#4308·sing-box

sing-box failed to pass hostname for .onion domains

Author: axetCreated Jul 17, 2026Updated Sep 16, 2026

LabelsStale

Operating system

Linux

System version

1.13.14

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

bash

Description

singbox 1.13.14 failed to pass hostnames to tor socks while singbox 1.12 version works just fine with same config.

you can see logs from 1.12 with proper sniff options:

  "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    }
  ],

Proper log output from 1.12 with correct ip overriding:

+0000 2026-07-17 14:21:03 INFO [51801188 0ms] inbound/direct[dns4]: inbound packet connection from 10.10.5.74:46276
+0000 2026-07-17 14:21:03 INFO [51801188 0ms] inbound/direct[dns4]: inbound packet connection to 10.10.5.5:53
+0000 2026-07-17 14:21:03 INFO [51801188 2ms] dns: exchanged A flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion. 0 IN A 172.16.0.1
+0000 2026-07-17 14:21:03 INFO [1380874693 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45316
+0000 2026-07-17 14:21:03 INFO [3510160057 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45324
+0000 2026-07-17 14:21:03 INFO [1380874693 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [3510160057 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [3510160057 2ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80
+0000 2026-07-17 14:21:03 INFO [877590728 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:45330
+0000 2026-07-17 14:21:03 INFO [1380874693 2ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80
+0000 2026-07-17 14:21:03 INFO [877590728 2ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 14:21:03 INFO [877590728 4ms] outbound/socks[tor]: outbound connection to flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion:80

Same configs with singbox 1.13 with small adjustments because deprecated options:

 "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
    }
  ],
 "route": {
    "rules": [
      {
        "inbound": [ "tproxy4", "tproxy6" ],
        "action": "sniff"
      }
    ],
    "final": "direct"
  },

produce fail logs, wher ip not being overriden and showing socks error:

+0000 2026-07-17 13:07:00 INFO [3552348983 0ms] inbound/direct[dns4]: inbound packet connection from 10.10.5.74:55901
+0000 2026-07-17 13:07:00 INFO [3552348983 0ms] inbound/direct[dns4]: inbound packet connection to 10.10.5.5:53
+0000 2026-07-17 13:07:00 INFO [3552348983 2ms] dns: exchanged A flibustaongezhld6dibs2dps6vm4nvqg2kp7vgowbu76tzopgnhazqd.onion. 0 IN A 172.16.0.1
+0000 2026-07-17 13:07:00 INFO [147736201 0ms] inbound/tproxy[tproxy4]: inbound connection from 10.10.5.74:52846
+0000 2026-07-17 13:07:00 INFO [147736201 0ms] inbound/tproxy[tproxy4]: inbound connection to 172.16.0.1:80
+0000 2026-07-17 13:07:00 INFO [147736201 1ms] outbound/socks[tor]: outbound connection to 172.16.0.1:80
+0000 2026-07-17 13:07:00 ERROR [147736201 7ms] connection: open connection to 172.16.0.1:80 using outbound/socks[tor]: socks5: request rejected, code=1

logs from tor socks:

Jul 17 16:39:54.263 [info] connection_handle_listener_read(): New SOCKS connection opened from 127.0.0.1.
Jul 17 16:39:54.266 [warn] Your application (using socks5 to port 80) is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via privoxy or socat) instead. For more information, please see https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks. [9 similar message(s) suppressed in last 60 seconds]

Reproduction

Full configs:

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "tproxy",
      "tag": "tproxy4",
      "listen": "127.0.0.1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    },
    {
      "type": "tproxy",
      "tag": "tproxy6",
      "listen": "::1",
      "listen_port": 12345,
      "sniff": true,
      "sniff_override_destination": true
    }
  ],
  "route": {
    "rules": [
      {
        "inbound": [ "tproxy4", "tproxy6" ],
        "action": "sniff"
      }
    ],
    "final": "direct"
  },
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ]
}

{
  "inbounds": [
    {
      "type": "direct",
      "tag": "dns4",
      "listen": "10.10.5.5",
      "listen_port": 53
    },
    {
      "type": "direct",
      "tag": "dns6",
      "listen": "fd00:10:10:5::5",
      "listen_port": 53
    }
  ],
  "dns": {
    "servers": [
      {
        "tag": "dnsmasq",
        "type": "udp",
        "server": "127.0.0.1",
        "server_port": 53
      }
    ],
    "reverse_mapping": true,
    "final": "dnsmasq"
  },
  "route": {
    "rules": [
      {
        "inbound": [
          "dns4",
          "dns6"
        ],
        "action": "hijack-dns"
      }
    ]
  }
}

{
  "outbounds": [
    {
      "type": "socks",
      "tag": "byedpi",
      "server": "127.0.0.1",
      "server_port": 2933
    },
    {
      "type": "socks",
      "tag": "zapret",
      "server": "127.0.0.1",
      "server_port": 8797
    },
    {
      "type": "plain",
      "tag": "i2p",
      "server": "127.0.0.1",
      "server_port": 4444
    },
    {
      "type": "socks",
      "tag": "google",
      "server": "127.0.0.1",
      "server_port": 4646
    },
    {
      "type": "socks",
      "tag": "xray",
      "server": "127.0.0.1",
      "server_port": 8537
    },
    {
      "type": "direct",
      "tag": "nfqws",
      "routing_mark": 200
    }
 ],
  "route": {
    "rules": [
      {
        "domain_suffix": [
          ".i2p"
        ],
        "outbound": "i2p"
      },
      {
        "ip_cidr": [
          "172.16.0.2/32"
        ],
        "outbound": "i2p"
      }
    ]
  }
}


{
  "outbounds": [
    {
      "type": "socks",
      "tag": "tor",
      "server": "127.0.0.1",
      "server_port": 9050
    }
 ],
  "route": {
    "rules": [
      {
        "domain_suffix": [
          ".onion"
        ],
        "outbound": "tor"
      }
    ]
  }
}

Logs

bash

Supporter

I am a sponsor

Integrity requirements

I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Source: SagerNet/sing-box

View original on GitHub View discussion on GitHub