VPN over DNS lets the app reach your SoftEther server on networks that block almost everything except DNS lookups — for example some hotel, airport, campus, or captive‑portal Wi‑Fi, and some restrictive mobile carriers. When it is on, the whole VPN session is tunnelled inside DNS traffic on UDP port 53 instead of the usual TCP connection.
It is a last‑resort transport: it gets you connected where a normal connection can’t, at the cost of lower speed and higher latency. Leave it off unless a regular connection is being blocked.
When to use it
Turn VPN over DNS on when all of the following are true:
- A normal connection to your server fails or times out on the current network.
- The network still resolves domain names (web pages that use a captive portal, or basic name lookups, still work).
- Your server administrator has enabled the VPN over DNS function on the SoftEther server (see Server requirements).
If a normal connection works, keep this off — it is much slower.
Note. Even with VPN over DNS turned off, the app already tries a DNS‑based path automatically as a fallback while connecting. Turning the option on makes the app skip TCP entirely and go straight over DNS, which connects faster on a DNS‑only network and avoids waiting for the blocked TCP attempt to time out.
Server requirements
VPN over DNS only works if the server side supports it:
- The SoftEther VPN Server must have the built‑in “VPN over DNS / VPN over
ICMP” function enabled. In SoftEther Server Manager this is under
Encryption and Network → “Enable the VPN over ICMP / VPN over DNS Server
Functions” (also settable with the
SetSpecialListeneradministrative command). - The server must be reachable at an IPv4 address (this transport is IPv4‑only).
- No firewall between you and the server may block outbound UDP port 53 to the server’s address.
If the function is off on the server, the connection will fail even though the option is enabled in the app.
How to enable it
- Open the app and edit (or create) a connection profile.
- Scroll to the connection options and turn on VPN over DNS.
- Save the profile and connect as usual.
While connecting, the log shows a line such as:
VPN over DNS is ON — tunnelling over DNS (UDP/53); expect higher latency.That confirms the app is using the DNS transport for this session.
What changes when it’s on
| Setting | Behaviour with VPN over DNS |
|---|---|
| Transport | Session runs over SoftEther R‑UDP‑over‑DNS on UDP/53 instead of TCP. |
| Speed / latency | Noticeably slower and higher‑latency than a normal connection. |
| Server port | The profile’s TCP Port is ignored for the tunnel; DNS uses UDP/53. |
| UDP acceleration | Automatically disabled (its direct‑UDP channel would be blocked on a DNS‑only network). The switch is greyed out. |
| Dual connection | Not available. A single DNS transport carries the session, so there is no second port to reserve. If both are enabled, the app falls back to a single connection. |
| Parallel connections | Still honoured, but keep the count low — DNS is a slow transport and extra links add overhead. |
| Kill switch, routing mode, manual IP, authentication | Work normally; they are independent of the transport. |
Limitations
- IPv4 only. The server must have a reachable IPv4 address.
- Bandwidth. Data is carried inside DNS messages, so throughput is limited and latency is high. It is fine for messaging, email, and light browsing; it is not suited to streaming or large downloads.
- Server‑dependent. If the server’s VPN‑over‑DNS function is off, it will not connect.