2018-01-10 23:41:33 +01:00
|
|
|
[](https://travis-ci.org/jedisct1/dnscrypt-proxy?branch=master)
|
|
|
|
|
|
2018-01-10 23:56:35 +01:00
|
|
|
# 
|
2018-01-10 20:17:46 +01:00
|
|
|
|
2018-01-12 15:41:26 +01:00
|
|
|
A modern client implementation of the DNSCrypt protocol.
|
2018-01-10 20:17:46 +01:00
|
|
|
|
2018-01-14 00:52:34 +01:00
|
|
|
## [dnscrypt-proxy 2.0.0alpha5 is available for download!](https://github.com/jedisct1/dnscrypt-proxy/releases/latest)
|
2018-01-14 00:51:07 +01:00
|
|
|
|
2018-01-10 20:17:46 +01:00
|
|
|
## Current status/features
|
|
|
|
|
|
2018-01-14 00:41:45 +01:00
|
|
|
| Features | dnscrypt-proxy 1.x | dnscrypt-proxy 2.x |
|
|
|
|
|
| -------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------- |
|
|
|
|
|
| Status | Old PoC, barely maintained any more | Very new, but quickly evolving |
|
|
|
|
|
| Code quality | Big ugly mess | Readable, easy to work on |
|
|
|
|
|
| Reliability | Poor, due to completely broken handling of edge cases | Excellent |
|
|
|
|
|
| Security | Written in C, bundles patched versions from old branches of system libraries | Written in standard and portable Go |
|
|
|
|
|
| Dependencies | Specific versions of dnscrypt-proxy, libldns and libtool | None |
|
|
|
|
|
| Upstream connections using TCP | Catastrophic, requires client retries | Implemented as anyone would expect, works well with TOR |
|
|
|
|
|
| XChaCha20 support | Only if compiled with recent versions of dnscrypt-proxy | Yes, always available |
|
|
|
|
|
| Support of links with small MTU | Unreliable due to completely broken padding | Reliable, properly implemented |
|
|
|
|
|
| Support for multiple servers | Nonexistent | Yes, with automatic failover and load-balancing |
|
|
|
|
|
| Custom additions | C API, requires libldns for sanity | Simple Go structures using miekg/dns |
|
|
|
|
|
| AAAA blocking for IPv4-only networks | Yes | Yes |
|
|
|
|
|
| DNS caching | Yes, with ugly hacks for DNSSEC support | Yes, without ugly hacks |
|
|
|
|
|
| EDNS support | Broken with custom records | Yes |
|
|
|
|
|
| Asynchronous filters | Lol, no filters block everything | Of course, thanks to Go |
|
|
|
|
|
| Session-local storage for extensions | Impossible | Yes |
|
|
|
|
|
| Multicore support | Nonexistent | Yes, thanks to Go |
|
|
|
|
|
| Efficient padding of queries | Couldn't be any worse | Yes |
|
|
|
|
|
| Multiple local sockets | Impossible | Of course. IPv4, IPv6, as many as you like |
|
|
|
|
|
| Automatically picks the fastest servers | Lol, it supports only one at a time, anyway | Yes, out of the box |
|
|
|
|
|
| Official, always up-to-date pre-built libraries | None | Yes, for many platforms. See below. |
|
|
|
|
|
| Automatically downloads and verifies servers lists | No. Requires custom scripts, cron jobs and dependencies (minisign) | Yes, built-in, including signature verification |
|
2018-01-10 20:17:46 +01:00
|
|
|
|
|
|
|
|
## Planned features
|
|
|
|
|
|
|
|
|
|
* New super simple (to copy&paste), extensible format for servers parameters: "stamps"
|
|
|
|
|
* Filtering with regexes
|
|
|
|
|
* Offline responses
|
|
|
|
|
* Local DNSSEC validation
|
|
|
|
|
* Flexible logging
|
|
|
|
|
* Windows support that doesn't suck
|
|
|
|
|
* DNS-over-HTTP2
|
|
|
|
|
* Some real documentation
|
2018-01-10 22:32:41 +01:00
|
|
|
|
2018-01-14 00:53:05 +01:00
|
|
|
## Pre-built binaries
|
2018-01-10 22:32:41 +01:00
|
|
|
|
|
|
|
|
Up-to-date, pre-built binaries are available for:
|
|
|
|
|
|
|
|
|
|
* Dragonfly BSD
|
|
|
|
|
* FreeBSD/x86
|
|
|
|
|
* FreeBSD/x86_64
|
|
|
|
|
* Linux/arm
|
|
|
|
|
* Linux/x86
|
|
|
|
|
* Linux/x86_64
|
|
|
|
|
* MacOS X
|
|
|
|
|
* NetBSD/x86
|
|
|
|
|
* NetBSD/x86_64
|
|
|
|
|
* OpenBSD/x86
|
|
|
|
|
* OpenBSD/x86_64
|
|
|
|
|
* Windows
|
|
|
|
|
* Windows 64 bit
|
