Bug: DNS_UPSTREAM_PLAIN_ADDRESSES ignored - gluetun always uses 1.1.1.1

[karan]

Is this urgent?

No

Host OS

No response

CPU arch

None

VPN service provider

Custom

What are you using to run the container

docker-compose

What is the version of Gluetun

3.41.2 and 3.41.3

What's the problem 🤔

When upgrading from gluetun v3.41.1 to v3.41.2+ (tested v3.41.2 and v3.41.3), the DNS configuration variable DNS_UPSTREAM_PLAIN_ADDRESSES is ignored. gluetun's internal DNS forwarder always uses Cloudflare (1.1.1.1) as the upstream resolver regardless of configuration.

This is a regression from v3.41.1 where DNS_KEEP_NAMESERVER=on preserved the host's DNS chain. With DNS_KEEP_NAMESERVER removed in v3.41.2+, containers behind the VPN can no longer resolve internal hostnames.

Reproduction

1. Create a gluetun container with custom WireGuard config
2. Set DNS_UPSTREAM_PLAIN_ADDRESSES= to any custom IP
3. Set DNS_UPSTREAM_RESOLVER_TYPE=plain
4. Start the container
5. Observe gluetun logs: [dns] using plaintext DNS at address 1.1.1.1
6. From gluetun container, cat /etc/resolv.conf shows nameserver 1.1.1.1 at the top.

Expected behavior

gluetun should use the address(es) specified in DNS_UPSTREAM_PLAIN_ADDRESSES as the upstream DNS resolvers for its internal DNS forwarder.

Actual behavior

gluetun ignores DNS_UPSTREAM_PLAIN_ADDRESSES and always falls back to 1.1.1.1 (Cloudflare).

Workarounds attempted (all failed)

• Setting dns: 127.0.0.1 in Docker compose - does not fix the issue
• Setting DNS_UPSTREAM_RESOLVER_TYPE=plain - no effect
• Setting DNS_UPSTREAM_PLAIN_ADDRESSES=IP - gluetun still uses 1.1.1.1
• Setting DNS_UPSTREAM_PLAIN_ADDRESSES=IP:53 - same result

Share your logs (at least 10 lines)

2026-08-01T14:13:02-07:00 INFO [dns] using plaintext DNS at address 1.1.1.1


After setting `DNS_UPSTREAM_PLAIN_ADDRESSES=$IP` and `DNS_UPSTREAM_RESOLVER_TYPE=plain`:


[dns] using plaintext DNS at address 1.1.1.1


gluetun startup log showing DNS configuration:


├── DNS settings:
| ├── Upstream resolver type: plain
| ├── Upstream resolvers:
| | └── $IP
| ├── Caching: on
| ├── IPv6: off
| └── ...


Note: The startup log correctly shows the configured upstream resolver ($IP), but the actual DNS queries from containers use 1.1.1.1 instead.

Share your configuration

VPN_SERVICE_PROVIDER=custom
VPN_TYPE=wireguard
VPN_INTERFACE=wg0
DOT=off
FIREWALL=on
FIREWALL_VPN_INPUT_PORTS=removed
FIREWALL_OUTBOUND_SUBNETS=$IP/24
HEALTH_VPN_DURATION_INITIAL=120s
HEALTH_VPN_DURATION_ADDITION=5s
BLOCK_MALICIOUS=off
DNS_UPSTREAM_PLAIN_ADDRESSES=$IP
DNS_UPSTREAM_RESOLVER_TYPE=plain
DNS_CACHING=on
DNS_UPSTREAM_IPV6=off
UPDATER_PERIOD=0
VERSION_INFORMATION=on
HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATH=/gluetun/config.toml
WIREGUARD_MTU=1280


### Docker compose (relevant section)


vpn-client:
  image: qmcgaw/gluetun:v3.41.3
  container_name: vpn-client
  cap_add:
    - NET_ADMIN
  restart: always
  environment:
    - TZ=${TZ}
    - PUID=${PUID}
    - PGID=${PGID}
  env_file:
    - .gluetun.env
  volumes:
    - gluetun_vol:/gluetun
  devices:
    - /dev/net/tun:/dev/net/tun

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

how are you sure it uses 1.1.1.1? v3.41 still uses 1.1.1.1 initially before it sets up the built-in dns server (unlike latest) so that log line is a bit misleading. what do you get from docker exec gluetun cat /etc/resolv.conf?

Quick checking on my phone v3.41.1...v3.41.3 I don't see much change regarding the dns plaintext handling 🤔

[karan]

how are you sure it uses 1.1.1.1?

Many ways.

1. In the logs, I can see 2026-08-01T14:13:02-07:00 INFO [dns] using plaintext DNS at address 1.1.1.1
   2.cat /etc/resolv.conf shows nameserver 1.1.1.1 at the top of the file.
2. nslookup anything says Server: 1.1.1.1.

so that log line is a bit misleading. what do you get from docker exec gluetun cat /etc/resolv.conf?

nameserver 1.1.1.1
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

search <my ts id>.ts.net
options edns0 trust-ad ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [$IP 9.9.9.9 149.112.112.112]
# Overrides: [nameservers]
# Option ndots from: internal

To clarify, I think the bug here is that whatever DNS_UPSTREAM_RESOLVERS is set to gets added to /etc/resolv.conf at the top. I can repro this with DNS_UPSTREAM_RESOLVERS=quad9 - I get 9.9.9.9 instead of 1.1.1.1 everywhere.

[qdm12]

Looking at the env variable DNS_UPSTREAM_PLAIN_ADDRESSES, it was added in 199ad77 and I don't think it's part of any v3.41.x releases? Or am I missing something?

[qdm12]

With DNS_KEEP_NAMESERVER removed in v3.41.2+, containers behind the VPN can no longer resolve internal hostnames.

Yeah that's not correct, it's still in all v3.41 releases. v3.41.x > v3.41.0 releases are all bugfixes only, no features or big changes.

Closing this assuming it's a little user hallucination 😉

[github-actions]

Closed issues are NOT monitored, so commenting here will likely NOT be seen.
If you think this is still unresolved and have more information to bring, please either
re-open this issue or create another issue.

❤️😠 temporarily help the Gluetun community and fight the AI slop scam website gluetun[dot]com by setting BORINGPOLL_GLUETUNCOM=on on the latest image.
See the option in the wiki for more information

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor closed issues.

[karan]

Oh, I was following the docs in the wiki. Maybe the docs can clarify that the new flags aren't applicable to 3.41.x?

[qdm12]

My bad indeed it seems I forgot to tag a v3.41 for the wiki in https://github.com/qdm12/gluetun-wiki#versioning

In the meantime use qdm12/gluetun-wiki@9f282b8 which should be the commit matching v3.41.0 (and v3.41.1, 2 and 3)

I'll update the wiki soon

[qdm12]

v3.42 wiki tagged 😉