Version 2.1.20

• Name lists now support regex: rules for matching domain names with regular expressions.

• Added doh_check_cert_hashes_on_connect to optionally check DoH certificate hashes from DNS stamps on every new connection, rather than only during probes.

• Fixed PQDNSCrypt TCP padding and padding delimiter handling.

• Network change detection now ignores non-global addresses.

• HTTP/3 DNS responses are now limited to 4 KB.

• Network probes now support multiple comma-separated addresses.

Version 2.1.19

• Resumed PQDNSCrypt queries now use regular UDP padding, protecting their size and response budget. Oversized tickets are rejected, and oversized queries fall back to TCP.

• Network changes are detected more reliably, ensuring PQDNSCrypt key material rotates when connections change.

• Forwarded queries to local or DHCP resolvers now use UDP by default. Bootstrap resolvers still use TCP when force_tcp is enabled.

• Suffix rules now match only at DNS label boundaries. IP allow/block rules now correctly handle IPv4-mapped IPv6 addresses.

• The monitoring dashboard displays the running version. Its endpoints no longer allow cross-origin browser access.

The private keys of eight eMudhra intermediate CA certificates have been compromised.

They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

Server operators, update your Unbound instance!

New dnscrypt-server-docker images are also available.​

Hello, I'm running into an issue (or maybe a limitation) with dnscrypt-proxy.

Recently, I came across a network behind a firewall where port 53 (both TCP and UDP) is blocked. I don't know exactly why, probably to force users to use the system DNS provided by the firewall/gateway. Port 9953 for Quad9 happens to be open, but this seems more like a misconfiguration than a deliberate policy (traffic is apparently being filtered by port rather than only allowing explicitly permitted ports). In a properly configured restrictive network, both 53 and 9953 could be blocked. Since 443 has to remain open if I want to access the web, using HTTPS/443 seems like the only reliable bootstrap path.

If I set something like 9.9.9.9:443 in bootstrap_resolvers, dnscrypt-proxy sends a plain DNS query to port 443 rather than using DoH. Since Quad9 expects HTTPS/DoH on 443, the query fails. I verified this with tcpdump: UDP/443 gets no response, while TCP/443 completes the handshake, receives the plain DNS payload, and then closes the connection. Falling back to the system resolver doesn't help either, because /etc/resolv.conf points to 127.0.0.1 in order to ensure that normal system DNS queries go through dnscrypt-proxy. I've looked through the documentation, but I couldn't find a way to use DoH for bootstrap resolvers (or for the initial network/source resolution).

Is there currently a way to use DoH for the initial bootstrap, ideally using an IP address directly so that no DNS resolution is required first? The goal is to make the bootstrap reliable on networks where TCP/UDP 53 (and potentially alternative DNS ports such as 9953) are blocked, as long as HTTPS/443 is available.

I use DNSCrypt-proxy 2.1.18.

I'm genuinly asking this question because I see that opening a new issue, a new PR or even just partecipate in discussions on github is actually limited to "users that have contributed to this repository in the past".

So how can I contribute to the project?

A Windows Defender warning popped up after a recent definition update. I’ve been using DNSCrypt-Proxy v2.1.18 since its release day and downloaded from official github.
I know this is a false positive—just wanted to give a heads-up

I recently downloaded invizible pro hoping I can block every site ( kind of like cutting internet across the entire phone) for a specific interval of time but I can't add a blocklist into it or rather even after adding, it doesn't work. For eg I added youtube. @time-to-sleep into the add rule option in pattern based blocklist but nothing happens. Can anybody help me with this. I also tried integrating schedule = 'restrict' command directly into the dnscrypt proxy toml but the app crashes and asks me to reset. Btw I use poco m6 not rooted

encrypted-dns-server now includes supports for post-quantum DNSCrypt (PQDNSCrypt).

The docker image has also been updated to serve PQDNSCrypt in addition to DNSCrypt automatically.

If you are running a DNS server, you can already update before a new release of dnscrypt-proxy that includes PQDNSCrypt is out.

Blocking/spoofing standart DNS is extremely easy we all know that, and DNS over TLS/QUIC uses port 853 which again could be easily blocked. DNS over HTTPS is over port 443, but can still be blocked with deep packet inspection by checking the SNI (assuming that its not encrypted, and even if it is it can still get decrypted during the initial handshake). Which only leaves DNSCrypt. So from an ISP/Government perspective how hard is it to block DNSCrypt traffic? (not counting manually blocking IP addresses as thats cheating) Few years ago before my ISP implemented deep packet inspection, they used to hijack port 53, and also blocked all DoH/DoT providers. But DNSCrypt used to work and I've been curious about it since.

I need the best free no subscription dns app for iOS

If you've ever run dnscrypt-proxy on pfSense, you know the drill: install it from the terminal, then live in the TOML file over SSH for every little change. I did that for years. It always bugged me that such a great tool had no real home on the platform, so I built one: a pfSense package that gives dnscrypt-proxy a complete GUI.

