Release v1.7.0
Highlights
- XDNS protocol — New DNS tunnel via Xray-core FinalMask mKCP. Encodes VPN traffic inside DNS-like packets. Tested working for Telegram during Iran's March 2026 internet shutdown. Two client configs per user: DNS resolver mode (stealthier) and direct mode (more stable).
- moav doctor — 9 built-in diagnostic checks for troubleshooting: docker, memory, disk, dns, services, config, ports, env, updates. Catches port conflicts, missing configs, stale .env, low resources.
- Xray-core built from source — Go multi-stage Docker build from main branch for latest FinalMask/XDNS support and mKCP MTU fix.
- Per-protocol Grafana stats — XDNS vs XHTTP traffic breakdown on Xray dashboard.
Upgrade notes
- XDNS is opt-in: ENABLE_XDNS=false by default. Set to true and ENABLE_DNSTT=false to use (both need port 53). (XTLS/Xray-core#5773)
- Xray builds from source: First build takes ~2 min (Go compilation). Subsequent builds are cached.
- telemt updated to 3.3.23: docker compose build telemt
- Bootstrap permissions fixed: Generated configs are now group-readable for the non-root admin container.
What's New
XDNS Protocol (DNS Tunnel for Telegram)
New protocol that encodes VPN traffic inside DNS-like packets using Xray-core's mKCP transport with FinalMask. Designed for heavy internet shutdowns when other
protocols are blocked — tested and confirmed working for Telegram in Iran (March 2026).
Each user gets two client configs:
- xdns-config.json — Via DNS resolver (8.8.8.8). Stealthier but may reconnect periodically.
- xdns-direct-config.json — Direct to server. More stable, less stealthy.
Key details:
- Runs on port 53 (mutually exclusive with dnstt/Slipstream)
- Server MTU 900, client MTU configurable (35/67/130)
- Requires FinalMask-capable client (Happ beta or Xray CLI built from main)
- Telegram proxy only — too slow for web browsing
- Telegram deep link included in user bundle: https://t.me/socks?server=127.0.0.1&port=7891
- Per-inbound traffic stats on Grafana (XDNS vs XHTTP breakdown)
moav doctor (PR #79)
9 built-in diagnostic checks:
moav doctor # Run all checks
moav doctor dns # DNS records + NS delegation
moav doctor services # Running vs enabled containers
moav doctor ports # Port conflicts (XDNS/dnstt)
moav doctor config # Bootstrap status + config files
moav doctor memory # RAM availability
moav doctor disk # Free disk space
moav doctor env # Missing .env variables
moav doctor updates # Version check
Xray-core Built from Source
Dockerfile changed from pre-built binary to Go multi-stage build from Xray-core main branch. Includes mKCP MTU fix (PR #5773) and full FinalMask/XDNS support.
Bug Fixes
- DNS NS delegation check fixed for Cloudflare-managed zones (queries authoritative nameserver AUTHORITY section)
- User-add now adds to all VLESS inbounds (XHTTP + XDNS)
- dns-router exits gracefully when no routes configured (XDNS mode)
- Bootstrap sets group-readable permissions on generated configs (fixes admin container permission errors)
Changed
- telemt updated to 3.3.23
- XDNS defaults to disabled (ENABLE_XDNS=false) to avoid port 53 conflict with existing setups
Upgrade
moav update
moav build xray telemt xray-exporter dns-router
moav bootstrap
moav start
▎ Enable XDNS: Set ENABLE_XDNS=true and ENABLE_DNSTT=false in .env, add NS record (NS x → dns.yourdomain.com), run moav bootstrap, then docker compose up -d.
▎ Without XDNS: No action needed beyond the standard update. Existing dnstt/Slipstream setups are unaffected.
New Contributors
Full Changelog: v1.6.2...v1.7.0
Quick Install
curl -fsSL moav.sh/install.sh | bashThis will install MoaV to /opt/moav and guide you through setup.
Documentation
moav.sh/docs — Full documentation
- Setup Guide — Complete installation instructions
- Client Setup — How to connect from devices
- DNS Configuration — DNS records setup
- CLI Reference — All commands and options
- Monitoring — Grafana dashboards and metrics
- Troubleshooting — Common issues and solutions