vless without TLS or other encryption is prohibited unless t

Error message

vless without TLS or other encryption is prohibited unless the server address is a private IP or domain

What it means

Error "vless without TLS or other encryption is prohibited unless the server address is a private IP or domain" thrown in XTLS/Xray-core.

Source

Thrown at infra/conf/xray.go:255

	}
	if address.Family().IsIP() {
		return !geodata.GetPrivateIPMatcher().Match(address.IP())
	}
	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)
}

func validateOutboundTransportSecurity(rawConfig interface{}, senderSettings *proxyman.SenderConfig) error {
	if senderSettings.StreamSettings != nil && senderSettings.StreamSettings.GetSecurityType() != "" {
		return nil
	}

	if vlessCfg, ok := rawConfig.(*VLessOutboundConfig); ok {
		if vlessCfg.Encryption != "" && vlessCfg.Encryption != "none" {
			return nil
		}
		if requiresTransportSecurity(vlessCfg.Address) {
			return errors.New("vless without TLS or other encryption is prohibited unless the server address is a private IP or domain")
		}
	}

	if tjCfg, ok := rawConfig.(*TrojanClientConfig); ok {
		if requiresTransportSecurity(tjCfg.Address) {
			return errors.New("trojan without TLS is prohibited unless the server address is a private IP or domain")
		}
	}

	return nil
}

// Build implements Buildable.
func (c *OutboundDetourConfig) Build() (*core.OutboundHandlerConfig, error) {
	senderSettings := &proxyman.SenderConfig{}
	switch strings.ToLower(c.TargetStrategy) {
	case "asis", "":
		senderSettings.TargetStrategy = internet.DomainStrategy_AS_IS

View on GitHub (pinned to 7d214f8b09)

When it happens

Trigger: Thrown at infra/conf/xray.go:255 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/fff65ea3963e340d. Report an issue: GitHub.