dnscrypt-proxy is a free open-source encrypted DNS proxy for people who want website-name lookups encrypted before they leave home.123 It runs on a computer or a router, and the configuration decides which resolvers it may use.57 DNS is the address book that turns a name into a numeric address.1 The original design had no encryption and no authentication, so anything between you and the server could monitor that traffic or interfere with it.1 DNSCrypt encrypts the exchange, checks that the answer came from the chosen resolver, and can hide your address from that resolver.1 The Academy’s beginner’s guide to encrypted DNS explains encrypted DNS before you change a setting.
Last checked October 28, 2026.
At a glance
- What it is: A local DNS proxy with encrypted lookup protocols, filtering and a cache.2
- Works on: Windows, macOS, Linux, Android, and FreeBSD, NetBSD, OpenBSD and Dragonfly BSD. Router installs are documented too.25
- Price: The project publishes source and pre-built builds. The ISC licence allows use with or without a fee. Contributions are invited.23
- Licence: ISC. The copyright line names Frank Denis, 2018–2026.3
- Best for: A household willing to edit one configuration file so a computer, or a router, uses encrypted DNS.
- Official site: dnscrypt.info
What dnscrypt-proxy does (and how it protects your privacy)
A resolver is the server that answers a DNS lookup. dnscrypt-proxy sits on your machine and forwards those questions over an encrypted channel. The project describes it as a way to block unwanted names, see where devices are sending lookups, cache answers so apps feel quicker, and reach upstream servers more privately.5 The current release is version 2.1.20, published on 22 October 2026.4
Supported protocols include DNSCrypt version 2, a post-quantum form called PQDNSCrypt, DNS-over-HTTPS, anonymized DNS relays, and oblivious DNS-over-HTTPS.2 With DNSCrypt, encryption starts on the first packet and uses a static public key rather than a certificate authority. DNS-over-HTTPS still relies on the normal certificate system.1 The example configuration allows both DNSCrypt and DNS-over-HTTPS servers, and it leaves oblivious DNS-over-HTTPS switched off.7
Encryption covers the lookup. Once an address comes back, the computer still connects to that website. What the internet provider can still see is worth reading beside this, because a name lookup is only one part of a visit.
Key dnscrypt-proxy features
- Encrypted, checked lookups: DNSCrypt, post-quantum DNSCrypt, DNS-over-HTTPS, anonymized relays and oblivious DNS-over-HTTPS are supported.2
- A say in who answers: The example starts with an empty server list and keeps servers that declare they do not log queries and that do not enforce their own block list.7
- A way to hide your address: Tor, a SOCKS proxy, or an anonymized DNS relay can keep your IP address off the resolver.2
- A local cache: Caching is on in the example, which the project says reduces delay and helps privacy.27
- Blocking: You can block ads, malware and other names. A separate option applies filters on a weekly schedule.2
- DNSSEC-compatible servers: It works with DNSSEC, the extension that signs some DNS answers. The example does not require DNSSEC.27
dnscrypt-proxy pros and cons
Pros
- The starting file filters for servers that declare no logging and no extra filtering, until you name servers yourself.7
- DNSCrypt uses the resolver’s own public key, and encryption starts on the first packet.1
- A relay lets the resolver see the relay’s address, while the relay cannot read the question.6
- The example listens only on this computer, at 127.0.0.1 port 53.7
Cons
- Setup is a configuration file and a terminal: copy the example, start the program, then point the computer’s DNS at it.5
- The resolver still sees the decrypted question. On a direct connection it also sees your IP address. A no-log label is a declaration, not a proof.67
- The public server list warns that it includes servers that may censor results, skip DNSSEC, or collect and monetize queries.8
- Naming your own servers turns the filters off. Anonymized relays apply to DNSCrypt servers, while the example also allows DNS-over-HTTPS, which those relays do not cover.67
- iPhone and iPad are not in the pre-built downloads. The Android path in the install notes is a Magisk module and needs root.25
Is dnscrypt-proxy safe and private?
The DNSCrypt FAQ calls the protocol an open specification with free and open-source reference implementations, and says it is not affiliated with any company.1 The proxy’s copyright line names Frank Denis, 2018–2026.3
The example listens on 127.0.0.1 port 53, which means this computer only. The query-log file path is left commented out. A monitoring page is included and switched off. If you enable it, the sample username is admin, the sample password is changeme, and that page also listens only on this computer.7
Upstream, you still choose whom to trust. The anonymized-DNS notes say a resolver that promises not to log still sees the decrypted traffic and, on a direct link, your IP address.6 A relay hides that address: the relay cannot decrypt the question, and the resolver sees the relay’s IP. The example leaves relay routes commented out, and it says to use a relay and a resolver run by different people. A relay run by the same operator as the resolver defeats the purpose of anonymization.67 Read the public list’s warning, and keep the no-log filter unless you have picked servers on purpose.78
How to get started with dnscrypt-proxy
- Download the build for your system from the dnscrypt-proxy 2.1.20 release. Check the archive with Minisign, using the key in the installation notes.45
- Unpack it and copy example-dnscrypt-proxy.toml to dnscrypt-proxy.toml, which is the name the example file tells you to save it as. Keep a backup of any file you change.57
- Leave server_names commented out so the no-log and no-filter rules still apply. Naming servers yourself turns those filters off.7
- Make sure nothing else is using port 53, then start dnscrypt-proxy. On Windows, use a console with elevated privileges.5
- Run dnscrypt-proxy -resolve example.com. The result should name one of the chosen DNS servers.5
- Point the computer’s DNS at the address in the configuration. The example uses 127.0.0.1 on port 53. Then register the program as a service so it starts with the computer. The wiki has pages for Windows, macOS, Linux and routers such as OpenWrt.57
Who should use dnscrypt-proxy (and who might prefer something else)
dnscrypt-proxy fits someone who wants encrypted lookups for a whole computer, or for the devices behind a router, and who will keep a text configuration file. A relay is there if you want the answering server to see a relay’s address.
People who want to run the answering server itself can use Unbound. On Android, Rethink DNS + Firewall + VPN is an app for reviewing connections. That is a different job from this proxy, whose documented phone module needs root.5
Frequently asked questions
Is dnscrypt-proxy free?
The project publishes the source and pre-built binaries, and it invites financial contributions.2 The ISC licence grants permission to use, copy, modify and distribute the software for any purpose, with or without a fee, provided the copyright and permission notice stay in every copy.3
Is dnscrypt-proxy safe?
It encrypts the lookup and, with DNSCrypt, checks the answer against the resolver’s key.1 Safety after that is the server you picked. Use the no-log filter, read the public list’s warning, and run 2.1.20 from 22 October 2026.478
Does dnscrypt-proxy work on iPhone?
iPhone and iPad do not appear in the pre-built downloads. Those downloads include Android, Windows, macOS, Linux and several BSD systems.2 The installation notes list AdGuard Pro for iOS, which embeds dnscrypt-proxy.5 The Android note in the installation guide points to a Magisk module and says root is required.5
Does dnscrypt-proxy hide what I visit from my internet provider?
It encrypts the name lookup on the way to the resolver, so that step is no longer plain DNS on the path.15 The resolver you chose can still see the name. A relay hides your IP address from that resolver. It does not stop the resolver from seeing the question it decrypts.6
