DNSCrypt: encrypted, authenticated DNS with clients, resolvers and setup guides

What DNSCrypt does to your DNS traffic

Ordinary DNS travels as plain text on port 53, so the café network, the hotel router or the internet provider can log every lookup and even forge replies. A DNSCrypt client wraps each query in authenticated encryption keyed to one specific resolver, and only that resolver can open it and answer it with a matching, verifiable reply.

The client learns the resolver's keys from a short certificate fetched over DNS and checked against a public key from the server stamp. Each query is padded to fixed sizes so their length gives little away. Version 2 of the protocol uses X25519 for key agreement and XChaCha20-Poly1305 for encryption, and recent releases add a post-quantum key exchange.

DNSCrypt is one of three common ways to get encrypted DNS, next to DNS-over-HTTPS and DNS-over-TLS. All three hide lookups from the local network; they differ in transport, in how easily a firewall can single them out and in what operating systems support out of the box. The guide to encrypted DNS compares them side by side.

Free DNSCrypt resolvers are available all over the world

Companies, non-profits and individuals run public recursive DNS servers supporting the DNSCrypt protocol, so most people only need to install a DNSCrypt client and pick DNSCrypt resolvers from the list. The public list currently describes 783 servers, 381 of them reachable over DNSCrypt and the rest over DNS-over-HTTPS, plus 316 relays that let queries travel without revealing who sent them.

The list is signed and refreshed regularly, and dnscrypt-proxy downloads it on its own, then picks servers that match the filters you set for logging, DNSSEC validation and content filtering. If you operate a public resolver and want it listed, the maintainers accept additions through a pull request on the project repository.

Installing a DNSCrypt client

DNSCrypt itself is a protocol rather than a single product, so there are several clients to choose from. The reference client, dnscrypt-proxy, runs on Windows, macOS, Linux, the BSDs, Solaris, Android and many routers, and graphical front ends exist for people who prefer not to edit a configuration file by hand.

Pick your platform below, or go straight to the installation guides, which walk through download, signature check, configuration and verification step by step. Firewalls should allow outgoing traffic to port 443 over both UDP and TCP, the default for DNSCrypt, although some resolvers prefer another port; the overview of DNS port numbers lists them all.

Testimonials

DNSCrypt for Windows

Simple DNSCrypt is a self-contained graphical client that bundles dnscrypt-proxy and runs the proxy as a service for you, with a window for choosing servers. DNSCrypt WinClient was an early DNSCrypt interface for Windows and still documents how the early setup worked, while dnscrypt-proxy itself runs as a Windows service configured from a text file.

Fake installers that pretend to be DNSCrypt clients and carry malware or unwanted programs have circulated for years. Download nothing that calls itself a DNSCrypt client from torrents, links under videos or file mirrors; take dnscrypt-proxy from its GitHub releases and check it with Minisign. The Windows guide covers the service install and the adapter settings.

DNSCrypt for macOS

DNSCrypt-OSXClient is a self-contained graphical interface for macOS that dates from the first generation of dnscrypt-proxy. On current macOS versions most people install dnscrypt-proxy itself, which runs natively and can be managed from the command line, then point the network settings at the local address it listens on, usually 127.0.0.1.

The quickest route is Homebrew, where one command installs dnscrypt-proxy and another starts it as a background service at every boot. A manual install from the GitHub releases works too and suits machines without Homebrew. The macOS guide shows both routes and how to confirm that lookups really go through the proxy.

DNSCrypt in the Yandex web browser

The Yandex web browser is a free desktop browser with its own security layer that scans downloads, warns about fraudulent pages and protects stored passwords and card details. It is one of the few browsers that has offered DNSCrypt directly, without installing any separate client, which makes it a simple option on a shared or locked-down computer.

The browser documents its built-in support for the DNSCrypt protocol in its help pages, including where the setting lives and which resolver it uses. Keep in mind that a browser setting protects only that browser; other applications on the same machine keep using the system resolver unless a system-wide client such as dnscrypt-proxy runs too.

DNSCrypt for Android

Early Android builds needed a rooted device, a custom recovery and an init script to start dnscrypt-proxy, and the xda-developers forum collected most of that knowledge. Two threads from that period remain useful background for anyone maintaining an older device: Starting the daemon on Android and How to install DNSCrypt on Android.

Today no root is needed. Apps that embed dnscrypt-proxy run it behind a local VPN interface, and Android 9 and later also offer the built-in Private DNS setting, which encrypts lookups with DNS-over-TLS. The Android guide explains when the built-in setting is enough and when a full DNSCrypt client with relays and filters is worth it.

DNSCrypt for iOS

On jailbroken devices, GuizmoDNS was the classic way to change DNS settings for mobile and Wi-Fi connections with DNSCrypt support, and a command-line dnscrypt-proxy build was distributed through the same Cydia channel. Those packages lagged behind the current releases, and jailbreaking is no longer necessary for encrypted DNS on an iPhone or iPad.

Since iOS 14, Apple supports encrypted DNS settings delivered through apps and configuration profiles, and apps with their own DNSCrypt client, such as AdGuard, bring DNSCrypt to an unmodified device. The iPhone and iPad guide lists the options and shows where the active profile appears in Settings, so you can see at a glance which resolver is in use.

