dnscrypt-proxy, an encrypting DNS proxy that forwards every query to public resolvers over DNSCrypt v2 and DNS over HTTPS.
dnscrypt-proxy is an open source, flexible DNS proxy that encrypts your DNS traffic. It accepts ordinary DNS queries on port 53 and forwards each one to a public upstream resolver over an encrypted transport, so networks between you and the resolver cannot see or tamper with your lookups. It supports the modern encrypted DNS protocols including DNSCrypt v2, DNS over HTTPS, Anonymized DNSCrypt and Oblivious DoH, with no database and no web console to manage.
The cloudimg image is hardened and fully patched with dnscrypt-proxy preconfigured and running as a dedicated non root service. It ships secure by default: upstream selection is restricted to DNSSEC validating, no log and non filtering encrypted resolvers, and no shared or default credential ships since dnscrypt-proxy has no login. It binds all interfaces to serve a network while the stock Network Security Group keeps port 53 off the internet until you open it to your own client subnets. Every instance is backed by a paired deploy guide and 24/7 cloudimg support.