XTLS/Xray-core · error

Super long domain is not supported: {domain}

Error message

Super long domain is not supported: {domain}

What it means

Returned by writeAddress when a domain destination exceeds the protocol's length limit (a domain must fit in a single length byte, i.e. at most 255 bytes, minus overhead). The wire format writes one length byte, so longer domains cannot be represented.

Source

Thrown at common/protocol/address.go:245

func (p *addressParser) writeAddress(writer io.Writer, address net.Address) error {
	tb := p.addrByteMap[address.Family()]
	if tb == afInvalid {
		return errors.New("unknown address family", address.Family())
	}

	switch address.Family() {
	case net.AddressFamilyIPv4, net.AddressFamilyIPv6:
		if _, err := writer.Write([]byte{tb}); err != nil {
			return err
		}
		if _, err := writer.Write(address.IP()); err != nil {
			return err
		}
	case net.AddressFamilyDomain:
		domain := address.Domain()
		if isDomainTooLong(domain) {
			return errors.New("Super long domain is not supported: ", domain)
		}

		if _, err := writer.Write([]byte{tb, byte(len(domain))}); err != nil {
			return err
		}
		if _, err := writer.Write([]byte(domain)); err != nil {
			return err
		}
	default:
		panic("Unknown family type.")
	}

	return nil
}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Reject/filter over-long destination domains at the inbound layer before they reach the proxy chain
2. If legitimate traffic uses long names, it cannot be proxied by this wire format - fix the originating application

Example fix

// before
err := parser.WriteAddress(writer, dest.Address)

// after
if dest.Address.Family().IsDomain() && len(dest.Address.Domain()) > 255 {
    return errors.New("destination domain too long, rejecting")
}
err := parser.WriteAddress(writer, dest.Address)

if dest.Address.Family().IsDomain() && len(dest.Address.Domain()) > 255 {
    return errors.New("reject over-long destination domain")
}

func isEncodableDomain(d string) bool { return len(d) <= 255 }

When it happens

Trigger: Routing a request whose destination domain is longer than the encoder's limit (isDomainTooLong), e.g. oversized generated subdomains used for DNS-tunnel-style traffic or crafted hostnames.

Common situations: Malicious or buggy clients sending extremely long hostnames; DNS-over-proxy abuse with data smuggled in subdomain labels.

Related errors

• invalid domain name: {domain}
• unknown address family{family}
• message size too large: {size}
• failed to read domain for socks 4a
• No available name server could be created from

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6871434ed4f84b4f. Report an issue: GitHub.