{"record":{"id":"6871434ed4f84b4f","repo":"XTLS/Xray-core","slug":"super-long-domain-is-not-supported-domain","errorCode":null,"errorMessage":"Super long domain is not supported: {domain}","messagePattern":"Super long domain is not supported: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/protocol/address.go","lineNumber":245,"sourceCode":"\nfunc (p *addressParser) writeAddress(writer io.Writer, address net.Address) error {\n\ttb := p.addrByteMap[address.Family()]\n\tif tb == afInvalid {\n\t\treturn errors.New(\"unknown address family\", address.Family())\n\t}\n\n\tswitch address.Family() {\n\tcase net.AddressFamilyIPv4, net.AddressFamilyIPv6:\n\t\tif _, err := writer.Write([]byte{tb}); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif _, err := writer.Write(address.IP()); err != nil {\n\t\t\treturn err\n\t\t}\n\tcase net.AddressFamilyDomain:\n\t\tdomain := address.Domain()\n\t\tif isDomainTooLong(domain) {\n\t\t\treturn errors.New(\"Super long domain is not supported: \", domain)\n\t\t}\n\n\t\tif _, err := writer.Write([]byte{tb, byte(len(domain))}); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif _, err := writer.Write([]byte(domain)); err != nil {\n\t\t\treturn err\n\t\t}\n\tdefault:\n\t\tpanic(\"Unknown family type.\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":227,"sourceCodeEnd":260,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/protocol/address.go#L227-L260","documentation":"Returned by writeAddress when a domain destination exceeds the protocol's length limit (a domain must fit in a single length byte, i.e. at most 255 bytes, minus overhead). The wire format writes one length byte, so longer domains cannot be represented.","triggerScenarios":"Routing a request whose destination domain is longer than the encoder's limit (isDomainTooLong), e.g. oversized generated subdomains used for DNS-tunnel-style traffic or crafted hostnames.","commonSituations":"Malicious or buggy clients sending extremely long hostnames; DNS-over-proxy abuse with data smuggled in subdomain labels.","solutions":["Reject/filter over-long destination domains at the inbound layer before they reach the proxy chain","If legitimate traffic uses long names, it cannot be proxied by this wire format - fix the originating application"],"exampleFix":"// before\nerr := parser.WriteAddress(writer, dest.Address)\n\n// after\nif dest.Address.Family().IsDomain() && len(dest.Address.Domain()) > 255 {\n    return errors.New(\"destination domain too long, rejecting\")\n}\nerr := parser.WriteAddress(writer, dest.Address)","handlingStrategy":"validation","validationCode":"if dest.Address.Family().IsDomain() && len(dest.Address.Domain()) > 255 {\n    return errors.New(\"reject over-long destination domain\")\n}","typeGuard":"func isEncodableDomain(d string) bool { return len(d) <= 255 }","tryCatchPattern":null,"preventionTips":["Filter absurd hostnames at the edge","Recognize these as abuse signals (DNS tunneling) not config bugs"],"tags":["protocol","domain","limits","serialization"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}