diff --git a/.ci/blacklist.txt b/.ci/blacklist.txt
index 6dc727955d..37f97375e3 100644
--- a/.ci/blacklist.txt
+++ b/.ci/blacklist.txt
@@ -4,8 +4,8 @@ banner.*
 banners.*
 creatives.*
 oas.*
-oascentral.*
-stats.*
+oascentral.*        # test inline comment
+stats.*             # test inline comment with trailing spaces       
 tag.*
 telemetry.*
 tracker.*
diff --git a/.ci/cloaking-rules.txt b/.ci/cloaking-rules.txt
index cbf0fba196..50ba0cbbc3 100644
--- a/.ci/cloaking-rules.txt
+++ b/.ci/cloaking-rules.txt
@@ -1,3 +1,3 @@
 cloaked.*                one.one.one.one
-*.cloaked2.*             one.one.one.one
+*.cloaked2.*             one.one.one.one # inline comment
 =www.dnscrypt-test       192.168.100.100
diff --git a/dnscrypt-proxy/common.go b/dnscrypt-proxy/common.go
index cef0ff19fb..4b9236e306 100644
--- a/dnscrypt-proxy/common.go
+++ b/dnscrypt-proxy/common.go
@@ -143,6 +143,18 @@ func StringStripSpaces(str string) string {
 	}, str)
 }
 
+func TrimAndStripInlineComments(str string) string {
+	if idx := strings.LastIndexByte(str, '#'); idx >= 0 {
+		if idx == 0 {
+			return ""
+		}
+		if prev := str[idx-1]; prev == ' ' || prev == '\t' {
+			str = str[:idx-1]
+		}
+	}
+	return strings.TrimFunc(str, unicode.IsSpace)
+}
+
 func ExtractHostAndPort(str string, defaultPort int) (host string, port int) {
 	host, port = str, defaultPort
 	if idx := strings.LastIndex(str, ":"); idx >= 0 && idx < len(str)-1 {
diff --git a/dnscrypt-proxy/example-blacklist.txt b/dnscrypt-proxy/example-blacklist.txt
index 91b4a3e0ca..a63e1e893f 100644
--- a/dnscrypt-proxy/example-blacklist.txt
+++ b/dnscrypt-proxy/example-blacklist.txt
@@ -21,7 +21,7 @@ banner.*
 banners.*
 creatives.*
 oas.*
-oascentral.*
+oascentral.*        # inline comments are allowed after a pound sign
 stats.*
 tag.*
 telemetry.*
diff --git a/dnscrypt-proxy/example-cloaking-rules.txt b/dnscrypt-proxy/example-cloaking-rules.txt
index ef9c8926c6..7f98c2e3d9 100644
--- a/dnscrypt-proxy/example-cloaking-rules.txt
+++ b/dnscrypt-proxy/example-cloaking-rules.txt
@@ -13,7 +13,7 @@ www.google.*             forcesafesearch.google.com
 
 www.bing.com             strict.bing.com
 
-yandex.ru                familysearch.yandex.ru
+yandex.ru                familysearch.yandex.ru       # inline comments are allowed after a pound sign
 
 =duckduckgo.com          safe.duckduckgo.com
 
diff --git a/dnscrypt-proxy/example-ip-blacklist.txt b/dnscrypt-proxy/example-ip-blacklist.txt
index 1aca3b7ae0..d9030572e4 100644
--- a/dnscrypt-proxy/example-ip-blacklist.txt
+++ b/dnscrypt-proxy/example-ip-blacklist.txt
@@ -10,4 +10,4 @@
 
