Short answer

MASQUE is a tunnel-style outbound based around HTTP/3/QUIC ideas, with key, IP, MTU, DNS and congestion-control fields. In real use, trust the provider subscription first and then verify whether the selected client core supports this exact type.

What It Means

In Clash/Mihomo configuration, masque identifies the outbound type used by the node, policy or group. The same display name in a GUI can hide different transport fields, so the YAML or subscription output is more reliable than the node nickname.

Common Fields

type: masque
private-key / public-key
ip / ipv6
mtu
remote-dns-resolve
dns
network

When to Use It

The subscription explicitly provides MASQUE.
Both server and client are deployed for MASQUE.
A tunnel-style outbound is needed with explicit DNS/MTU settings.

Support Checks Checks

Key fields are usually base64-encoded; avoid copying PEM headers.
Bad MTU or remote DNS settings can break specific sites.
QUIC/UDP restrictions may prevent connection.

Minimal Shape

proxies:
- name: "masque-node"
  type: masque
  server: server.example.com
  port: 443
  private-key: BASE64_PRIVATE_KEY
  public-key: BASE64_PUBLIC_KEY
  ip: 172.16.0.2/32
  udp: true

Compatibility Notes

Client support changes with the bundled core. A maintained Mihomo-based client usually supports more modern node types than historical Clash clients, but mobile clients and iOS alternatives still vary by app and release.

If a subscription contains this type but the client filters it out, switch to a compatible client, ask the provider for a compatible subscription format, or use a converter only when you understand what fields are being changed.

Official Reference

MASQUE in Mihomo docs

MASQUE Protocol