diff --git a/server/cmd/mockserver/main.go b/server/cmd/mockserver/main.go
index 3dca755..276d0dd 100644
--- a/server/cmd/mockserver/main.go
+++ b/server/cmd/mockserver/main.go
@@ -22,7 +22,7 @@ import (
 // Fields match the nodes table columns: reality_public_key / reality_short_id / hy2_password.
 // In production the API renders these per-user from the nodes table.
 // Placeholders here are mock values for integration testing only.
-const connectConfig = `{"log":{"level":"warn","timestamp":true},"inbounds":[{"type":"tun","tag":"tun-in","address":["172.19.0.1/30"],"mtu":9000,"auto_route":true,"strict_route":true,"stack":"system"}],"outbounds":[{"type":"vless","tag":"reality-out","server":"18.136.60.128","server_port":11443,"uuid":"ffffffff-ffff-ffff-ffff-ffffffffffff","flow":"xtls-rprx-vision","tls":{"enabled":true,"server_name":"www.apple.com","utls":{"enabled":true,"fingerprint":"chrome"},"reality":{"enabled":true,"public_key":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","short_id":"deadbeef"}}},{"type":"hysteria2","tag":"hy2-out","server":"18.136.60.128","server_port":443,"password":"mock-hy2-password","tls":{"enabled":true,"insecure":true,"alpn":["h3"]}},{"type":"urltest","tag":"auto","outbounds":["reality-out","hy2-out"],"url":"https://www.gstatic.com/generate_204","interval":"3m","tolerance":50},{"type":"block","tag":"block"},{"type":"direct","tag":"direct"}],"route":{"rules":[{"ip_cidr":["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"],"outbound":"direct"}],"final":"auto","auto_detect_interface":true},"dns":{"servers":[{"tag":"remote","type":"tls","server":"8.8.8.8","detour":"auto"},{"tag":"local","type":"udp","server":"223.5.5.5","detour":"direct"}],"final":"remote","strategy":"ipv4_only"}}`
+const connectConfig = `{"log":{"level":"warn","timestamp":true},"inbounds":[{"type":"tun","tag":"tun-in","address":["172.19.0.1/30"],"mtu":9000,"auto_route":true,"strict_route":true,"stack":"system"}],"outbounds":[{"type":"vless","tag":"reality-out","server":"18.136.60.128","server_port":11443,"uuid":"ffffffff-ffff-ffff-ffff-ffffffffffff","flow":"xtls-rprx-vision","tls":{"enabled":true,"server_name":"www.apple.com","utls":{"enabled":true,"fingerprint":"chrome"},"reality":{"enabled":true,"public_key":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","short_id":"deadbeef"}}},{"type":"hysteria2","tag":"hy2-out","server":"18.136.60.128","server_port":443,"password":"mock-hy2-password","tls":{"enabled":true,"insecure":true,"alpn":["h3"]}},{"type":"urltest","tag":"auto","outbounds":["reality-out","hy2-out"],"url":"https://www.gstatic.com/generate_204","interval":"3m","tolerance":50},{"type":"block","tag":"block"},{"type":"direct","tag":"direct"}],"route":{"rules":[{"ip_cidr":["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"],"outbound":"direct"}],"final":"auto","auto_detect_interface":true},"dns":{"servers":[{"tag":"remote","type":"tls","server":"8.8.8.8","detour":"auto"},{"tag":"local","type":"udp","server":"223.5.5.5"}],"final":"remote","strategy":"ipv4_only"}}`
 
 var reConnect = regexp.MustCompile(`^/v1/nodes/[^/]+/connect$`)
 
diff --git a/server/internal/httpapi/clientconfig.go b/server/internal/httpapi/clientconfig.go
index 67e9033..388b71f 100644
--- a/server/internal/httpapi/clientconfig.go
+++ b/server/internal/httpapi/clientconfig.go
@@ -126,7 +126,9 @@ func BuildClientConfig(node *nodes.NodeRow, dpUUID, deriveKey string) ([]byte, e
 	dns := map[string]any{
 		"servers": []any{
 			map[string]any{"tag": "remote", "type": "tls", "server": "8.8.8.8", "detour": "auto"},
-			map[string]any{"tag": "local", "type": "udp", "server": "223.5.5.5", "detour": "direct"},
+			// local 不带 detour:sing-box 1.12 拒绝 DNS detour 到空 direct 出站
+			// (FATAL: detour to an empty direct outbound makes no sense)。
+			map[string]any{"tag": "local", "type": "udp", "server": "223.5.5.5"},
 		},
 		"final":    "remote",
 		"strategy": "ipv4_only",