{"record":{"id":"b07867213f2aecc0","repo":"XTLS/Xray-core","slug":"unknown-nonipquery","errorCode":null,"errorMessage":"unknown nonIPQuery: {}","messagePattern":"unknown nonIPQuery: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/dns_proxy.go","lineNumber":130,"sourceCode":"\t\t}\n\t\tconfig.Rule = append(config.Rule, rule)\n\t}\n\n\treturn config, nil\n}\n\n// todo: remove legacy\nfunc (c *DNSOutboundConfig) buildLegacyDNSPolicy() ([]*dns.DNSRuleConfig, error) {\n\trules := make([]*dns.DNSRuleConfig, 0, 3)\n\n\tmode := \"reject\"\n\tif c.NonIPQuery != nil && *c.NonIPQuery != \"\" {\n\t\tmode = *c.NonIPQuery\n\t}\n\tswitch mode {\n\tcase \"\", \"reject\", \"drop\", \"skip\":\n\tdefault:\n\t\treturn nil, errors.New(\"unknown nonIPQuery: \", mode)\n\t}\n\n\tif c.BlockTypes != nil && len(*c.BlockTypes) > 0 {\n\t\trule := &dns.DNSRuleConfig{Action: dns.RuleAction_Drop}\n\t\tif mode == \"reject\" {\n\t\t\trule.Action = dns.RuleAction_Return\n\t\t\trule.RCode = 5\n\t\t}\n\t\tfor _, qType := range *c.BlockTypes {\n\t\t\tif qType < 0 || qType > 65535 {\n\t\t\t\treturn nil, errors.New(\"legacy blockTypes qType out of range: \", qType)\n\t\t\t}\n\t\t\trule.QType = append(rule.QType, qType)\n\t\t}\n\t\trules = append(rules, rule)\n\t}\n\n\t{","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/dns_proxy.go#L112-L148","documentation":"Thrown while compiling the deprecated 'nonIPQuery' setting of a DNS outbound into internal rules: the mode string is not one of the accepted values. buildLegacyDNSPolicy() accepts only \"\" (defaults to reject), \"reject\", \"drop\", and \"skip\"; anything else is rejected. This runs only on the legacy code path (nonIPQuery/blockTypes present without 'rules').","triggerScenarios":"A DNS outbound with \"nonIPQuery\": \"allow\" or \"block\" or any word other than reject/drop/skip, while not using the \"rules\" array. The switch default branch fires immediately.","commonSituations":"Guessing allowed values instead of checking docs; configs ported from tools whose semantics differ (e.g. dnsmasq 'refuse', AdGuard 'refused').","solutions":["Set \"nonIPQuery\" to \"reject\", \"drop\", \"skip\", or remove it entirely (default is reject).","Prefer migrating to the \"rules\" array, which supersedes nonIPQuery and gives per-qType control.","Check spelling/case: values are matched literally after the nil/empty default, so \"Drop\" works via strings equality? No — match is exact lowercase; use lowercase values."],"exampleFix":"// before\n\"nonIPQuery\": \"block\"\n\n// after\n\"nonIPQuery\": \"drop\"","handlingStrategy":"validation","validationCode":"var validNonIPQuery = map[string]bool{\"\": true, \"reject\": true, \"drop\": true, \"skip\": true}\n\nif c.NonIPQuery != nil && !validNonIPQuery[strings.ToLower(*c.NonIPQuery)] {\n    return fmt.Errorf(\"unknown nonIPQuery %q\", *c.NonIPQuery)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only reject/drop/skip (lowercase) for nonIPQuery, or omit it.","Plan migration to rules; the legacy path prints deprecation warnings."],"tags":["go","xray","dns","config","deprecated","validation"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}