dns.server # this domain name will be resolved by 1.2.3.4
+        server 1.2.3.4 -group bootstrap-dns
+        nameserver /dns.server/bootstrap-dns
+        ```
+
+    1. Set bootstrap DNS server  
+
+        use `-bootstrap-dns` option to set server as bootstrap DNS.
+
+        ```
+        server 1.2.3.4 -bootstrap-dns
+        server dns.server
+        ```
+    
 1. More questions  
     More questions, please read issue: [https://github.com/pymumu/smartdns/issues](https://github.com/pymumu/smartdns/issues)
 

etc/smartdns/smartdns.conf

@@ -50,7 +50,11 @@
 #    bind [::]:53
 #    bind [::]:53@eth0
 #    bind-tcp [::]:53
-bind [::]:53
+bind [::]:7053
+
+server 192.168.1.1:6053 -bootstrap-dns
+server dns.google 
+server 192.168.1.1:6053
 
 # tcp connection idle timeout
 # tcp-idle-time [second]
@@ -144,7 +148,7 @@ force-qtype-SOA 65
 # log-file: file path of log file.
 # log-size: size of each log file, support k,m,g
 # log-num: number of logs, 0 means disable log
-log-level info
+log-level debug
 
 # log-file /var/log/smartdns/smartdns.log
 # log-size 128k
@@ -181,6 +185,7 @@ log-level info
 #   -group [group]: set server to group, use with nameserver /domain/group.
 #   -exclude-default-group: exclude this server from default group.
 #   -proxy [proxy-name]: use proxy to connect to server.
+#   -bootstrap-dns: set as bootstrap dns server.
 # server 8.8.8.8 -blacklist-ip -check-edns -group g1 -group g2
 # server tls://dns.google:853 
 # server https://dns.google/dns-query
@@ -197,6 +202,7 @@ log-level info
 #   -host-name: TLS sni hostname.
 #   -no-check-certificate: no check certificate.
 #   -proxy [proxy-name]: use proxy to connect to server.
+#   -bootstrap-dns: set as bootstrap dns server.
 # Get SPKI with this command:
 #    echo | openssl s_client -connect '[ip]:853' | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
 # default port is 853
@@ -211,6 +217,7 @@ log-level info
 #   -http-host: http host.
 #   -no-check-certificate: no check certificate.
 #   -proxy [proxy-name]: use proxy to connect to server.
+#   -bootstrap-dns: set as bootstrap dns server.
 # default port is 443
 # server-https https://cloudflare-dns.com/dns-query
 

src/dns_client.c

@@ -447,7 +447,8 @@ errout:
 }
 
 /* check whether server exists */
-static int _dns_client_server_exist(const char *server_ip, int port, dns_server_type_t server_type, struct client_dns_server_flags *flags)
+static int _dns_client_server_exist(const char *server_ip, int port, dns_server_type_t server_type,
+									struct client_dns_server_flags *flags)
 {
 	struct dns_server_info *server_info = NULL;
 	struct dns_server_info *tmp = NULL;
@@ -458,7 +459,7 @@ static int _dns_client_server_exist(const char *server_ip, int port, dns_server_
 			continue;
 		}
 
-		if (memcmp(&server_info->flags, flags, sizeof(*flags)) == 0) {
+		if (memcmp(&server_info->flags, flags, sizeof(*flags)) != 0) {
 			continue;
 		}
 
@@ -489,7 +490,8 @@ static void _dns_client_server_update_ttl(struct ping_host_struct *ping_host, co
 }
 
 /* get server control block by ip and port, type */
-static struct dns_server_info *_dns_client_get_server(char *server_ip, int port, dns_server_type_t server_type)
+static struct dns_server_info *_dns_client_get_server(char *server_ip, int port, dns_server_type_t server_type,
+													  struct client_dns_server_flags *flags)
 {
 	struct dns_server_info *server_info = NULL;
 	struct dns_server_info *tmp = NULL;
@@ -510,6 +512,10 @@ static struct dns_server_info *_dns_client_get_server(char *server_ip, int port,
 			continue;
 		}
 
+		if (memcmp(&server_info->flags, flags, sizeof(*flags)) != 0) {
+			continue;
+		}
+
 		pthread_mutex_unlock(&client.server_list_lock);
 		server_info_return = server_info;
 		break;
@@ -596,7 +602,7 @@ errout:
 }
 
 static int _dns_client_add_to_pending_group(const char *group_name, char *server_ip, int port,
