{ "log": { "disabled": false, "level": "...

整体判断：你的配置框架是正确的，而且既然目前运行良好，不需要推倒重写。 我建议做一次“小幅收紧”，重点不是追求更多规则，而是让 TUN、DNS 和路由规则完全对应，同时去掉 1.14 已废弃/无效/未使用的东西。

你这份实际上是 sing-box 1.14 系列语法。例如新 DNS Server 格式、preferred_by、TUN 的 dns_mode、cache_file.store_dns 都是新版本语法。官方 1.14 的 TUN 已支持 dns_mode: hijack；Windows 下配合 strict_route 会阻止普通多网卡 DNS 从非 TUN 接口泄露。(Sing Box)

我检查下来，主要有这些地方值得改：

1. 你最前面的 "rule_set": [null] 没有意义，直接删掉。规则集应该引用实际 tag，不应该留 null。
2. 你原来的 DNS 没有完全镜像路由规则。比如你强制 linux.do、v2ex.com、nodeseek.com 等走 PROXY，但如果其中某个域名命中了 cn DNS 规则，它的 DNS 仍然会直接送 AliDNS。严格讲这不属于传统 DNS 泄露，但会出现“流量走代理、DNS 却走国内直连”的隐私不一致。我在最终版里让这些强制代理域名优先走 dns-global。
3. dns-global 明确 detour: PROXY 是正确的；新的 HTTPS DNS Server 本身默认是直连拨号器，所以 dns-cn 不设置 detour 就是直连，而 Cloudflare DNS 设置 PROXY 后才会明确经代理。(Sing Box)
4. 我给 TUN 增加了一个 IPv6 ULA 地址。你目前只有 172.19.0.1/30 IPv4；虽然 ipv4_only 已经大幅减少 IPv6 使用，但宿主机若存在原生 IPv6，缓存/硬编码 IPv6 连接仍不值得冒险。官方 address 本身就是同时承载 IPv4/IPv6 前缀的字段，官方迁移示例也同时配置两种地址。(Sing Box)
5. independent_cache 在 1.14 已废弃，直接删除即可；store_dns 已经可以持久化完整 DNS cache，所以你原来的 rdrc_timeout、没有实际 FakeIP 时的 store_fakeip 也没必要保留。(Sing Box)
6. download_detour 在 1.14 已经被标记为废弃，未来 1.16 会移除。最终版改成一个顶层 http_clients，让所有远程规则集统一通过 PROXY 下载，这是 1.14 推荐的新写法。(Sing Box)
7. 你定义了 proxy.srs 却没有使用。我建议直接删掉；DustinWin 的规则说明中 gfw / proxy 本来也经常是替代选择。(github.com)

还有一个地方请你自己确认：你节点域名是 xi.9598.xyz、SNI 是 psord.9598.xyz，但直连规则写的是 959698.xyz。这看起来很像笔误，但因为也可能是你另外一个域名，我没有擅自改。如果你本意确实是节点域名后缀，请把代码里的 959698.xyz 改成 9598.xyz。

另外，你刚才贴出来的 Clash API secret 和 VLESS UUID 都应该视为已经暴露。下面我不重复你的原值。Clash API secret 建议立即重新生成；VLESS UUID 如果服务器是你自己的，也建议服务端和客户端一起换掉。