DNSCrypt for routers

Running DNSCrypt on the router protects every device on the network at once, including televisions and game consoles that cannot run a client themselves. Open router firmwares such as Tomato Shibby and other Tomato variants have shipped a DNSCrypt client, and dnscrypt-proxy also builds for Intel, MIPS and ARM Linux targets of almost any kind.

OpenWrt packages dnscrypt-proxy, and its older wiki kept a page on DNSCrypt on OpenWRT; on other firmwares the client is available through Entware. The OpenWrt guide shows how to install the current package and forward the router's own resolver to it, which keeps local hostnames such as printers and storage boxes working.

dnscrypt-proxy, the reference DNSCrypt client

The most widely used DNSCrypt client is dnscrypt-proxy. It works on its own or underneath the graphical clients mentioned above, speaks both DNSCrypt and DNS-over-HTTPS, and adds caching, filtering, relay routing and query logging. Its documentation lives in the project wiki, and questions and bugs go to the project's Support tracker.

The protocol specification and the current documentation are maintained at dnscrypt.info, and new releases appear on the dnscrypt-proxy releases page. A history of versions, from the 1.x series to the current 2.x line, is kept on the dnscrypt-proxy download page, together with notes on checking each file before you run it.

Alternative clients and installation scripts for Unix

DNSCrypt-Loader is a console tool for Linux that manages the proxy, keeps the resolver list current and can switch the system DNS settings over to DNSCrypt. Pcap_DNSProxy is a fast DNS proxy with its own DNSCrypt implementation. Both come from the earlier generation of tools, so check their maintenance status before relying on them.

Take control of your DNS traffic with DNSCrypt

Beyond encryption, a DNSCrypt client gives you a clear view of the lookups leaving your network and a lot of control over them, from simple monitoring to rules that apply to every single device behind it on the network. With dnscrypt-proxy, or with a graphical client built on it, you can:

• review DNS traffic in real time and spot hosts or apps phoning home;
• block ads, trackers, malware and any names or IP ranges that match your own rules;
• stop lookups for local zones from leaking to outside resolvers;
• cut latency with a local cache and skip IPv6 lookups on IPv4-only networks;
• force TCP to route queries through TCP-only tunnels or Tor;
• send DNSCrypt queries through anonymizing relays so no single server sees both who you are and what you asked.

Relays are the feature people find hardest to set up, because each server needs relays run by someone else, ideally in another network. The route builder picks them from the public relay list and writes the configuration block for you, and the filtering guide covers blocklists, allowlists and cloaking rules.

Signature verification

Source code archives, precompiled binaries and the public resolver list are signed, so you can confirm that a file is exactly what the maintainers published. The tool for this is Minisign, a small program that checks a file against its detached signature and a public key. The resolver list, for example, is verified with this command:

minisign -VP RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3 -m public-resolvers.md

dnscrypt-proxy performs that check by itself every time it refreshes the list, and refuses a list whose signature fails. For release binaries, use the public key printed in the project wiki and the signature file published next to each download, and treat a failed check as a reason to delete the file rather than to retry the install.

Running your own DNSCrypt server

If you run a private or public recursive resolver, adding DNSCrypt support is a matter of putting a DNSCrypt front end in front of it. DNSCrypt-Wrapper is a dedicated server-side proxy and works with any resolver, including Unbound, PowerDNS Recursor and BIND. The Docker image for dnscrypt server bundles a validating Unbound resolver with key rotation.

Two general-purpose DNS programs also speak the protocol. dnsdist, a DNS load balancer built to route traffic to the best server while blocking abuse, can act as a DNSCrypt server. unbound, the validating and caching resolver, can do the same when built with DNSCrypt enabled, configured through its own options.

How a DNSCrypt deployment is laid out

A DNSCrypt setup has two halves. The client proxy listens on a local address such as 127.0.0.1, accepts ordinary DNS queries from the operating system, encrypts them for the chosen resolver and verifies each reply before passing it back. The server proxy decrypts the queries, hands them to a recursive resolver and encrypts the answers it receives.

The local network is where spoofing and snooping are easiest, which is why the client usually runs on the device itself, so protection starts before traffic leaves the laptop or phone. Running the client on the router protects every device at home but trusts the home network. DNSSEC then covers the part between the resolver and the authoritative servers.

Running your own DNSCrypt server on a trusted remote network gives complete control over logging and filtering, at the price of maintaining a resolver. For most people a public resolver with a no-logging policy and DNSSEC validation, reached through a relay, offers a good balance; the shortlist of DNS servers explains what to look for.

DNSCrypt for developers

The protocol is documented in an open specification, and the cryptography relies on well-studied primitives available in libsodium and other libraries, so a client or server can be written in almost any language. Server stamps, the compact sdns:// strings that describe a server, keep configuration portable between implementations and are easy to generate and decode.

The developer overview collects the specification, the stamp format, the server implementations and the history of the plugin interface from the 1.x series. To see how stamps decode in practice, every entry in the resolver directory can be expanded to show the protocol, address, port and properties its stamp declares.

Further reading: BestCasino.co.uk