diff --git a/docs/en/README.md b/docs/en/README.md
index 4872aa4..bd36afc 100644
--- a/docs/en/README.md
+++ b/docs/en/README.md
@@ -180,7 +180,7 @@ dns {
     }
     response {
       upstream(googledns) -> accept
-      !qname(geosite:cn) && ip(geoip:private) -> googledns
+      ip(geoip:private) && !qname(geosite:cn) -> googledns
       fallback: accept
     }
   }
diff --git a/docs/en/configuration/dns.md b/docs/en/configuration/dns.md
index 356a130..c888ef7 100644
--- a/docs/en/configuration/dns.md
+++ b/docs/en/configuration/dns.md
@@ -62,7 +62,7 @@ dns {
             upstream(googledns) -> accept
             # If DNS request name is not in CN and response answers include private IP, which is most likely polluted
             # in China mainland. Therefore, resend DNS request to 'googledns' to get correct result.
-            !qname(geosite:cn) && ip(geoip:private) -> googledns
+            ip(geoip:private) && !qname(geosite:cn) -> googledns
             fallback: accept
         }
     }
@@ -112,7 +112,7 @@ dns {
       # Trusted upstream. Always accept its result.
       upstream(googledns) -> accept
       # Possibly polluted, re-lookup using googledns.
-      !qname(geosite:cn) && ip(geoip:private) -> googledns
+      ip(geoip:private) && !qname(geosite:cn) -> googledns
       # fallback is also called default.
       fallback: accept
     }
diff --git a/docs/en/tutorials/run-on-macos.md b/docs/en/tutorials/run-on-macos.md
index 828928a..116f485 100644
--- a/docs/en/tutorials/run-on-macos.md
+++ b/docs/en/tutorials/run-on-macos.md
@@ -127,7 +127,7 @@ dns {
     }
     response {
       upstream(googledns) -> accept
-      !qname(geosite:cn) && ip(geoip:private) -> googledns
+      ip(geoip:private) && !qname(geosite:cn) -> googledns
       fallback: accept
     }
   }
diff --git a/docs/zh/README.md b/docs/zh/README.md
index 0fef923..349fe97 100644
--- a/docs/zh/README.md
+++ b/docs/zh/README.md
@@ -174,7 +174,7 @@ dns {
     }
     response {
       upstream(googledns) -> accept
-      !qname(geosite:cn) && ip(geoip:private) -> googledns
+      ip(geoip:private) && !qname(geosite:cn) -> googledns
       fallback: accept
     }
   }
diff --git a/docs/zh/configuration/dns.md b/docs/zh/configuration/dns.md
index 6a720e5..179ec71 100644
--- a/docs/zh/configuration/dns.md
+++ b/docs/zh/configuration/dns.md
@@ -61,7 +61,7 @@ dns {
             # 接受upstream 'googledns' 回复的 DNS 响应。 有助于避免回环。
             upstream(googledns) -> accept
             # 若 DNS 请求的域名不属于 CN 且回复包含私有 IP， 大抵是被污染了，向 'googledns' 重查。
-            !qname(geosite:cn) && ip(geoip:private) -> googledns
+            ip(geoip:private) && !qname(geosite:cn) -> googledns
             fallback: accept
         }
     }
@@ -111,7 +111,7 @@ dns {
       # 可信的 upstream。总是接受它的回复。
       upstream(googledns) -> accept
       # 疑似被污染结果，向 'googledns' 重查。
-      !qname(geosite:cn) && ip(geoip:private) -> googledns
+      ip(geoip:private) && !qname(geosite:cn) -> googledns
       # fallback 意为 default。
       fallback: accept
     }
diff --git a/example.dae b/example.dae
index 5d3b777..9295c7e 100644
--- a/example.dae
+++ b/example.dae
@@ -152,7 +152,7 @@ dns {
             # Trusted upstream. Always accept its result.
             upstream(googledns) -> accept
             # Possibly polluted, re-lookup using googledns.
-            !qname(geosite:cn) && ip(geoip:private) -> googledns
+            ip(geoip:private) && !qname(geosite:cn) -> googledns
             # fallback is also called default.
             fallback: accept
         }