XTLS/Xray-core · error

legacy blockTypes qType out of range: {}

Error message

legacy blockTypes qType out of range: {}

What it means

Thrown when a legacy 'blockTypes' entry in a DNS outbound is outside the range 0-65535. DNS qType is a 16-bit field, so the builder rejects negative or oversized values before appending them to the drop rule. Only reached on the legacy path (blockTypes present, no 'rules').

Source

Thrown at infra/conf/dns_proxy.go:141

	mode := "reject"
	if c.NonIPQuery != nil && *c.NonIPQuery != "" {
		mode = *c.NonIPQuery
	}
	switch mode {
	case "", "reject", "drop", "skip":
	default:
		return nil, errors.New("unknown nonIPQuery: ", mode)
	}

	if c.BlockTypes != nil && len(*c.BlockTypes) > 0 {
		rule := &dns.DNSRuleConfig{Action: dns.RuleAction_Drop}
		if mode == "reject" {
			rule.Action = dns.RuleAction_Return
			rule.RCode = 5
		}
		for _, qType := range *c.BlockTypes {
			if qType < 0 || qType > 65535 {
				return nil, errors.New("legacy blockTypes qType out of range: ", qType)
			}
			rule.QType = append(rule.QType, qType)
		}
		rules = append(rules, rule)
	}

	{
		rule := &dns.DNSRuleConfig{Action: dns.RuleAction_Hijack}
		rule.QType = append(rule.QType, 1)
		rule.QType = append(rule.QType, 28)
		rules = append(rules, rule)
	}

	{
		rule := &dns.DNSRuleConfig{Action: dns.RuleAction_Return}
		if mode == "reject" {
			rule.Action = dns.RuleAction_Return
			rule.RCode = 5

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Use valid DNS RR type numbers (e.g. 255 = ANY, 16 = TXT, 33 = SRV, 28 = AAAA).
2. Remove the legacy blockTypes and use "rules": [{"action": "drop", "qType": [...]}] which validates ranges too.
3. Validate generated configs programmatically before shipping them.

Example fix

// before
"blockTypes": [65536, 255]

// after
"blockTypes": [255]

for _, qt := range blockTypes {
    if qt < 0 || qt > 65535 {
        return fmt.Errorf("blockTypes qType %d out of range", qt)
    }
}

When it happens

Trigger: "blockTypes": [70000] or [-1] in a DNS outbound JSON; any entry where qType < 0 || qType > 65535 fails the guard in buildLegacyDNSPolicy().

Common situations: Typos or copy-paste of RR type mnemonics' numeric codes from IANA tables with OCR/format errors; generators emitting int32 values unchecked.

Related errors

• rCode out of range: {}
• legacy nonIPQuery and blockTypes cannot be mixed with rules
• unknown nonIPQuery: {}
• unknown action: {}
• PacketsFrom can't be 0

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/3935ac23a6ce780a. Report an issue: GitHub.