最终建议配置

json
{
  "log": {
    "disabled": false,
    "level": "info",
    "output": "",
    "timestamp": true
  },
  "experimental": {
    "clash_api": {
      "external_controller": "127.0.0.1:9090",
      "external_ui": "",
      "external_ui_download_url": "",
      "secret": "REPLACE_WITH_NEW_CLASH_API_SECRET",
      "default_mode": "Rule",
      "access_control_allow_origin": [
        "http://127.0.0.1",
        "http://localhost",
        "http://clash.razord.top",
        "https://clash.razord.top",
        "http://yacd.haishan.me",
        "https://yacd.haishan.me"
      ],
      "access_control_allow_private_network": true
    },
    "cache_file": {
      "enabled": true,
      "path": "cache.db",
      "cache_id": "ID_4nm8o2j0",
      "store_dns": true
    }
  },
  "http_clients": [
    {
      "tag": "ruleset-proxy",
      "detour": "PROXY"
    }
  ],
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "singtun0",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "mtu": 1500,
      "auto_route": true,
      "strict_route": true,
      "dns_mode": "hijack",
      "stack": "system"
    },
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 7890,
      "tcp_fast_open": false,
      "tcp_multi_path": false,
      "udp_fragment": false
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "PROXY",
      "default": "1",
      "interrupt_exist_connections": true,
      "outbounds": [
        "1"
      ]
    },
    {
      "type": "selector",
      "tag": "DIRECT",
      "default": "direct",
      "interrupt_exist_connections": true,
      "outbounds": [
        "direct"
      ]
    },
    {
      "type": "selector",
      "tag": "REJECT",
      "default": "block",
      "interrupt_exist_connections": true,
      "outbounds": [
        "block"
      ]
    },
    {
      "tag": "1",
      "type": "vless",
      "server": "xi.9598.xyz",
      "server_port": 40001,
      "uuid": "REPLACE_WITH_NEW_OR_CURRENT_VLESS_UUID",
      "tls": {
        "enabled": true,
        "server_name": "psord.9598.xyz",
        "insecure": false,
        "reality": {
          "enabled": true,
          "public_key": "zQuwOjryLZzOhHwUUar0E7IrgsxZCPM987SLDQCyPmE",
          "short_id": "7323b654d4"
        },
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "packet_encoding": "xudp",
      "flow": "xtls-rprx-vision"
    },
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "action": "hijack-dns",
        "protocol": "dns"
      },
      {
        "action": "route",
        "ip_is_private": true,
        "outbound": "DIRECT"
      },
      {
        "action": "route",
        "rule_set": [
          "private"
        ],
        "outbound": "DIRECT"
      },
      {
        "action": "reject",
        "rule_set": [
          "ads"
        ],
        "method": "default"
      },
      {
        "action": "route",
        "domain": [
          "cdn.zhezhi.art",
          "test.ustc.edu.cn",
          "clash.razord.top",
          "yacd.haishan.me"
        ],
        "domain_suffix": [
          "cc.cd",
          "959698.xyz"
        ],
        "outbound": "DIRECT"
      },
      {
        "action": "route",
        "domain": [
          "emby101.origamiart.uk"
        ],
        "domain_suffix": [
          "1password.com",
          "nodeseek.com",
          "lightting.net",
          "online-fix.me",
          "linux.do",
          "v2ex.com"
        ],
        "outbound": "PROXY"
      },
      {
        "action": "route",
        "rule_set": [
          "kaspersky",
          "tencent",
          "icloud",
          "apple"
        ],
        "outbound": "DIRECT"
      },
      {
        "action": "route",
        "rule_set": [
          "spotify",
          "cloudflare",
          "google",
          "youtube",
          "telegram",
          "telegramip",
          "twitter",
          "ai",
          "github",
          "gfw"
        ],
        "outbound": "PROXY"
      },
      {
        "action": "route",
        "rule_set": [
          "cn"
        ],
        "outbound": "DIRECT"
      },
      {
        "action": "route",
        "rule_set": [
          "cnip"
        ],
        "outbound": "DIRECT"
      }
    ],
    "rule_set": [
      {
        "tag": "private",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/private.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "ads",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/category-ads-all.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "spotify",
        "type": "remote",
        "url": "https://github.com/DustinWin/ruleset_geodata/releases/download/sing-box-ruleset/spotify.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "youtube",
        "type": "remote",
        "url": "https://github.com/DustinWin/ruleset_geodata/releases/download/sing-box-ruleset/youtube.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "ai",
        "type": "remote",
        "url": "https://github.com/DustinWin/ruleset_geodata/releases/download/sing-box-ruleset/ai.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "gfw",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/gfw.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "cn",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/cn.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "cnip",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geoip/cn.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "telegramip",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geoip/telegram.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "kaspersky",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-kaspersky.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "tencent",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-tencent.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "icloud",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-icloud.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "apple",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/apple.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "cloudflare",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/cloudflare.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "google",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/google.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "telegram",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/telegram.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "twitter",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/twitter.srs",
        "format": "binary",
        "update_interval": "1d"
      },
      {
        "tag": "github",
        "type": "remote",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/sing/geo/geosite/github.srs",
        "format": "binary",
        "update_interval": "1d"
      }
    ],
    "auto_detect_interface": true,
    "final": "PROXY",
    "default_domain_resolver": {
      "server": "dns-cn"
    },
    "default_http_client": "ruleset-proxy"
  },
  "dns": {
    "servers": [
      {
        "tag": "dns-local",
        "type": "local"
      },
      {
        "tag": "dns-cn",
        "type": "https",
        "server_port": 443,
        "server": "223.5.5.5",
        "path": "/dns-query"
      },
      {
        "tag": "dns-global",
        "type": "https",
        "detour": "PROXY",
        "server_port": 443,
        "server": "1.1.1.1",
        "path": "/dns-query"
      }
    ],
    "rules": [
      {
        "action": "route",
        "preferred_by": "dns-local",
        "server": "dns-local"
      },
      {
        "action": "route",
        "rule_set": [
          "private"
        ],
        "server": "dns-local"
      },
      {
        "action": "reject",
        "rule_set": [
          "ads"
        ],
        "method": "default"
      },
      {
        "action": "route",
        "domain": [
          "cdn.zhezhi.art",
          "test.ustc.edu.cn",
          "clash.razord.top",
          "yacd.haishan.me"
        ],
        "domain_suffix": [
          "cc.cd",
          "959698.xyz"
        ],
        "server": "dns-cn"
      },
      {
        "action": "route",
        "domain": [
          "emby101.origamiart.uk"
        ],
        "domain_suffix": [
          "1password.com",
          "nodeseek.com",
          "lightting.net",
          "online-fix.me",
          "linux.do",
          "v2ex.com"
        ],
        "server": "dns-global"
      },
      {
        "action": "route",
        "rule_set": [
          "kaspersky",
          "tencent",
          "icloud",
          "apple"
        ],
        "server": "dns-cn"
      },
      {
        "action": "route",
        "rule_set": [
          "spotify",
          "cloudflare",
          "google",
          "youtube",
          "telegram",
          "twitter",
          "ai",
          "github",
          "gfw"
        ],
        "server": "dns-global"
      },
      {
        "action": "route",
        "rule_set": [
          "cn"
        ],
        "server": "dns-cn"
      }
    ],
    "disable_cache": false,
    "disable_expire": false,
    "final": "dns-global",
    "strategy": "ipv4_only"
  }
}

