Encrypted DNS Server (DNSCrypt)

Use it when

• You operate your own recursive resolver and want clients to reach it over an encrypted DNS transport rather than exposing queries in plaintext on the local network.
• You need DNSCrypt, Anonymized DNSCrypt, and optional DoH/QUIC forwarding on one public endpoint with automatic key and certificate rotation.

What it solves

Not the fit when

• Recursive resolution by itself; pair it with Unbound, Knot, PowerDNS, or another resolver.
• DoH without a separate DoH proxy such as rust-doh.
• Hiding queries from the recursive resolver or its upstream authorities; encrypted transport protects the client-to-endpoint hop, not the entire DNS resolution chain.
• Deleting or publicly exposing `encrypted-dns.state`; it contains the provider secret key and certificates.
• Applying domain filters to DoH-forwarded traffic; README says filtering applies only to DNSCrypt.
• recursive DNS resolution itself (requires a separate resolver)
• client-side DNS encryption on end devices
• web reverse proxying or TLS for HTTP services

Install

cargo install encrypted-dns (or download Debian packages / Linux and Windows archives from the GitHub releases page; Docker users deploy via dnscrypt-server-docker)

Invoke

Copy `example-encrypted-dns.toml` to `encrypted-dns.toml`, configure `listen_addrs` and `provider_name`, and point it at a recursive resolver such as Unbound, Knot, or PowerDNS. Run `encrypted-dns`; preserve the generated `encrypted-dns.state` secret-key file and use the printed DNS stamps with dnscrypt-proxy clients. DoH additionally requires a separate DoH proxy such as rust-doh.

Alternatives

No reviewed alternatives recorded yet.