What causes "Connect to DNS server %s:%d fail:%r" in XX-net/XX-Net?

Test raw reachability: 'nc -vz host 853' (or 53) from the same host

Connect to DNS server %s:%d fail:%r

Error message

Connect to DNS server %s:%d fail:%r

What it means

direct_connect() logs this warning when socket.create_connection/connect to the DNS server (host, port) raises a non-socket.error exception, and returns None. Note the log line omits the exception object (%r is declared but 'e' is not passed), so the actual cause is hidden. Callers must handle the None return.

Source

Thrown at code/default/smart_router/local/dns_query.py:367

                info = [(socket.AF_INET, socket.SOCK_STREAM, 0, "", (host, port))]

        for res in info:
            af, socktype, proto, canonname, sa = res
            s = None
            try:
                s = socket.socket(af, socktype, proto)

                s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
                s.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 32 * 1024)
                s.setsockopt(socket.SOL_TCP, socket.TCP_NODELAY, True)
                s.settimeout(connect_timeout)
                s.connect((host, port))
                return s
            except socket.error:
                if s:
                    s.close()
            except Exception as e:
                xlog.warn("Connect to DNS server %s:%d fail:%r", host, port)

        return None

    def connect(self, host, port):
        if not g.config.PROXY_ENABLE:
            sock = self.direct_connect(host, self.port)
        else:
            connect_timeout = 5

            import socks

            sock = socks.socksocket(socket.AF_INET)
            sock.set_proxy(proxy_type=g.config.PROXY_TYPE,
                           addr=g.config.PROXY_HOST,
                           port=g.config.PROXY_PORT, rdns=True,
                           username=g.config.PROXY_USER,
                           password=g.config.PROXY_PASSWD)

View on GitHub (pinned to cfa5bc17b6)

Solutions

Test raw reachability: 'nc -vz host 853' (or 53) from the same host
If TCP 853 is blocked, switch to DoH (port 443) which passes almost all firewalls
Fix or replace the server address/port configuration with a known-good public resolver
Patch the log call to include 'e' (xlog.warn(..., host, port, e)) so the real cause is visible

Example fix

# before
xlog.warn("Connect to DNS server %s:%d fail:%r", host, port)
# after
xlog.warn("Connect to DNS server %s:%d fail:%r", host, port, e)

Defensive patterns

Strategy: fallback

Try / catch

sock = client.direct_connect(host, port)
if sock is None:
    sock = fallback_client.connect(host, port)  # e.g. DoH/443
# never use sock without the None check

Prevention

Always null-check the return of connect()/direct_connect()
Prefer DoH (443) where 853/53 are likely blocked
Patch the log format to include the exception for diagnosability

When it happens

Trigger: TCP connect to (host, port) — usually port 853 for DoT or 53 for TCP DNS — failing with a non-socket.error exception such as a DNS resolution failure of the hostname, an SSL/timeout wrapper error, or a programming error. socket.error itself is silently retried/ignored.

Common situations: Blocking of TCP 853/53 by firewalls (DoT is commonly blocked), the server hostname failing to resolve, a dead server IP in the fallback list, corporate proxies intercepting direct connections.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/6e6edb497ff30c64. Report an issue: GitHub.