Dnscrypt-proxy 2 – A flexible DNS proxy with support for encrypted DNS protocols | Hacker News Reader

Dnscrypt-proxy 2 – A flexible DNS proxy with support for encrypted DNS protocols

github.com

58 pointsknown28 comments

This post came at a right time for me. I already run a custom DNS server on premises and setting up dnscrypt-proxy took less than 5 minutes. It's good to see how encrypted DNS has evolved in the last year or so.

It was actually the post "Big ISPs aren’t happy about Google’s plans for encrypted DNS" [1] which made me think that I will tackle this issue now, even though I was already thinking about this for months.

[1] https://news.ycombinator.com/item?id=21124900

And to run your own encrypted DNS server: https://github.com/jedisct1/encrypted-dns-server

I'm a (former) user. It's bloated. Extremely bloated.

Fortunately, openbsd added DoH support to their recursive resolver, allowing me to get rid of dnscrypt-proxy.

Can you elaborate a bit? I'm not really a fan of go, but not all go projects are automatically bad. Is it slow, a memory hog, ...?

I can't speak for the parent since I am not a BSD user at home, but I tried a few different options for DNS on my Windows laptop and dnscrypt-proxy was the simplest to get up and running. Right now it's consuming 25 meg of RAM, which is perhaps a lot compared to built-in networking services, but not much compared to application software. It also saves installing ad block browser plugins, which feel far more heavyweight.

My only complaint is that it doesn't stay running in the background waiting for connection if you boot up without wifi. There is a 1 hour timeout, but it doesn't seem to reliably keep the service hanging around till you connect to a wifi. Not a big deal - it starts up pretty much immediately from the Task Manager Services tab.

I imagine if you have a dedicated router with limited RAM or are running a UNIX desktop there may be better options, but for a Windows laptop connecting direct to untrusted connections (e.g. 4G phone tether) it does the job just fine.

Not slow but it is cuurently using 23MB with default caching serving a single computer, i can see why the parent would consider it bloated.

>slow or memory hog.

Both. It'll easily use several hundred mb of ram and, if you use its cache feature (enabled by default) and hit the cache while measuring the latency, you'll see it takes about 10x the time to respond compared to pdnsd's cache.

Therefore, when I used it, I put pdnsd in front.

Forgot: Also very high CPU usage. Hundreds of hours after a few weeks.

I use this as a local dns resolver in combination with a blacklist and a whitelist to do DNS-level ad/tracker blocking. Works pretty well.

I see people here are using some DNS switchers in macos, but you can also configure an extra 'location' in your networking configuration. My default location uses the dnscrypt-proxy server I run locally and another uses CloudFlare, for the rare occasions where things break. I haven't had anything break really, but sometimes you want to test certain things and it is useful to be able to switch quickly.

I have mine configured on my router:

https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

My DHCP server hands out the router's IP as a DNS server, then that DNS server forwards through the VPN to my VPN provider's DNS server, or to my DNSCrypt servers.

The good thing about it is it works on every host no matter what platform, configuration, application without any installed software.

When I am out and about I just use a VPN on my phone and use the accepted DNS server pushed to me (which is an internal one to my VPN provider).

Cool. I am still looking into setting up a Pi-hole in order to block things on all devices. I haven't had the time though.

I looked into this but Go on a little OpenWrt router seemed… silly.

If you’re interested in something lightweight for OpenWrt give this a try:

https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...

>I looked into this but Go on a little OpenWrt router seemed… silly.

Why? Go compiles to distributable binaries, Go binaries do not depend on Go to run. You wouldn’t need to actually install Go on the router

From their own documentation [1]

> The dnscrypt-proxy file is quite large, but can be compressed for a massive reduction of its size, from ~12 Mb down to ~2 Mb.

Routers typically have 8-16 Mb of storage. Even 2 Mb is a bit much but even if the size doesn’t bother you the memory usage is still relatively extreme when compared to the link I shared.

[1] https://github.com/dnscrypt/dnscrypt-proxy/wiki/Installation...

Sure that’s fair, not really specific to Go though

Go specifically makes a bunch of choices that lead to (somewhat, it's by no means extreme) larger executables. Which is fine, but means it's not the best choice for the specific usecase of targeting tiny devices.

Get a better router, there's no excuse for openwrt these days, with plenty of ultra small, cheap, abundant devices that can run a full distribution without issues.

I wanted to setup a local dns (pdnsd) with dnscrypt but I lack knowledge on how to be sure everything is coupled the way it should.

You can adds DNSCrypt support to pdnsd, simply by installing https://github.com/jedisct1/encrypted-dns-server - In `upstream_addr`, instead of `9.9.9.9:53`, just put the IP and port of your pdnsd server.

I run https://github.com/m13253/dns-over-https on my EdgeOS based router. It was trivial to cross-compile the doh-client binary. I have doh-client listen on localhost:5353, then I point dnsmasq at doh-client. Works great, and gives me the full flexibility and caching of dnsmasq. e.g. There's a few domains that I don't send over doh.

Is it just me or has this DNSCrypt project been doing things without any prior announcement?

Last month or so, the main GitHub repo for DNSCrypt randomly got deleted. It wasn't until several days later, the author posted a tweet saying he/she are not supporting it anymore.

Now it has seemingly been resurrected...after I have already configured my server to use a new project called getdns (and stubby).

Hi!

The GitHub repository for dnscrypt-proxy was simply moved from my personal GitHub account to the DNSCrypt organization. GitHub automatically adds redirections when a project is moved, so this should be transparent.

dnscrypt-proxy 2 is actively supported since it was released in January 2018. What has been EOL'd is the legacy dnscrypt-proxy 1.x client, after having been supported for 7 years.

The protocol itself is also still evolving, with the recent introduction of a lightweight alternative to Tor in order to hide IP addresses: https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol...

Besides the main website https://dnscrypt.info, there is a subreddit for announcements: https://www.reddit.com/r/dnscrypt/

What happened to DNSCrypt-OSXClient Preferences? It was suddenly pulled from Homebrew.

I use a bitbar module for this: https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/

Yes, I'm aware of that, but I don't use Bitbar, and I'm wondering about what happened with that Homebrew Cask. Why was it pulled, and why was the orig. pulled?

I normally use WireGuard and use a DNS server supplied by that. If WireGuard is offline, I automatically use DNSCrypt.

The project have a turbulent history IMO.

Been using it for years, but did not know of the recent episode. Leaves you wondering..

Stubby is kind of limited. It has no cache, and I can't find a way to avoid resolving a list of my own domains via a specified resolver, so it's not that great for privacy.

Though I like getdns C API, I'll probably use it in one of my projects.

Reply on news.ycombinator.com