AdguardTeam/AdGuardHome · error

creating new dns server config: %w

Error message

creating new dns server config: %w

What it means

newServerConfig assembles the dnsforward.ServerConfig (listen addrs, TLS config, upstreams, clients container). It fails when the DNS configuration cannot be translated into a valid server config — most commonly invalid upstream DNS URLs or malformed blocking/clients settings.

Source

Thrown at internal/home/dns.go:176

		}
	}()
	if err != nil {
		return fmt.Errorf("creating new dns server: %w", err)
	}

	globalContext.clients.clientChecker = globalContext.dnsServer

	dnsConf, err := newServerConfig(
		&config.DNS,
		config.Clients.Sources,
		config.HTTPConfig.DoH,
		params.TLSManager,
		httpReg,
		globalContext.clients.storage,
		confModifier,
	)
	if err != nil {
		return fmt.Errorf("creating new dns server config: %w", err)
	}

	// Try to prepare the server with disabled private RDNS resolution if it
	// failed to prepare as is.  See TODO on [dnsforward.PrivateRDNSError].
	err = globalContext.dnsServer.Prepare(ctx, dnsConf)
	if _, ok := errors.AsType[*dnsforward.PrivateRDNSError](err); ok {
		l := params.Logger
		l.WarnContext(ctx, "private rdns resolution failed; disabling", slogutil.KeyError, err)

		dnsConf.UsePrivateRDNS = false
		err = globalContext.dnsServer.Prepare(ctx, dnsConf)
	}
	if err != nil {
		return fmt.Errorf("preparing dns server: %w", err)
	}

	return nil
}

View on GitHub (pinned to b41aefbe51)

Solutions

1. Validate every entry in dns.upstream_dns and dns.bootstrap_dns — schemes like tls://, https:// must include valid hostnames
2. Check tls:// entries have valid server names and that enabled_tls certificates exist
3. Simplify: temporarily reduce config to one known-good plain upstream (e.g. https://dns.cloudflare.com/dns-query) and re-add entries
4. Re-run setup from a backup config if the file was hand-edited

Example fix

# before
upstream_dns:
  - tls://1.1.1.1
# after (DoT requires the server name for TLS validation; use a hostname or dns:// fallback)
upstream_dns:
  - tls://one.one.one.one
  - https://dns.cloudflare.com/dns-query

// validate upstream URLs before building server config
import "net/url"
for _, u := range config.DNS.UpstreamDNS {
    parsed, err := url.Parse(u)
    if err != nil || parsed.Host == "" {
        return fmt.Errorf("invalid upstream %q", u)
    }
    switch parsed.Scheme {
    case "dns", "tcp", "tls", "https", "quic":
    default:
        return fmt.Errorf("unsupported upstream scheme %q", u)
    }
}

func isValidUpstream(u string) bool {
    p, err := url.Parse(u)
    if err != nil || p.Host == "" { return false }
    switch p.Scheme {
    case "dns", "tcp", "tls", "https", "quic": return true
    }
    return false
}

if _, err := newServerConfig(tlsManager, dnsConf, clients, hosts, modifier); err != nil {
    return fmt.Errorf("creating new dns server config: %w", err) // inspect wrapped upstream error
}

When it happens

Trigger: Calling newServerConfig with config.DNS containing invalid upstream URLs (e.g. missing scheme, bad tls:// hostname), invalid bootstrap DNS, or TLS manager unable to supply certificates for the configured hostnames.

Common situations: Hand-edited config.yaml with typo'd upstream servers, upstreams using DNS-over-TLS/DNS-over-HTTPS with unparseable URLs, or certificate files missing after a migration.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• constructing tls config: %w
• init querylog: %w
• dnscrypt_config_file: %w
• reading cert file: %w
• reading key file: %w

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/20cbb03bfb2dd153. Report an issue: GitHub.