Unexpected ALPN "dns" used when DNS server is same as proxy server

[CryptoFetter]

Operating system

Android

System version

15

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

Latest

Description

When the client is configured to use a dns.server entry that matches the remote proxy address (i.e. the DNS is routed through the same server as the VLESS/Trojan endpoint), the client initiates TLS with an ALPN set to:

"h2,dns,http/1.1"

This behavior appears only under this condition and causes detection issues when using SNI-based routing or stream multiplexers (e.g. NGINX with ssl_preread).

Expected Behavior:

The ALPN list should reflect the actual protocol intended for use (e.g. h2, http/1.1, grpc, etc.). The inclusion of dns is confusing and non-standard, especially when mixed with other protocols.

Reproduction

Configure the dns.server in the client to point to the same domain/IP and port as the server's listen entry.

Start the client.

Capture the outgoing ALPN with tcpdump, nginx, or openssl s_client.

Example result:

ALPN: "h2,dns,http/1.1"

Either:

Avoid sending the dns ALPN token unless using a specific DNS-over-TLS stream;

Or isolate dns ALPN in a separate connection.

This would improve compatibility with intermediaries like NGINX and avoid detection by ALPN fingerprinting.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.