DNSCrypt-Proxy is a free, open-source DNS proxy for Windows, macOS, Linux, Android, BSD and Solaris. It accepts ordinary domain lookups locally, then sends them to upstream resolvers through encrypted protocols. Configuration files control resolver selection, local filtering, address overrides and query logging. An optional browser dashboard displays traffic and performance.
Resolvers and signed sources
Applications or network clients send DNS queries to the proxy’s listening addresses. DNSCrypt-Proxy handles encrypted upstream exchanges through DNSCrypt or DNS-over-HTTPS, including optional HTTP/3 connections. Its post-quantum DNSCrypt mode requires a compatible resolver.
Static server definitions use DNS stamps, which combine connection details such as addresses, protocols and cryptographic keys into one string. Alternatively, the proxy subscribes to resolver lists, verifies their signatures and refreshes them automatically. Each source supplies download locations, a local cache filename and a verification key.
Selection filters limit automatic choices by address family, protocol, DNSSEC capability and declared logging or filtering policies. Explicit server names override those filters, so manual selection uses the named resolvers instead. Optional hot reloading rereads rule files after edits; the default configuration leaves automatic reloading off.
Balancing queries and caching replies
For an uncached lookup, the proxy chooses one resolver from its eligible pool. Balancing strategies can prefer the fastest server, choose from a faster group or weigh recent performance. The proxy updates its rankings as response times change. A failed exchange does not automatically retry that same query through another resolver.
The DNS cache answers subsequent lookups locally within configurable lifetimes. It can retain successful replies and negative results, with separate minimum and maximum lifetimes for each. These controls determine how long the proxy reuses an answer before consulting upstream again.
Relay routes
Users can map a target resolver to one or more relays. DNSCrypt-Proxy encrypts the query for the target, while the relay passes that payload onward and carries the response back. A setting can exclude incompatible resolvers rather than contact them directly.
Anonymized DNSCrypt requires DNSCrypt-compatible routes; ordinary DoH traffic does not gain that routing simply through the same configuration. Oblivious DoH uses its own compatible targets and relays. Its configuration includes separate server and relay sources, plus routes that associate them. Separate connection settings route TCP traffic through a SOCKS proxy or DoH traffic through an HTTP proxy.
Local filtering
Name blocklists reject matching lookups before they reach an upstream resolver. Exact names, wildcards, prefixes and regular expressions define the target domains. IP blocklists instead reject replies that contain matching addresses. Allow rules create exceptions, including a particular subdomain within an otherwise blocked zone.
DNSCrypt-Proxy can attach a name rule to a weekly schedule. The schedule supplies weekdays and time ranges, while the rule supplies the domain pattern. That connection makes blocking or an exception apply during specific periods.
Forwarding and address overrides
Domain forwarding sends a chosen zone to a particular DNS server, such as a router that knows local device names. Those exchanges use ordinary, unencrypted DNS. The proxy deliberately leaves forwarded answers out of its cache so that the local server remains responsible for current device records.
Cloaking rules supply an address directly instead of consulting upstream. A name can map to an IPv4 or IPv6 address, or follow another hostname’s current address. This supports local development under real domain names and mappings to safe-search services.
IPv6 and browser requests
DNS64 fills a missing IPv6 answer by synthesizing an AAAA record from an IPv4 address. Users provide a translation prefix or discover it through a DNS64 resolver. A matching NAT64 gateway must translate the traffic; the proxy supplies the DNS records.
A local DoH listener accepts HTTPS DNS requests from browsers. Its controls specify the listening address, URL path, certificate and private key. The browser must trust that certificate. Requests then pass through the proxy’s resolver selection and local rules.
Logs and client addresses
Optional query logs identify requests and upstream servers, with response codes and durations. Separate files collect nonexistent names and filtering actions. TSV provides tab-separated rows, while LTSV adds labelled fields for log processors. Users can omit particular query types from the main query log.
IPCrypt can encrypt client-address fields before logging. Deterministic encryption keeps repeated addresses linkable, while nondeterministic modes change their representation between queries. These controls concern local records; resolver-selection filters separately handle declared upstream logging policies.
Live monitoring
The optional browser dashboard shows query statistics, cache utilization and server status. It also displays recent requests and response details when query logging is active. Privacy settings can show full information, anonymize client addresses or present aggregates without individual domains. Configurable login credentials and TLS govern access to the interface. A separate Prometheus endpoint publishes metrics when users enable it.