DNS 泄露结论

按这个版本，我认为传统 DNS 泄露风险已经比较低。

普通系统 DNS 会被 TUN 的 dns_mode: hijack 接管；Windows 再由 strict_route 阻止普通 53 端口从其他接口出去。官方明确说明这正是 strict_route 在 Windows 上的用途之一。(Sing Box)

最终解析路径基本是：

本地/LAN 域名 → dns-local

中国大陆/明确直连域名 → AliDNS 223.5.5.5 DoH，DIRECT

明确代理/GFW/Google/YouTube/Telegram/AI/GitHub 等 → Cloudflare 1.1.1.1 DoH，PROXY

其余未知域名 → Cloudflare DoH，PROXY

所以随机 DNS 泄露测试域名通常会走 dns-global，不会去运营商 DNS。

唯一需要区分的是 dns-local：它本来就是为了 hosts、局域网主机、.local/mDNS 等本地名称而存在的；1.14 的 preferred_by 正是官方为这类 split DNS 场景提供的机制。它使用系统/本地解析能力并不算你的公网 DNS 泄露。(Sing Box)

还有一种情况无法靠 hijack-dns 完全“劫持”：Chrome/Firefox/某些程序自己内置的 DoH/DoQ。因为那已经是 HTTPS/QUIC 应用流量，而不是普通 53 端口 DNS。不过这些连接仍然会经过你的 TUN 和 route；在你的 final: PROXY 设计下，大多数未知国外 DoH 也会经代理出去，因此问题不大。

最后，在真正替换配置前建议跑一次：

bash
sing-box check -c config.json

官方也把 sing-box check 作为配置验证方式。(Sing Box)

如果 check 通过，我建议就直接长期用这个版本，不需要再继续堆规则。 你现在真正值得做的只剩两件事：确认 959698.xyz 是否笔误，以及更换刚才暴露的 Clash API secret / VLESS UUID。