Plugin Overview

All OxiDNS capabilities ship as plugins, organized into four layers by responsibility:

• server: network ingress; listens for traffic and hands it to the policy entrypoint.
• executor: performs actions such as forwarding, caching, rewriting, observability, and system integrations.
• matcher: evaluates branch conditions for sequence.
• provider: supplies reusable domain / IP datasets consumed by matchers and executors.

Complex policies are usually built by composing several plugin types:

server -> sequence
  -> matcher decides
  -> executor acts
  -> provider supplies datasets
  -> upstream or side effect

The full built-in plugin catalog is listed below. Click any plugin name to jump to its field reference.

Find the right build for your pluginsCustom builds ↗

minimal

Essential core

standard

Everyday extensions

fullDefault build

All capabilities

Builds are cumulative: minimal+ includes all three; standard+ includes standard and full.

Labels indicate plugins included in a build. Enable them in your configuration to use them.

Server plugins

See Server Plugins for full field reference.

Plugin	Purpose	Included in
udp_server	Listens for DNS over UDP and forwards requests to entry.	minimal+
tcp_server	Listens for DNS over TCP. With cert and key configured it also serves as a DoT listener.	minimal+
http_server	Provides DNS over HTTPS (DoH) over HTTP/1.1, HTTP/2, and optional HTTP/3.	standard+
quic_server	Provides DNS over QUIC (DoQ).	standard+

Executor plugins

See Executor Plugins for full field reference. Grouped as: policy orchestration → request handling → response rewriting → observability → side-effect integrations → maintenance.

Policy orchestration

Plugin	Purpose	Included in
sequence	Orchestrates matchers and executors into a pipeline. The most common entry executor.	minimal+
fallback	Runs a primary executor first and falls back to a secondary executor when the primary is too slow or fails.	minimal+
load_balance	Distribute requests across executors using round-robin, random, or weighted-random selection.	minimal+

Request handling

Plugin	Purpose	Included in
forward	Sends DNS queries to upstreams.	minimal+
cache	TTL-aware response caching with negative cache and persistence support.	minimal+
hosts	Returns local static A / AAAA answers using host-style entries.	minimal+
arbitrary	Injects arbitrary DNS records from zone-style rule strings.	standard+
response	Builds complete DNS responses from zone-record templates, including sections, RCODE, and response flags.	standard+
redirect	Rewrites a query name toward another target and restores the visible CNAME on the way back.	minimal+
client_ip_from_ecs	Replaces the request-local client IP with the ECS address for subsequent matchers and recorders.	standard+
edns_filter	Filters request EDNS options, optionally restoring the entire request on scope exit.	minimal+
ecs_handler	Handles EDNS Client Subnet: keep, rewrite, or auto-fill from source IP.	minimal+
forward_edns0opt	Forwards selected EDNS0 options from the request into the final response.	minimal+

Response rewriting

Plugin	Purpose	Included in
ttl	Rewrites response TTL values (fixed value or min/max clamp).	minimal+
ip_selector	Actively probes multiple response IPs and selects or reorders them by score.	standard+
prefer_ipv4 / prefer_ipv6	Dual-stack selector: learns presence of the preferred family and suppresses the other.	minimal+
black_hole	Generates full-qtype interception responses using nxdomain, nodata, null, custom, or refused mode.	minimal+
drop_resp	Drops the current response from the context.	minimal+
reverse_lookup	Maintains a reverse IP → name cache and optionally answers PTR requests.	standard+

Observability and debugging

Plugin	Purpose	Included in
query_summary	Emits a concise query summary after downstream execution.	minimal+
query_recorder	Persists requests, responses, and sequence path events to SQLite, with history, stats, and SSE stream APIs.	standard+
metrics_collector	Collects lightweight request count and latency metrics and exports them in Prometheus format.	standard+
debug_print	Prints request and response objects for debugging.	minimal+
sleep	Async delay for testing and policy experiments.	minimal+

Side effects and system integration

Plugin	Purpose	Included in
http_request	Sends callbacks to external http/https services — webhooks, audit, alerts, external integrations.	standard+
learn_domain	Learns pipeline request domains into dynamic_domain_set for dynamic allow or block lists.	standard+
script	Runs an external command and injects a stable subset of DnsContext as arguments or environment variables.	standard+
ipset	Writes response IPs into Linux ipset via the embedded netlink backend (no ipset binary required).	full
nftset	Writes response IPs into nftables sets via the embedded netlink backend (no nft binary required).	full
ros_address_list	Projects response IPs into a RouterOS address-list consumed by firewall, mangle, or policy-routing rules.	full
ros_route	Projects response IPs as per-IP static routes in a RouterOS routing table with the configured gateway and distance.	full

Maintenance and scheduling

Plugin	Purpose	Included in
upgrade	Triggers the OxiDNS upgrade flow from inside the executor pipeline.	standard+
download	Downloads one or more http/https files locally and atomically replaces targets after fully written.	standard+
reload_provider	Rebuilds selected provider snapshots by tag without triggering a full application reload.	minimal+
reload	Triggers the same application-level full reload as POST /reload.	minimal+
cron	Schedules executors in the background via cron expression or fixed interval.	standard+

Matcher plugins

See Matcher Plugins for full field reference.

Request dimensions

Plugin	Purpose	Included in
qname	Matches the query name in the request.	minimal+
question	Matches request questions using provider contains_question semantics.	minimal+
qtype	Matches request qtypes.	minimal+
qclass	Matches request qclasses.	minimal+
client_ip	Matches the client source IP.	minimal+
ptr_ip	Decodes the IP from a PTR query name and matches it.	minimal+

Response dimensions

Plugin	Purpose	Included in
resp_ip	Matches A and AAAA addresses in response answers.	minimal+
cname	Matches CNAME targets in the response.	minimal+
rcode	Matches the current response code.	minimal+
has_resp	Matches when a response already exists in the context.	minimal+
has_cname	Checks whether the response Answer section contains a CNAME record.	minimal+
has_wanted_ans	Matches when the response already contains answers of the wanted qtype.	minimal+

Context and expressions

Plugin	Purpose	Included in
mark	Matches marks already written into the DNS context.	minimal+
env	Matches process environment variables.	minimal+
time	Matches by timezone, time window, weekday, and day of month.	minimal+
random	Matches probabilistically for rollout or sampling.	minimal+
rate_limiter	Token-bucket rate limiting by client IP.	minimal+
string_exp	General-purpose string expression matcher for cases where dedicated matchers are too rigid.	minimal+

Composition and constants

Plugin	Purpose	Included in
any_match	Composes multiple matcher expressions; returns true when any one matches.	minimal+
_true	Always true.	minimal+
_false	Always false.	minimal+

Provider plugins

See Provider Plugins for full field reference.

Plugin	Purpose	Included in
domain_set	High-performance domain rule set, referenced by qname, cname, and similar plugins.	minimal+
dynamic_domain_set	Writable local domain rule file with hot-snapshot matching, API management, and learned appends.	standard+
geosite	Loads one or more codes from the v2ray-rules-dat geosite.dat into a reusable domain rule set.	standard+
adguard_rule	Provides a reusable subset of AdGuard Home DNS rule evaluation as a provider.	standard+
ip_set	IP / CIDR rule set, referenced by client_ip, resp_ip, ptr_ip, and similar matchers.	minimal+
geoip	Loads one or more codes from the v2ray-rules-dat geoip.dat into a reusable IP / CIDR set.	standard+