dnscrypt-proxy - Encrypted DNS Proxy

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

dnscrypt-proxy is a flexible DNS proxy that encrypts your DNS traffic. It sits between your clients and the public internet, accepting ordinary DNS queries on port 53 and forwarding every one of them to a public upstream resolver over an encrypted transport, so your internet provider and any network between you and the resolver can no longer see or tamper with the names you look up. It supports the modern encrypted DNS protocols including DNSCrypt v2, DNS over HTTPS, Anonymized DNSCrypt and Oblivious DoH. This image delivers dnscrypt-proxy fully installed and configured as a hardened systemd service, so an encrypted resolver for your whole network is answering queries within minutes of launch.

dnscrypt-proxy is a single self contained binary whose behaviour is defined by one plain text configuration file. There is no database and no web console. On this image it listens for DNS on port 53 over both UDP and TCP across all interfaces, and forwards to upstreams selected automatically from a cryptographically signed public resolver list by lowest latency. Upstream selection is restricted to resolvers that validate DNSSEC, keep no logs, and apply no filtering, so you get authentic, private, unfiltered answers.

Application stack: dnscrypt-proxy runs as a dedicated non root service with only the Linux CAP_NET_BIND_SERVICE capability so it can bind the privileged DNS port. The operating system stub resolver listener is disabled so dnscrypt-proxy owns port 53 cleanly, while the operating system keeps resolving names through its own upstream list. The proxy resolves the hostnames of its encrypted upstreams and refreshes the signed resolver list through its built in bootstrap resolvers, so it never depends on the host resolver.

Secure by default: this image ships with no shared or default credentials of any kind, since dnscrypt-proxy has no login. It binds all interfaces so it can serve a network, but access to port 53 is governed entirely by the security group. Because dnscrypt-proxy has no built in allow from access control list, the security group is your access control: open UDP and TCP 53 only to the client subnets you control, never to the whole internet, so the resolver is never abused as an open resolver.

Key capabilities: transparent encrypted DNS for every client that points at this resolver; automatic selection of DNSSEC validating, no log, non filtering encrypted upstreams; support for DNSCrypt v2, DNS over HTTPS, Anonymized DNSCrypt and Oblivious DoH; optional local blocklists, allow lists, cloaking and forwarding rules shipped as ready to edit example files; and a single binary with no runtime dependencies.

Get started: point your clients, or your virtual network DNS setting, at this instance on port 53, and restrict the security group to your own subnets. cloudimg engineers can help with upstream selection, per client access policy, blocklists and forwarding rules, and monitoring after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.