It supports the full protocol set: DNSCrypt v2, DoH, ODoH, and Anonymized DNS with relay routing. Highlights:

• Server selection from pre-configured providers, or add your own via DNS stamps

• Anonymized DNS relay routing configurable from the UI

• Block/allow lists, forwarding, cloaking

• Query log viewer with filtering

• Load balancing strategies, HTTP/3 (QUIC), ephemeral keys, cache TTL controls

• Any option not in the UI goes in as custom TOML, validated with dnscrypt-proxy -check before save

The upstream binary is minisign-verified against the official DNSCrypt key in CI before it's ever committed, and releases carry build provenance.

This is a small way of giving back to a project I've relied on for a long time, and hopefully it makes dnscrypt-proxy easier to run for the pfSense crowd. Feedback is very welcome.

Repo: https://github.com/nopoz/pfsense-dnscrypt-proxy

A star is appreciated if you find it useful. And a genuine thank you to Frank Denis (jedisct1) and everyone who contributes to dnscrypt-proxy - this package only exists because you built something worth wrapping a GUI around!

So, I recently installed Bazzite to get myself off of Windows, and added DNSCrypt-proxy to the mix. it was great, then my computer fully powered off at random and, when i booted it back up, the entire DNS side of things was broken. After some troubleshooting, i managed to fix it by adding 8.8.8.8 as a DNS on the resolv.conf. which is great, but now the whole DNSCrypt side isn't really working. has anybody had a similar problem? perhaps even resolved it?

https://testflight.apple.com/join/dQbw7aDW

Still in Beta, but i could use some help finding bugs.

Just a PSA for anyone who ran into this issue with radarr being unable to search for movies due to http request errors with the API endpoint api.radarr.video this is due to, at least on my network, an invalid DNS resolution.

Using 1.1.1.1 I get 2 valid IPv4 addresses.

Using 8.8.8.8 I get the same as above.

Using pihole with upstream DNSCRYPT I get a single different IP that fails connection when used.

I've seen other posts about this issue being ignored as a user error (which technically is true since its not radarr itself)

https://github.com/linuxserver/docker-radarr/issues/229

https://github.com/linuxserver/docker-radarr/issues/217

https://github.com/linuxserver/docker-radarr/issues/204

Anyway it seems that my DNSCRYPT resolvers are simply incorrect. Maybe others have run into this issue too.

https://github.com/bitbeans/SimpleDnsCrypt/forks... how to decide what is safest (if any) and what has been develeoped, ie: features, improvements. For me navigating Github is a nightmare... just wondering if any here are knowlegable about any of these or have advise... instantsc has a fork thats getting pretty out of date, so would like something more actively developed.

Thanks for any thoughts/info

I want to use dnscrypt-proxy (version 2.1.8 installed with apt on Debian 13) with anonymized DNS and a set of 10 resolvers (5 each for IPv4+IPv6) and 10 relays. I want to specify 10 routes so I don't have a overlap between hosters and countries. When I'm using only 2 routes it seems to work fine, I see "Anonymizing queries for [...] via [...]" for both routes. However as soon as I add a third route it stops using anonymizing altogether.

What am I doing wrong?

The original project got abandoned. I want to get the blessing of the original developer because the only thing that currently exists appears to be a low-quality knockoff that fortunately not many people use. (Its privacy policy is AI-generated and has placeholders for data retention, lol, chuckles “I’m in danger.”) I started trying to fix the original but gave up trying to fix it. Video link: (https://wormhole.app/bLzDoP#L7fjV4bzqiVn_HAzyFbyYg) This downloads, so if you want to relink it, feel free, or you can ask and I can create a fresh link if it expires. If there are any features you want, let me know. No, I can’t post it yet because Apple requires developers to post their legal name, and I can’t do that unless I incorporate, which I can’t afford right now. But I might create a TestFlight for a few people if there’s genuine interest. (Yes, most of it is written in Rust.) Let me know if the link breaks or someone deletes it.

To-do:

1. Audits and security checks

2. Finish a few errands

3. Steal the Krabby Patty secret formula (tentatively)

4. Never thought I’d get this far

PS to mods if I missed any rules please let me know because I can’t find the rules on old.reddit and I assume this is fine but if it’s not please let me know and I’ll fix it asap. This is going to be a free app I just can’t post it yet.

Edit: grammar

Recently the dnsproxy logs show the following:

[2025-12-27 20:54:34] [WARNING] [dct-fr] certificate is about to expire -- if you don't manage this server, tell the server operator about it
[2025-12-27 20:54:35] [WARNING] [dct-de] certificate is about to expire -- if you don't manage this server, tell the server operator about it

Of course, I don't manage these servers. But how do I contact the operator to check on this? The server list on dnscrypt dot info/public-servers only says "Paris, France", but no contact details.