-											dns_server_type_t server_type)
+											dns_server_type_t server_type, struct client_dns_server_flags *flags)
 {
 	struct dns_server_pending *item = NULL;
 	struct dns_server_pending *tmp = NULL;
@@ -610,6 +616,10 @@ static int _dns_client_add_to_pending_group(const char *group_name, char *server
 	pthread_mutex_lock(&pending_server_mutex);
 	list_for_each_entry_safe(item, tmp, &pending_servers, list)
 	{
+		if (memcmp(&item->flags, flags, sizeof(*flags)) != 0) {
+			continue;
+		}
+
 		if (strncmp(item->host, server_ip, DNS_HOSTNAME_LEN) == 0 && item->port == port && item->type == server_type) {
 			pending = item;
 			break;
@@ -644,7 +654,8 @@ errout:
 
 /* add server to group */
 static int _dns_client_add_to_group_pending(const char *group_name, char *server_ip, int port,
-											dns_server_type_t server_type, int is_pending)
+											dns_server_type_t server_type, struct client_dns_server_flags *flags,
+											int is_pending)
 {
 	struct dns_server_info *server_info = NULL;
 
@@ -652,21 +663,22 @@ static int _dns_client_add_to_group_pending(const char *group_name, char *server
 		return -1;
 	}
 
-	server_info = _dns_client_get_server(server_ip, port, server_type);
+	server_info = _dns_client_get_server(server_ip, port, server_type, flags);
 	if (server_info == NULL) {
 		if (is_pending == 0) {
 			tlog(TLOG_ERROR, "add server %s:%d to group %s failed", server_ip, port, group_name);
 			return -1;
 		}
-		return _dns_client_add_to_pending_group(group_name, server_ip, port, server_type);
+		return _dns_client_add_to_pending_group(group_name, server_ip, port, server_type, flags);
 	}
 
 	return _dns_client_add_to_group(group_name, server_info);
 }
 
-int dns_client_add_to_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type)
+int dns_client_add_to_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type,
+							struct client_dns_server_flags *flags)
 {
-	return _dns_client_add_to_group_pending(group_name, server_ip, port, server_type, 1);
+	return _dns_client_add_to_group_pending(group_name, server_ip, port, server_type, flags, 1);
 }
 
 /* free group member */
@@ -709,12 +721,13 @@ static int _dns_client_remove_server_from_groups(struct dns_server_info *server_
 	return 0;
 }
 
-int dns_client_remove_from_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type)
+int dns_client_remove_from_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type,
+								 struct client_dns_server_flags *flags)
 {
 	struct dns_server_info *server_info = NULL;
 	struct dns_server_group *group = NULL;
 
-	server_info = _dns_client_get_server(server_ip, port, server_type);
+	server_info = _dns_client_get_server(server_ip, port, server_type, flags);
 	if (server_info == NULL) {
 		return -1;
 	}
@@ -3680,7 +3693,8 @@ static int _dns_client_add_pendings(struct dns_server_pending *pending, char *ip
 
 	list_for_each_entry_safe(group, tmp, &pending->group_list, list)
 	{
-		if (_dns_client_add_to_group_pending(group->group_name, ip, pending->port, pending->type, 0) != 0) {
+		if (_dns_client_add_to_group_pending(group->group_name, ip, pending->port, pending->type, &pending->flags, 0) !=
+			0) {
 			tlog(TLOG_WARN, "add server to group failed, skip add.");
 		}
 

src/dns_client.h

@@ -133,9 +133,11 @@ int dns_client_remove_server(char *server_ip, int port, dns_server_type_t server
 
 int dns_client_add_group(const char *group_name);
 
-int dns_client_add_to_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type);
+int dns_client_add_to_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type,
+							struct client_dns_server_flags *flags);
 
-int dns_client_remove_from_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type);
+int dns_client_remove_from_group(const char *group_name, char *server_ip, int port, dns_server_type_t server_type,
