diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 0000000000..067492e2de
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,43 @@
+Checks: >
+  -*,
+  modernize-*,
+  bugprone-*,
+  concurrency-*,
+  misc-*,
+  readability-*,
+  performance-*,
+  portability-*,
+  google-*,
+  linuxkernel-*,
+  -bugprone-narrowing-conversions,
+  -bugprone-branch-clone,
+  -bugprone-reserved-identifier,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-sizeof-expression,
+  -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-suspicious-memory-comparison,
+  -bugprone-not-null-terminated-result,
+  -bugprone-signal-handler,
+  -concurrency-mt-unsafe,
+  -misc-unused-parameters,
+  -misc-misplaced-widening-cast,
+  -misc-no-recursion,
+  -readability-magic-numbers,
+  -readability-use-anyofallof,
+  -readability-identifier-length,
+  -readability-function-cognitive-complexity,
+  -readability-named-parameter,
+  -readability-isolate-declaration,
+  -readability-else-after-return,
+  -readability-redundant-control-flow,
+  -readability-suspicious-call-argument,
+  -google-readability-casting,
+  -google-readability-todo,
+  -performance-no-int-to-ptr,
+#   clang-analyzer-*,
+#   clang-analyzer-deadcode.DeadStores,
+#   clang-analyzer-optin.performance.Padding,
+#   -clang-analyzer-security.insecureAPI.*
+
+# Turn all the warnings from the checks above into errors.
+FormatStyle: file
diff --git a/src/Makefile b/src/Makefile
index c5edf90f81..c6b60cb0a3 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -15,8 +15,9 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 BIN=smartdns 
-OBJS_LIB=lib/rbtree.o lib/art.o lib/bitops.o lib/radix.o lib/conf.o lib/nftset.o
-OBJS=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o proxy.o $(OBJS_LIB)
+OBJS_LIB=lib/rbtree.o lib/art.o lib/bitops.o lib/radix.o
+OBJS_MAIN=smartdns.o fast_ping.o dns_client.o dns_server.o dns.o util.o tlog.o dns_conf.o dns_cache.o http_parse.o proxy.o lib/conf.o lib/nftset.o
+OBJS=$(OBJS_MAIN) $(OBJS_LIB)
 
 # cflags
 ifndef CFLAGS
@@ -51,5 +52,8 @@ all: $(BIN)
 $(BIN) : $(OBJS)
 	$(CC) $(OBJS) -o $@ $(LDFLAGS)
 
+clang-tidy:
+	clang-tidy -p=. $(OBJS_MAIN:.o=.c) -- $(CFLAGS)
+
 clean:
 	$(RM) $(OBJS) $(BIN)
diff --git a/src/dns.h b/src/dns.h
index e56691fc75..e44b0648ff 100644
--- a/src/dns.h
+++ b/src/dns.h
@@ -302,7 +302,7 @@ int dns_add_HTTPS_end(struct dns_rr_nested *svcparam);
 
 int dns_get_HTTPS_svcparm_start(struct dns_rrs *rrs, struct dns_https_param **https_param, char *domain, int maxsize,
 								int *ttl, int *priority, char *target, int target_size);
-struct dns_https_param *dns_get_HTTPS_svcparm_next(struct dns_rrs *rrs, struct dns_https_param *parm);
+struct dns_https_param *dns_get_HTTPS_svcparm_next(struct dns_rrs *rrs, struct dns_https_param *param);
 
 /*
  * Packet operation
diff --git a/src/dns_server.c b/src/dns_server.c
index 225235dbc6..d66b64ef28 100644
--- a/src/dns_server.c
+++ b/src/dns_server.c
@@ -3395,7 +3395,7 @@ static void _dns_server_query_end(struct dns_request *request)
 	/* Not need to wait check result if only has one ip address */
 	if (ip_num <= 1 && request_wait == 1) {
 		if (request->dualstack_selection_query == 1) {
-			if ((dns_conf_ipset_no_speed.ipv4_enable || dns_conf_nftset_no_speed.ip6_enable ||
+			if ((dns_conf_ipset_no_speed.ipv4_enable || dns_conf_nftset_no_speed.ip_enable ||
 				 dns_conf_ipset_no_speed.ipv6_enable || dns_conf_nftset_no_speed.ip6_enable) &&
 				dns_conf_dns_dns64.prefix_len == 0) {
 				/* if speed check fail enabled, we need reply quickly, otherwise wait for ping result.*/
diff --git a/src/fast_ping.c b/src/fast_ping.c
index 5850ef565c..6cc7de2ead 100644
--- a/src/fast_ping.c
+++ b/src/fast_ping.c
@@ -726,7 +726,7 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 
 	len = sendto(ping.fd_icmp6, &ping_host->packet, sizeof(struct fast_ping_packet), 0, &ping_host->addr,
 				 ping_host->addr_len);
-	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
+	if (len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
 		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EHOSTUNREACH) {
 			goto errout;
@@ -806,7 +806,7 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 	icmp->icmp_cksum = _fast_ping_checksum((void *)packet, sizeof(struct fast_ping_packet));
 
 	len = sendto(ping.fd_icmp, packet, sizeof(struct fast_ping_packet), 0, &ping_host->addr, ping_host->addr_len);
-	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
+	if (len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
 		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
@@ -858,7 +858,7 @@ static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 
 	gettimeofday(&ping_host->last, NULL);
 	len = sendto(fd, &dns_head, sizeof(dns_head), 0, &ping_host->addr, ping_host->addr_len);
-	if (len < 0 || len != sizeof(dns_head)) {
+	if (len != sizeof(dns_head)) {
 		int err = errno;
 		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL || errno == EPERM || errno == EACCES) {
 			goto errout;
diff --git a/src/tlog.c b/src/tlog.c
index 3622dc6eb2..6bab56cd10 100644
--- a/src/tlog.c
+++ b/src/tlog.c
@@ -187,7 +187,7 @@ static int _tlog_mkdir(const char *path)
         return 0;
     }
 
-    while (*path == ' ' && *path != '\0') {
+    while (*path == ' ') {
         path++;
     }
 
diff --git a/src/tlog.h b/src/tlog.h
index 0c3f71b294..78cb69158c 100644
--- a/src/tlog.h
+++ b/src/tlog.h
@@ -139,7 +139,7 @@ customize log output format
 read _tlog_format for example.
 */
 typedef int (*tlog_format_func)(char *buff, int maxlen, struct tlog_loginfo *info, void *userptr, const char *format, va_list ap);
-extern int tlog_reg_format_func(tlog_format_func func);
+extern int tlog_reg_format_func(tlog_format_func callback);
 
 /* register log output callback
  Note: info is invalid when flag TLOG_SEGMENT is not set.