DOCSEARCHbyAlgolia
Submit Docs

dnscrypt-proxy

repository·master·Indexed 12 days ago

https://github.com/dnscrypt/dnscrypt-proxy

A flexible DNS proxy providing encryption and authentication for DNS traffic using protocols such as DNSCrypt v2 (including PQDNSCrypt), DNS-over-HTTPS (DoH), and ODoH. It features DNS caching, load balancing, ad and malware filtering, and the ability to hide client IP addresses via Tor, SOCKS, or Anonymized DNS relays.

Tokens
1.7K
Snippets
6
Records
8
Agent score
96%

What's inside dnscrypt-proxy

  1. Overview of dnscrypt-proxy

    master

    dnscrypt-proxy is a flexible DNS proxy designed to provide DNS traffic encryption and authentication. It supports several modern encrypted DNS protocols, including:

    • DNSCrypt v2 (including Post-Quantum DNSCrypt/PQDNSCrypt)
    • DNS-over-HTTPS (DoH) using TLS 1.3 and QUIC
    • Anonymized DNSCrypt
    • ODoH (Oblivious DoH)

    It is used to improve privacy and security by preventing DNS eavesdropping and tampering, and can be configured to hide client IP addresses using Tor, SOCKS proxies, or Anonymized DNS relays.

  2. Key features of dnscrypt-proxy

    master

    dnscrypt-proxy provides several advanced DNS management capabilities:

    • Privacy & Anonymity: Encrypts DNS traffic; supports hiding client IPs via Tor, SOCKS, or Anonymized DNS relays.
    • Filtering: Ability to block ads, malware, and unwanted content; supports time-based filtering with a weekly schedule.
    • Performance: Includes DNS caching to reduce latency and automatic load balancing that measures and tracks resolver speeds to use the fastest ones.
    • Traffic Control: Transparent redirection of specific domains to specific resolvers; can force outgoing connections to use TCP.
    • Cloaking: Acts as an advanced HOSTS file, returning preconfigured addresses for specific names or resolving/returning IPs of other names (useful for local development or enforcing safe search).
    • Management: Automatic background updates of resolver lists; optional hot-reloading of configuration files (note: disabled by default since v2.1.10).
    • Compatibility: Supports DNSSEC and includes a local DoH server to support ECH (ESNI).

  3. Download and install dnscrypt-proxy

    master

    You can obtain the latest version of dnscrypt-proxy as source code or as pre-built binaries.

    Pre-built Binaries

    Pre-built binaries are available for a wide range of operating systems and architectures, including:

    • Android: arm, arm64, x86, x86_64
    • Linux: arm, arm64, mips, mipsle, mips64, mips64le, x86, x86_64
    • macOS: arm64, x86_64
    • Windows: Windows, Windows 64 bit, Windows ARM
    • BSD: FreeBSD (arm, x86, x86_64), OpenBSD (x86, x86_64), NetBSD (x86, x86_64), Dragonfly BSD

    Installation Instructions

    For detailed steps on how to use these files and how to verify their signatures, refer to the official installation instructions.

    https://github.com/dnscrypt/dnscrypt-proxy/releases/latest

  5. Manage dnscrypt-proxy as a system service

    master

    On supported platforms, dnscrypt-proxy can be installed and managed as a system service using the -service flag. This allows the proxy to run in the background and be controlled by the operating system's service manager.

    # Install the proxy as a service
./dnscrypt-proxy -service install

# Start the service
./dnscrypt-proxy -service start

# Stop the service
./dnscrypt-proxy -service stop

# Restart the service
./dnscrypt-proxy -service restart

# Uninstall the service
./dnscrypt-proxy -service uninstall

  7. Reference: dnscrypt-proxy CLI flags

    master

    The following flags are available for the dnscrypt-proxy executable:

    -service <action>      Control the system service: "install", "uninstall", "start", "stop", "restart"
-version               print current proxy version
-resolve <name>        resolve a DNS name (string can be <name> or <name>,<resolver address>)
-list                  print the list of available resolvers for the enabled filters
-list-all              print the complete list of available resolvers, ignoring filters
-include-relays        include the list of available relays in the output of -list and -list-all
-json                  output list as JSON
-check                 check the configuration file and exit
-config <path>         Path to the configuration file (default: dnscrypt-proxy.toml)
-child                 Invokes program as a child process
-netprobe-timeout <n>  Override the netprobe timeout
-show-certs            print DoH certificate chain hashes

  8. Use dnscrypt-proxy CLI flags

    master

    The dnscrypt-proxy binary accepts several command-line flags to control its behavior, manage services, and inspect available resolvers. Common tasks include checking configuration validity, listing resolvers, or managing the system service.

    # Check if the configuration file is valid
./dnscrypt-proxy -check

# List available resolvers (respecting filters)
./dnscrypt-proxy -list

# List all available resolvers, including relays, in JSON format
./dnscrypt-proxy -list-all -include-relays -json

# Specify a custom configuration file
./dnscrypt-proxy -config /path/to/custom.toml

# Print the current version
./dnscrypt-proxy -version