README.md
1# 
2
3[](https://gitter.im/dnscrypt-operators/Lobby)
4
5An easy to install, high-performance, zero maintenance proxy to run an encrypted DNS server.
6
7
8
9## Protocols
10
11The proxy supports the following protocols:
12
13- [DNSCrypt v2](https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/DNSCRYPT-V2-PROTOCOL.txt)
14- [Anonymized DNSCrypt](https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt)
15- DNS-over-HTTP (DoH) forwarding
16
17All of these can be served simultaneously, on the same port (usually port 443). The proxy automatically detects what protocol is being used by each client.
18
19## Installation
20
21### Option 1: precompiled binary for Linux
22
23Precompiled tarballs and Debian packages for Linux/x86_64 [can be downloaded here](https://github.com/jedisct1/encrypted-dns-server/releases/latest).
24
25Nothing else has to be installed. The server doesn't require any external dependencies.
26
27In the Debian package, the example configuration file can be found in `/usr/share/doc/encrypted-dns/`.
28
29### Option 2: compilation from source code
30
31The proxy requires rust >= 1.0.39 or rust-nightly.
32
33Rust can installed with:
34
35```sh
36curl -sSf https://sh.rustup.rs | bash -s -- -y --default-toolchain nightly
37source $HOME/.cargo/env
38```
39
40Once rust is installed, the proxy can be compiled and installed as follows:
41
42```sh
43cargo install encrypted-dns
44strip ~/.cargo/bin/encrypted-dns
45```
46
47The executable file will be copied to `~/.cargo/bin/encrypted-dns` by default.
48
49### Options 3: Docker
50
51[dnscrypt-server-docker](https://github.com/dnscrypt/dnscrypt-server-docker) is the most popular way to deploy an encrypted DNS server.
52
53This Docker image that includes a caching DNS resolver, the encrypted DNS proxy, and scripts to automatically configure everything.
54
55## Setup
56
57The proxy requires a recursive DNS resolver, such as Knot, PowerDNS or Unbound.
58
59That resolver can run locally and only respond to `127.0.0.1`. External resolvers such as Quad9 or Cloudflare DNS can also be used, but this may be less reliable due to rate limits.
60
61In order to support DoH in addition to DNSCrypt, a DoH proxy must be running as well. [rust-doh](https://github.com/jedisct1/rust-doh) is the recommended DoH proxy server. DoH support is optional, as it is currently way more complicated to setup than DNSCrypt due to certificate management.
62
63Make a copy of the `example-encrypted-dns.toml` configuration file named `encrypted-dns.toml`.
64
65Then, review the [`encrypted-dns.toml`](https://raw.githubusercontent.com/jedisct1/encrypted-dns-server/master/example-encrypted-dns.toml) file. This is where all the parameters can be configured, including the IP addresses to listen to.
66
67You should probably at least change the `listen_addresses` and `provider_name` settings.
68
69Start the proxy. It will automatically create a new provider key pair if there isn't any.
70
71The DNS stamps are printed. They can be used directly with [`dnscrypt-proxy`](https://github.com/dnscrypt/dnscrypt-proxy/).
72
73There is nothing else to do. Certificates are automatically generated and rotated.
74
75## Migrating from dnscrypt-wrapper
76
77If you are currently running an encrypted DNS server using [`dnscrypt-wrapper`](https://github.com/cofyc/dnscrypt-wrapper), moving to the new proxy is simple:
78
79- Double check that the provider name in `encrypted-dns.toml` matches the one you previously configured. If you forgot it, it can be recovered [from its DNS stamp](https://dnscrypt.info/stamps/).
80- Run `encrypted-dns --import-from-dnscrypt-wrapper secret.key`, with `secret.key` being the file with the `dnscrypt-wrapper` provider secret key.
81
82Done. Your server is now running the new proxy.
83
84## Built-in DNS cache
85
86The proxy includes a key cache, as well as a DNS cache to significantly reduce the load on upstream servers.
87
88In addition, if a server is slow or unresponsive, expired cached queries will be returned, ensuring that popular domain names always keep being served.
89
90## State file
91
92The proxy creates and updates a file named `encrypted-dns.state` by default. That file contains the provider secret key, as well as certificates and encryption keys.
93
94Do not delete the file, unless you want to change parameters (such as the provider name), and keep it secret, or the keys will be lost.
95
96Putting it in a directory that is only readable by the super-user is not a bad idea.
97
98## Filtering
99
100Domains can be filtered directly by the proxy, see the `[filtering]` section of the configuration file.
101
102## Access control
103
104Access control can be enabled in the `[access_control]` section and configured with the `query_meta` configuration value of `dnscrypt-proxy`.
105
106## Prometheus metrics
107
108Prometheus metrics can optionally be enabled in order to monitor performance, cache efficiency, and more.
109
110## Anonymized DNSCrypt
111
112Enabling Anonymized DNSCrypt allows the server to be used as an encrypted DNS relay.
113
){kind=link}