+								 struct client_dns_server_flags *flags);
 
 int dns_client_remove_group(const char *group_name);
 

src/dns_conf.c

@@ -96,6 +96,7 @@ struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 char dns_conf_server_name[DNS_MAX_SERVER_NAME_LEN];
 int dns_conf_server_num;
 int dns_conf_resolv_hostname = 1;
+char dns_conf_exist_bootstrap_dns;
 
 struct dns_domain_check_orders dns_conf_check_orders = {
 	.orders =
@@ -164,6 +165,8 @@ struct dns_edns_client_subnet dns_conf_ipv6_ecs;
 
 char dns_conf_sni_proxy_ip[DNS_MAX_IPLEN];
 
+static int _conf_domain_rule_nameserver(char *domain, const char *group_name);
+
 static void *_new_dns_rule(enum domain_rule domain_rule)
 {
 	struct dns_rule *rule;
@@ -467,6 +470,7 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 	unsigned int server_flag = 0;
 	unsigned char *spki = NULL;
 	int drop_packet_latency_ms = 0;
+	int is_bootstrap_dns = 0;
 
 	int ttl = 0;
 	/* clang-format off */
@@ -487,6 +491,7 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 		{"proxy", required_argument, NULL, 'P'}, /* proxy server */
 		{"exclude-default-group", no_argument, NULL, 'E'}, /* exclude this from default group */
 		{"set-mark", required_argument, NULL, 254}, /* set mark */
+		{"bootstrap-dns", no_argument, NULL, 255}, /* set as bootstrap dns */
 		{NULL, no_argument, NULL, 0}
 	};
 	/* clang-format on */
@@ -618,6 +623,10 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 			server->set_mark = atoll(optarg);
 			break;
 		}
+		case 255: {
+			is_bootstrap_dns = 1;
+			break;
+		}
 		default:
 			break;
 		}
@@ -633,6 +642,12 @@ static int _config_server(int argc, char *argv[], dns_server_type_t type, int de
 	dns_conf_server_num++;
 	tlog(TLOG_DEBUG, "add server %s, flag: %X, ttl: %d", ip, result_flag, ttl);
 
+	if (is_bootstrap_dns) {
+		server->server_flag |= SERVER_FLAG_EXCLUDE_DEFAULT;
+		_dns_conf_get_group_set("bootstrap-dns", server);
+		dns_conf_exist_bootstrap_dns = 1;
+	}
+
 	return 0;
 
 errout:
@@ -643,6 +658,26 @@ errout:
 	return -1;
 }
 
+static int _config_update_bootstrap_dns_rule(void)
+{
+	struct dns_servers *server = NULL;
+
+	if (dns_conf_exist_bootstrap_dns == 0) {
+		return 0;
+	}
+
+	for (int i = 0; i < dns_conf_server_num; i++) {
+		server = &dns_conf_servers[i];
+		if (check_is_ipaddr(server->server) == 0) {
+			continue;
+		}
+
+		_conf_domain_rule_nameserver(server->server, "bootstrap-dns");
+	}
+
+	return 0;
+}
+
 static int _config_domain_rule_free(struct dns_domain_rule *domain_rule)
 {
 	int i = 0;
@@ -3297,6 +3332,7 @@ errout:
 	return -1;
 }
 
+
 static int _dns_conf_load_post(void)
 {
 	_config_setup_smartdns_domain();
@@ -3322,6 +3358,8 @@ static int _dns_conf_load_post(void)
 
 	_config_domain_set_name_table_destroy();
 
+	_config_update_bootstrap_dns_rule();
+
 	return 0;
 }
 

src/smartdns.c

@@ -224,6 +224,47 @@ static int _smartdns_load_from_resolv(void)
 	return ret;
 }
 
+static int _smartdns_prepare_server_flags(struct client_dns_server_flags *flags, struct dns_servers *server)
+{
+	memset(flags, 0, sizeof(*flags));
+	switch (server->type) {
+	case DNS_SERVER_UDP: {
+		struct client_dns_server_flag_udp *flag_udp = &flags->udp;
+		flag_udp->ttl = server->ttl;
+	} break;
+	case DNS_SERVER_HTTPS: {
+		struct client_dns_server_flag_https *flag_http = &flags->https;
+		flag_http->spi_len = dns_client_spki_decode(server->spki, (unsigned char *)flag_http->spki);
+		safe_strncpy(flag_http->hostname, server->hostname, sizeof(flag_http->hostname));
+		safe_strncpy(flag_http->path, server->path, sizeof(flag_http->path));
+		safe_strncpy(flag_http->httphost, server->httphost, sizeof(flag_http->httphost));
+		safe_strncpy(flag_http->tls_host_verify, server->tls_host_verify, sizeof(flag_http->tls_host_verify));
+		flag_http->skip_check_cert = server->skip_check_cert;
+	} break;
+	case DNS_SERVER_TLS: {
