Add encrypted DNS presets (#5837)

docs/xray-dns.md

@@ -0,0 +1,19 @@
+# Xray DNS presets and leak notes
+
+The panel DNS preset menu supports plain DNS, DoH, and DoQ server entries accepted by Xray's built-in DNS config. These notes follow Xray's DNS server address forms documented in <https://xtls.github.io/en/config/dns.html>.
+
+- Plain DNS uses UDP/53 and follows routing unless a local-mode scheme is used. It is easy to observe on the server network path.
+- DoH uses `https://.../dns-query` and goes through Xray routing.
+- DoQ uses `quic+local://...` in Xray. Local mode bypasses Xray routing and connects directly through Freedom, which avoids DNS routing loops but can reveal resolver traffic from the server IP.
+- Xray DNS does not have a direct DoT URL scheme. Use DoH/DoQ, or wrap DNS-over-TCP/TLS outside this DNS config if DoT is required.
+
+Leak-prone settings:
+
+- `localhost` uses the host resolver and is outside Xray control.
+- `tcp+local://`, `https+local://`, and `quic+local://` bypass Xray routing by design.
+- Domain resolver names can need system DNS in local mode unless pinned in `hosts`.
+- `disableFallback: false` or `enableParallelQuery: true` can query fallback servers and reveal domains to more than one provider.
+- `clientIp` sends EDNS Client Subnet data upstream.
+- Plain IP/UDP DNS presets are not encrypted.
+
+For privacy-sensitive setups, prefer DoH through routed outbounds, add `hosts` pins for resolver hostnames, set `disableFallback` or `skipFallback` where fallback is not wanted, and keep `clientIp` empty.