flexible DNS proxy with support for encrypted DNS protocols
Project homepage: https://dnscrypt.info/
Description
dnscrypt-proxy is a flexible DNS proxy, with support for modern
encrypted DNS protocols such as DNSCrypt v2 including Post-Quantum
DNSCrypt (DNSCrypt 2026), DNS-over-HTTPS (with TLS 1.3 and QUIC),
Anonymized DNSCrypt and ODoH (Oblivious DoH), and features:
- Client IP addresses can be hidden using Tor, SOCKS proxies or
Anonymized DNS relays
- DNS query monitoring, with separate log files for regular and
suspicious queries
- Filtering: block ads, malware, and other unwanted content.
Compatible with all DNS services
- Time-based filtering, with a flexible weekly schedule
- Transparent redirection of specific domains to specific resolvers
- Optional hot-reloading of configuration files
- DNS caching, to reduce latency and improve privacy
- Local IPv6 blocking to reduce latency on IPv4-only networks
- Load balancing: pick a set of resolvers, dnscrypt-proxy will
automatically measure and keep track of their speed, and balance
the traffic across the fastest available ones.
- Cloaking: like a HOSTS file on steroids, that can return preconfigured
addresses for specific names, or resolve and return the IP address
of other names. This can be used for local development as well
as to enforce safe search results on Google, Yahoo, DuckDuckGo
and Bing
- Automatic background updates of resolvers lists
- Can force outgoing connections to use TCP
- Compatible with DNSSEC
- Includes a local DoH server in order to support ECH (ESNI)
Package information
- Ports path
- net/dnscrypt-proxy
- Package architecture
- amd64
- Maintainer
- Igor Zornik <mocheryl@mocheryl.org>
- Categories
- net, lang/go
- Available flavors
- None listed
- Only for architectures
- aarch64, amd64, arm, i386, riscv64
Ports list build and test dependencies as well as runtime dependencies. pkg_add selects those needed for installation.
Direct dependencies
Build
OpenBSD README
This README contains unresolved ports variables; replace them before using its commands.
+-----------------------------------------------------------------------
| Running dnscrypt-proxy on OpenBSD
+-----------------------------------------------------------------------
dnscrypt-proxy listens for DNS queries on a local address and forwards
them to a DNSCrypt resolver over an encrypted channel.
To use this package, several things are required.
Customizing dnscrypt-proxy.toml
===============================
Ensure that ${SYSCONFDIR}/dnscrypt-proxy.toml fits your needs.
Resolvers
---------
Uncomment 'server_names' to have a smaller set of public resolvers to be used
for load balancing. If this line is commented, all registered servers matching
the require_* filters will be used for load balancing. Refer to
${LOCALSTATEDIR}/dnscrypt-proxy/public-resolvers.md for a list of all public
resolvers.
Load balancing strategy
-----------------------
Note the load balancing strategy, controlled by 'lb_strategy'. It can be
set to one of the following values:
- 'wp2' (default): Weighted Power of Two - selects the better
performing server from two random candidates based on real-time RTT
and success rates.
- 'p2': Randomly choose 1 of the fastest 2 servers by latency.
- 'ph': Randomly choose from fastest half of servers.
- 'p<n>': Randomly choose from fastest n servers (e.g., 'p3' for fastest 3).
- 'first': Always use the fastest server.
- 'random': Randomly choose from all servers.
For more information, see
https://github.com/jedisct1/dnscrypt-proxy/wiki/Load-Balancing-Options
Logging
-------
Logging is disabled by default.
To log to ${LOCALSTATEDIR}/log/messages:
log_level = 2
use_syslog = true
To log to a custom file:
log_level = 2
log_file = '${LOCALSTATEDIR}/log/dnscrypt-proxy.log'
Daemon
======
Start the daemon:
# rcctl enable dnscrypt_proxy
# rcctl start dnscrypt_proxy
resolv.conf
===========
Managed by resolvd(8). One way is to disable it and force
${SYSCONFDIR}/resolv.conf to perform queries from dnscrypt-proxy:
nameserver 127.0.0.1
lookup file bind
For more information, see https://dnscrypt.info/