 163.5.1.4
 94.46.118.*
-[fe80:53:*]
+[fe80:53:*]        # IPv6 prefix example
diff --git a/dnscrypt-proxy/plugin_block_ip.go b/dnscrypt-proxy/plugin_block_ip.go
index 317ea3146c..0224806b7e 100644
--- a/dnscrypt-proxy/plugin_block_ip.go
+++ b/dnscrypt-proxy/plugin_block_ip.go
@@ -6,7 +6,6 @@ import (
 	"net"
 	"strings"
 	"time"
-	"unicode"
 
 	iradix "github.com/hashicorp/go-immutable-radix"
 	"github.com/jedisct1/dlog"
@@ -38,8 +37,8 @@ func (plugin *PluginBlockIP) Init(proxy *Proxy) error {
 	plugin.blockedPrefixes = iradix.New()
 	plugin.blockedIPs = make(map[string]interface{})
 	for lineNo, line := range strings.Split(string(bin), "\n") {
-		line = strings.TrimFunc(line, unicode.IsSpace)
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
+		line = TrimAndStripInlineComments(line)
+		if len(line) == 0 {
 			continue
 		}
 		ip := net.ParseIP(line)
diff --git a/dnscrypt-proxy/plugin_block_name.go b/dnscrypt-proxy/plugin_block_name.go
index 73e9621108..0540a14665 100644
--- a/dnscrypt-proxy/plugin_block_name.go
+++ b/dnscrypt-proxy/plugin_block_name.go
@@ -94,8 +94,8 @@ func (plugin *PluginBlockName) Init(proxy *Proxy) error {
 		patternMatcher:  NewPatternPatcher(),
 	}
 	for lineNo, line := range strings.Split(string(bin), "\n") {
-		line = strings.TrimFunc(line, unicode.IsSpace)
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
+		line = TrimAndStripInlineComments(line)
+		if len(line) == 0 {
 			continue
 		}
 		parts := strings.Split(line, "@")
diff --git a/dnscrypt-proxy/plugin_cloak.go b/dnscrypt-proxy/plugin_cloak.go
index 3bad64f9a6..46e422291b 100644
--- a/dnscrypt-proxy/plugin_cloak.go
+++ b/dnscrypt-proxy/plugin_cloak.go
@@ -45,8 +45,8 @@ func (plugin *PluginCloak) Init(proxy *Proxy) error {
 	plugin.patternMatcher = NewPatternPatcher()
 	cloakedNames := make(map[string]*CloakedName)
 	for lineNo, line := range strings.Split(string(bin), "\n") {
-		line = strings.TrimFunc(line, unicode.IsSpace)
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
+		line = TrimAndStripInlineComments(line)
+		if len(line) == 0 {
 			continue
 		}
 		var target string
diff --git a/dnscrypt-proxy/plugin_forward.go b/dnscrypt-proxy/plugin_forward.go
index 761cc9614b..79afb36200 100644
--- a/dnscrypt-proxy/plugin_forward.go
+++ b/dnscrypt-proxy/plugin_forward.go
@@ -35,8 +35,8 @@ func (plugin *PluginForward) Init(proxy *Proxy) error {
 		return err
 	}
 	for lineNo, line := range strings.Split(string(bin), "\n") {
-		line = strings.TrimFunc(line, unicode.IsSpace)
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
+		line = TrimAndStripInlineComments(line)
+		if len(line) == 0 {
 			continue
 		}
 		domain, serversStr, ok := StringTwoFields(line)
diff --git a/dnscrypt-proxy/plugin_whitelist_name.go b/dnscrypt-proxy/plugin_whitelist_name.go
index 6c4a44f739..cb7a9b0a6f 100644
--- a/dnscrypt-proxy/plugin_whitelist_name.go
+++ b/dnscrypt-proxy/plugin_whitelist_name.go
@@ -37,8 +37,8 @@ func (plugin *PluginWhitelistName) Init(proxy *Proxy) error {
 	plugin.allWeeklyRanges = proxy.allWeeklyRanges
 	plugin.patternMatcher = NewPatternPatcher()
 	for lineNo, line := range strings.Split(string(bin), "\n") {
-		line = strings.TrimFunc(line, unicode.IsSpace)
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
+		line = TrimAndStripInlineComments(line)
+		if len(line) == 0 {
 			continue
 		}
 		parts := strings.Split(line, "@")