DnsCrypt on Ubuntu – Encrypted DNS Traffic


DNSCrypt is an authentication protocol that facilitates the communication between DNS clients and DNS resolvers.  It’s an effective tool to prevent DNS spoofing where traffic is diverted to fake websites by manipulating DNS servers. DNSCrypt uses cryptographic signatures to authenticate traffic sources. So it’s easier to detect any manipulation of incoming information. It’s an open specification with multiple free and open-source implementation. DNSCrypt clients are available for Windows, MacOS, Unix, Android, iOS, and Linux.

Available DNS Resolvers with DNSCrypt Capability

There are a number of public DNS server with support for DNSCrypt protocol. You can also run your own DNS resolver.

You will need a DNSCrypt client to communicate with these servers.

DNSCrypt Clients

One of the most popular clients is dnscrypt-proxy. It has both a command line and a graphical user interface. It’s up-to-date to current DNSCrypt protocol and it is supported on Windows, macOS, Linux, OpenBSD, FreeBSD, NetBSD, Android, and iOS.

There are other clients like Simple DNSCrypt and DNSCrypt-OSXClient.

Benefits of DNSCrypt Clients

The DNSCrypt clients have the following benefits:

  • Reviews traffic integrity in real-time and detects any manipulation.
  • Provides control over rejecting ads, trackers, spam, malware or other harmful sites.
  • Caches responses and avoids IPv6 requests on IPv4-only networks to improve latency.
  • Mandatory TCP use through TCP-only tunnels or Tor
  • Local zone queries are protected

DNSCrypt Client dnscrypt-proxy Installation on Ubuntu

For Ubuntu 14.x, you can use Pascal’s DNSCrypt PPA:

    $ sudo add-apt-repository ppa:anton+/dnscrypt    $ sudo apt-get update    $ sudo apt-get install dnscrypt-proxy    

For Ubuntu 16.x and 17.x, dnscrypt-proxy is part of the Ubuntu repository. So you can directly install using the following command:

    $ sudo apt-get install dnscrypt-proxy    

After installation, add to your DNS servers on your network configuration.

Next, start the dnscrypt-proxy service using the following command:

    $ service dnscrypt-proxy start    

It will create a user called “_dnscrypt-proxy” and run the service as that user. Check the service status using:

    $ service dnscrypt-proxy status    

Verifying Successful Installation

The following link verifies successful installations:


A successful installation should show the following page:

Alternatively, you can use the following command line

    $ dig txt debug.opendns.com    

You should get output like:

  $ dig txt debug.opndns.com    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> txt debug.opndns.com  ;; global options: +cmd  ;; Got answer:  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41412  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0    ;; OPT PSEUDOSECTION:  ; EDNS: version: 0, flags:; udp: 4096  ;; QUESTION SECTION:  ;debug.opndns.com.        IN    TXT    ;; ANSWER SECTION:  debug.opendns.com. 0 IN TXT "server 11.ash"  debug.opendns.com. 0 IN TXT "flags 20 0 70 5950800000000000000"  debug.opendns.com. 0 IN TXT "originid 0"  debug.opendns.com. 0 IN TXT "actype 0"  debug.opendns.com. 0 IN TXT "source [REDACTED-YOUR IP]"  debug.opendns.com. 0 IN TXT "dnscrypt enabled (71447764594D3377)"    ;; Query time: 74 msec  ;; SERVER:  ;; WHEN: Sat Dec 09 11:26:16 UTC 2017  ;; MSG SIZE  rcvd: 249  

Notice the debug.opendns.com. 0 IN TXT “dnscrypt enabled (71447764594D3377)” line. If you have a similar line that means your DNSCrypt protocol is working.

ONET IDC thành lập vào năm 2012, là công ty chuyên nghiệp tại Việt Nam trong lĩnh vực cung cấp dịch vụ Hosting, VPS, máy chủ vật lý, dịch vụ Firewall Anti DDoS, SSL… Với 10 năm xây dựng và phát triển, ứng dụng nhiều công nghệ hiện đại, ONET IDC đã giúp hàng ngàn khách hàng tin tưởng lựa chọn, mang lại sự ổn định tuyệt đối cho website của khách hàng để thúc đẩy việc kinh doanh đạt được hiệu quả và thành công.
Bài viết liên quan

DNSMasq Ubuntu Tutorial

DNSmasq is a lightweight tool to provide both DNS service and DHCP service for small-scale networks. DNSmasq’s local DNS...

Install BIND 9 on Ubuntu and Configure It for Usage

The full form of BIND is Berkeley Internet Name Domain is a DNS server software. A DNS server resolves domain names such...

Google DNS Tutorial

On 3 December 2009, Google announced its free alternative Domain Name System (DNS) service, Google Public DNS, which can...
Bài Viết

Bài Viết Mới Cập Nhật

Mua Proxy V6 Nuôi Facebook Spam Hiệu Quả Tại Onetcomvn

Hướng dẫn cách sử dụng ProxyDroid để duyệt web ẩn danh

Mua proxy Onet uy tín tại Onet.com.vn

Thuê mua IPv4 giá rẻ, tốc độ nhanh, uy tín #1

Thuê địa chỉ IPv4 IPv6 trọn gói ở đâu chất lượng, giá RẺ nhất?