XTLS/Xray-core · error

invalid domain name: {domain}

Error message

invalid domain name: {domain}

What it means

Returned when a decoded domain-type address fails isValidDomain after the maybeIPPrefix fast path did not parse it as an IP. The domain contains illegal characters, bad labels, or other RFC violations, so the parser refuses to accept it as a destination.

Source

Thrown at common/protocol/address.go:220

		}
		return net.IPAddress(b.BytesFrom(-16)), nil
	case net.AddressFamilyDomain:
		if _, err := b.ReadFullFrom(reader, 1); err != nil {
			return nil, err
		}
		domainLength := int32(b.Byte(b.Len() - 1))
		if _, err := b.ReadFullFrom(reader, domainLength); err != nil {
			return nil, err
		}
		domain := string(b.BytesFrom(-domainLength))
		if maybeIPPrefix(domain[0]) {
			addr := net.ParseAddress(domain)
			if addr.Family().IsIP() {
				return addr, nil
			}
		}
		if !isValidDomain(domain) {
			return nil, errors.New("invalid domain name: ", domain)
		}
		return net.DomainAddress(domain), nil
	default:
		panic("impossible case")
	}
}

func (p *addressParser) writeAddress(writer io.Writer, address net.Address) error {
	tb := p.addrByteMap[address.Family()]
	if tb == afInvalid {
		return errors.New("unknown address family", address.Family())
	}

	switch address.Family() {
	case net.AddressFamilyIPv4, net.AddressFamilyIPv6:
		if _, err := writer.Write([]byte{tb}); err != nil {
			return err
		}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Verify client/server credentials and encryption match (desync is the usual root cause)
2. If a specific client triggers it, inspect the exact domain bytes logged and block/fix that client
3. Reproduce with a known-good client to confirm the server decoder is fine

addr, err := parser.ReadAddress(buf, reader)
if err != nil { // invalid domain: reject request, keep listener alive
    return newError("invalid destination domain").Base(err)
}

When it happens

Trigger: readAddress decoding a domain address whose bytes include control characters, spaces, invalid punycode, empty labels, or exceed per-label length limits; typically because the stream is corrupted or the length prefix pointed mid-domain.

Common situations: Framing desync (length byte wrong), a malicious/malformed client deliberately sending invalid domains, or middleboxes mangling the payload.

Related errors

• No available name server could be created from
• pattern string does not conform to Letter-Digit-Hyphen (LDH)
• failed to parse address and port
• unknown network type:
• failed to read metadata

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/0bcf176fab23dc1d. Report an issue: GitHub.