+		struct client_dns_server_flag_tls *flag_tls = &flags->tls;
+		flag_tls->spi_len = dns_client_spki_decode(server->spki, (unsigned char *)flag_tls->spki);
+		safe_strncpy(flag_tls->hostname, server->hostname, sizeof(flag_tls->hostname));
+		safe_strncpy(flag_tls->tls_host_verify, server->tls_host_verify, sizeof(flag_tls->tls_host_verify));
+		flag_tls->skip_check_cert = server->skip_check_cert;
+
+	} break;
+	case DNS_SERVER_TCP:
+		break;
+	default:
+		return -1;
+		break;
+	}
+
+	flags->type = server->type;
+	flags->server_flag = server->server_flag;
+	flags->result_flag = server->result_flag;
+	flags->set_mark = server->set_mark;
+	flags->drop_packet_latency_ms = server->drop_packet_latency_ms;
+	safe_strncpy(flags->proxyname, server->proxyname, sizeof(flags->proxyname));
+	return 0;
+}
+
 static int _smartdns_add_servers(void)
 {
 	unsigned long i = 0;
@@ -234,44 +275,12 @@ static int _smartdns_add_servers(void)
 	struct client_dns_server_flags flags;
 
 	for (i = 0; i < (unsigned int)dns_conf_server_num; i++) {
-		memset(&flags, 0, sizeof(flags));
-		switch (dns_conf_servers[i].type) {
-		case DNS_SERVER_UDP: {
-			struct client_dns_server_flag_udp *flag_udp = &flags.udp;
-			flag_udp->ttl = dns_conf_servers[i].ttl;
-		} break;
-		case DNS_SERVER_HTTPS: {
-			struct client_dns_server_flag_https *flag_http = &flags.https;
-			flag_http->spi_len = dns_client_spki_decode(dns_conf_servers[i].spki, (unsigned char *)flag_http->spki);
-			safe_strncpy(flag_http->hostname, dns_conf_servers[i].hostname, sizeof(flag_http->hostname));
-			safe_strncpy(flag_http->path, dns_conf_servers[i].path, sizeof(flag_http->path));
-			safe_strncpy(flag_http->httphost, dns_conf_servers[i].httphost, sizeof(flag_http->httphost));
-			safe_strncpy(flag_http->tls_host_verify, dns_conf_servers[i].tls_host_verify,
-						 sizeof(flag_http->tls_host_verify));
-			flag_http->skip_check_cert = dns_conf_servers[i].skip_check_cert;
-		} break;
-		case DNS_SERVER_TLS: {
-			struct client_dns_server_flag_tls *flag_tls = &flags.tls;
-			flag_tls->spi_len = dns_client_spki_decode(dns_conf_servers[i].spki, (unsigned char *)flag_tls->spki);
-			safe_strncpy(flag_tls->hostname, dns_conf_servers[i].hostname, sizeof(flag_tls->hostname));
-			safe_strncpy(flag_tls->tls_host_verify, dns_conf_servers[i].tls_host_verify,
-						 sizeof(flag_tls->tls_host_verify));
-			flag_tls->skip_check_cert = dns_conf_servers[i].skip_check_cert;
-
-		} break;
-		case DNS_SERVER_TCP:
-			break;
-		default:
+		if (_smartdns_prepare_server_flags(&flags, &dns_conf_servers[i]) != 0) {
+			tlog(TLOG_ERROR, "prepare server flags failed, %s:%d", dns_conf_servers[i].server,
+				 dns_conf_servers[i].port);
 			return -1;
-			break;
 		}
 
-		flags.type = dns_conf_servers[i].type;
-		flags.server_flag = dns_conf_servers[i].server_flag;
-		flags.result_flag = dns_conf_servers[i].result_flag;
-		flags.set_mark = dns_conf_servers[i].set_mark;
-		flags.drop_packet_latency_ms = dns_conf_servers[i].drop_packet_latency_ms;
-		safe_strncpy(flags.proxyname, dns_conf_servers[i].proxyname, sizeof(flags.proxyname));
 		ret = dns_client_add_server(dns_conf_servers[i].server, dns_conf_servers[i].port, dns_conf_servers[i].type,
 									&flags);
 		if (ret != 0) {
@@ -293,7 +302,14 @@ static int _smartdns_add_servers(void)
 			if (server == NULL) {
 				continue;
 			}
-			ret = dns_client_add_to_group(group->group_name, server->server, server->port, server->type);
+
+			if (_smartdns_prepare_server_flags(&flags, server) != 0) {
+				tlog(TLOG_ERROR, "prepare server flags failed, %s:%d", server->server,
+					 server->port);
+				return -1;
+			}
+
+			ret = dns_client_add_to_group(group->group_name, server->server, server->port, server->type, &flags);
 			if (ret != 0) {
 				tlog(TLOG_ERROR, "add server %s to group %s failed", server->server, group->group_name);
 				return -1;