Skip to content


Jacek edited this page Oct 13, 2019 · 68 revisions


How do I install DNSCrypt?

You can't. Because DNSCrypt is just a specification.

However, that specification has been implemented in software such as unbound, dnsdist, dnscrypt-wrapper, Simple DNSCrypt and dnscrypt-proxy.

dnscrypt-proxy is a flexible DNS proxy. It runs on your computer or router, and can locally block unwanted content, reveal where your devices are silently sending data to, make applications feel faster by caching DNS responses, and improve security and confidentiality by communicating to upstream DNS servers over secure channels.

OS-specific instructions

Graphical front-ends

  • Simple DNSCrypt is a simple management tool to configure dnscrypt-proxy on windows based systems.
  • DNSCloak is a full-featured DNSCrypt client for iOS, with filtering, logging, caching, password protection and more. No jailbreak required.
  • AdGuard Pro for iOS, Android, macOS and Windows embeds dnscrypt-proxy in a slick user interface.
  • dnscrypt-proxy switcher is a plugin for Bitbar on macOS, to control dnscrypt-proxy usage from the menu bar.

Setting up dnscrypt-proxy (general guidelines)

  1. Extract and adjust the configuration file dnscrypt-proxy.toml to your needs. In case you started fresh, ensure you backup your modified dnscrypt-proxy.toml file.

Note: You can choose a set of preferred servers in the dnscrypt-proxy.toml file.

Look for:

# server_names = ['scaleway-fr', 'google', 'yandex']

Change to the servers you would like to use and remove the leading #.


server_names = ['google', 'cloudflare']

When doing this filters are ignored if you explicitly name the set of resolvers to use ['google', 'cloudflare']

Filters are used when the list is empty, which means all resolvers from configured sources, matching the filters.

  1. Make sure that nothing else is already listening to port 53 on your system and run (in a console with elevated privileges on Windows) the dnscrypt-proxy application.

Change your DNS settings to the configured IP address and check that everything works as expected.

./dnscrypt-proxy -resolve

should return one of the chosen DNS servers instead of your ISP's resolver.

  1. Register as a system service.

Verification of downloaded files

Pre-compiled binaries can be verified with Minisign:

(warning: long line, that may require horizontal scrolling if you use a large font. Make sure to copy the whole of it; the last characters are jB5)

minisign -Vm dnscrypt-proxy-*.tar.gz -P RWTk1xXqcTODeYttYMCMLo0YJHaFEHn7a3akqHlb/7QvIQXHVPxKbjB5

On Windows, archives are ZIP files, not .tar.gz files, so use dnscrypt-proxy-*.zip in the command above.

Clone this wiki locally
You can’t perform that action at this time.