2.1.17

• Added support for PQDNSCrypt (DNSCrypt 2026), using post-quantum cryptography with compatible DNSCrypt servers to protect query confidentiality against future quantum computers. It is enabled by default and can be disabled with the new pqdnscrypt setting.
• Key material is now rotated when the local network changes, reducing linkability across network changes.
• Fixed a cache issue that could corrupt cached responses or cause data races under concurrent use.
• The netprobe_timeout configuration setting is now honored instead of being silently overridden by its command-line default.
• Forwarded queries now correctly fall back to TCP after a truncated UDP response, and SOCKS-proxied anonymized DNS exchanges are sent to the relay.
• HTTP/3 connections now retry after transient failures, and bootstrap resolution succeeds when at least one address was obtained.
• Cloaking rules that resolve through a rule ending in an IP address are no longer incorrectly rejected as recursive. Actual loops are still rejected.
• The monitoring dashboard now resolves API paths against the page origin, allowing it to work correctly when hosted under a path.