dnscrypt-proxy Encrypted DNS Proxy on AWS User Guide

Overview

This guide covers the deployment and configuration of dnscrypt-proxy on AWS using cloudimg AWS Marketplace images. dnscrypt-proxy is a flexible DNS proxy that encrypts your DNS traffic: it accepts ordinary DNS queries on port 53 and forwards every one of them to a public upstream resolver over an encrypted transport, so your internet provider and any network between you and the resolver can no longer see or tamper with the names you look up.

The image installs the official dnscrypt-proxy binary (a self-contained Go binary, pinned by SHA256 at build) and runs it under systemd as the unprivileged dnscrypt-proxy user, so an encrypted resolver for your whole network is answering queries within minutes of launch. It listens on 0.0.0.0:53 over both UDP and TCP.

Secure by default - hardened upstreams. Upstream selection is restricted to encrypted resolvers that validate DNSSEC, keep no logs, and apply no filtering, chosen automatically by lowest latency from a cryptographically signed public resolver list. The supported encrypted protocols are DNSCrypt v2, DNS over HTTPS, Anonymized DNSCrypt and Oblivious DoH.

Secure by default - not an open resolver. dnscrypt-proxy has no login and no baked credential of any kind. It binds all interfaces so it can serve a network, but dnscrypt-proxy has no built in allow from access control list, so the AWS security group is your access control. Open UDP and TCP 53 only to the client subnets you control, never to 0.0.0.0/0, or the instance becomes an open resolver.

What is included:

• dnscrypt-proxy 2.1.18 (official binary, pinned by SHA256 at build time), run under systemd as the unprivileged dnscrypt-proxy user (dnscrypt-proxy.service)

• An encrypted DNS resolver on port 53 over both UDP and TCP, forwarding to DNSSEC validating, no log, non filtering public upstreams over DNSCrypt v2 and DNS over HTTPS

• A hardened configuration at /etc/dnscrypt-proxy/dnscrypt-proxy.toml (require_dnssec, require_nolog, require_nofilter all enabled, only encrypted upstream families)

• A per-instance informational note written on first boot (holds no credential, since dnscrypt-proxy has no login)

• Ready to edit example blocklist, allow list, cloaking and forwarding rule files in /etc/dnscrypt-proxy/

• Unattended security upgrades left enabled so the server keeps receiving patches

Prerequisites

• Active AWS account, an EC2 key pair, a VPC and subnet in the target region

• Subscription to the dnscrypt-proxy listing on AWS Marketplace

• A security group allowing TCP 22 (admin) and, from the clients you intend to serve, UDP 53 and TCP 53 (DNS)

Recommended instance type: m5.large (2 vCPU, 8 GB RAM). DNS forwarding is very light; busy resolvers can move to a larger instance type.

Step 1: Launch from AWS Marketplace

Find dnscrypt-proxy on AWS Marketplace, published by cloudimg, and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Select the Ubuntu 24.04 delivery option, your instance type (m5.large), your key pair, and a security group that allows TCP 22 for administration plus UDP 53 and TCP 53 from the client networks you want to serve.

Important: scope the port 53 rules to your own client subnets. dnscrypt-proxy has no built in allow from access control, so the security group is the only thing preventing the resolver from being used by anyone on the internet. Never open UDP/TCP 53 to 0.0.0.0/0.

Step 2: Connecting to your instance

SSH in with your EC2 key pair as the login user for the OS variant you launched.

ssh -i your-key.pem ubuntu@<public-ip>

Step 3: Confirm the resolver is running

dnscrypt-proxy starts automatically at boot. Confirm the service is active and that it is listening on port 53 over both UDP and TCP:

sudo systemctl status dnscrypt-proxy.service --no-pager | head -12

sudo ss -tulnp | grep -E ':53 '

You should see the service active (running) and both a udp and a tcp listener on 0.0.0.0:53, owned by the unprivileged dnscrypt-proxy process.

Step 4: Resolve a name through the encrypted proxy

Send a DNS query to the resolver on the instance itself. The answer is fetched from a public upstream over an encrypted transport:

dig +noall +answer @127.0.0.1 example.com A

DNS over TCP is answered too (used for large or truncated responses):

dig +tcp +noall +answer @127.0.0.1 example.com A

Both commands return the same A records, proving the resolver answers over UDP and TCP.

Step 5: Confirm the upstream is encrypted

The service journal records which public upstreams responded and over which transport. Every entry is an encrypted DNSCrypt or DoH resolver:

sudo journalctl -u dnscrypt-proxy --no-pager | grep -oE '\[[a-z0-9.-]+\] OK \((DoH|DNSCrypt)\) - rtt: [0-9]+ms' | tail -8

dnscrypt-proxy picks the upstream with the lowest latency automatically:

sudo journalctl -u dnscrypt-proxy --no-pager | grep -oE 'Server with the lowest initial latency: .*' | tail -1

Step 6: Review the hardened configuration

The entire behaviour of dnscrypt-proxy is defined by one plain text file. Confirm the shipped hardening - only DNSSEC validating, no log, non filtering encrypted upstreams:

sudo grep -E '^(listen_addresses|require_dnssec|require_nolog|require_nofilter|dnscrypt_servers|doh_servers) =' /etc/dnscrypt-proxy/dnscrypt-proxy.toml

A per-instance informational note is written on first boot. It holds no credential, because dnscrypt-proxy has no login:

sudo ls -l /root/dnscrypt-proxy-info.txt

Step 7: Point your clients at the resolver

Point your clients, or your VPC DHCP option set / instance DNS setting, at this instance's private IP on port 53. Then, in the AWS security group, open UDP 53 and TCP 53 only from the client subnets you control.

To edit configuration - upstreams, caching, local blocklists, allow lists, cloaking or forwarding rules - edit /etc/dnscrypt-proxy/dnscrypt-proxy.toml (example rule files are shipped alongside it) and reload the service:

sudo systemctl reload dnscrypt-proxy

Security notes

• The security group is your access control. dnscrypt-proxy has no built in allow from list. Only open UDP/TCP 53 to your own client subnets, never to 0.0.0.0/0, or the instance becomes an open resolver that anyone can abuse.

• No baked credential. This image ships no login or password of any kind. The per-instance info note at /root/dnscrypt-proxy-info.txt contains no secret.

• Encrypted, DNSSEC validated, no log upstreams only. The shipped configuration accepts answers only from DNSSEC validating, no log, non filtering resolvers reached over encrypted transports.

• Keep the OS patched. Unattended security upgrades are left enabled.

Support

cloudimg provides 24/7 technical support for this dnscrypt-proxy product by email (support@cloudimg.co.uk) and live chat. We help with upstream and protocol selection, scoping the port 53 security group rules to your client subnets, DNSSEC and no log requirements, local blocklists, allow lists, cloaking and forwarding rules, caching, and dnscrypt-proxy version upgrades. Critical issues receive a one hour average response time.