4 ms·

Cloudflare resolvers are supported by dnscrypt-proxy. See https://dnscrypt.info/public-servers https://dnscrypt.info/public-servers

codetrotter 9y ago
Should point out though that it is using DNS-over-HTTP/2 and not DNSCrypt it seems, because the DNS stamp you provided in a sibling comment starts with "Ag" and not "AQ". https://dnscrypt.info/faq https://dnscrypt.info/faq mentions some drawbacks of DNS over HTTPS; - Requires a full TLS stack and a web server - Interception/monitoring tools are readily available - Key management can be surprisingly hard especially if public key pinning is used by clients - Allows insecure algorithms and parameters - Requires TCP - RFC is in draft stage So the question remains; does 1.1.1.1 support DNSCrypt or are there any plans for it to do so?
- jedisct1 9y ago
  When you are a CDN and already have a massive infrastructure to handle HTTP/2 traffic, DNS-over-HTTP/2 makes more sense. I also totally trust Cloudflare for the TLS security part, especially since they support TLS 1.3 already. Quad9 said they will support DNSCrypt soon, and the software they use just got an update to do it nicely. So, this will be a decent alternative if you are looking for an anycast resolver.
  - codetrotter 9y ago
    Snap, hours later as I was looking for some things relating to setting up dnscrypt-proxy2 I landed on https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy and spotted a certain similarity between the usernames of that GitHub user and the person that had responded to me on HN earlier. Thanks for making this :) Also, thanks for using the ISC license, it is my favorite license. PS: And additionally then, the text I was quoting from https://dnscrypt.info/faq https://dnscrypt.info/faq was probably written by you. Good thing I was sufficiently convinced by what you said that I didn't argue against it, that'd been embarrassing. Embarrassing but also funny ofc ;) Edit, another 40 minutes later: And you've authored libsodium, and you've done a bunch of other really cool things also. Holy crap! I'd buy you a beer if I ever met you but you are probably way busy anyway lol.

codetrotter 9y ago

Should point out though that it is using DNS-over-HTTP/2 and not DNSCrypt it seems, because the DNS stamp you provided in a sibling comment starts with "Ag" and not "AQ". https://dnscrypt.info/faq https://dnscrypt.info/faq mentions some drawbacks of DNS over HTTPS; - Requires a full TLS stack and a web server - Interception/monitoring tools are readily available - Key management can be surprisingly hard especially if public key pinning is used by clients - Allows insecure algorithms and parameters - Requires TCP - RFC is in draft stage So the question remains; does 1.1.1.1 support DNSCrypt or are there any plans for it to do so?

jedisct1 9y ago
When you are a CDN and already have a massive infrastructure to handle HTTP/2 traffic, DNS-over-HTTP/2 makes more sense. I also totally trust Cloudflare for the TLS security part, especially since they support TLS 1.3 already. Quad9 said they will support DNSCrypt soon, and the software they use just got an update to do it nicely. So, this will be a decent alternative if you are looking for an anycast resolver.
- codetrotter 9y ago
  Snap, hours later as I was looking for some things relating to setting up dnscrypt-proxy2 I landed on https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy and spotted a certain similarity between the usernames of that GitHub user and the person that had responded to me on HN earlier. Thanks for making this :) Also, thanks for using the ISC license, it is my favorite license. PS: And additionally then, the text I was quoting from https://dnscrypt.info/faq https://dnscrypt.info/faq was probably written by you. Good thing I was sufficiently convinced by what you said that I didn't argue against it, that'd been embarrassing. Embarrassing but also funny ofc ;) Edit, another 40 minutes later: And you've authored libsodium, and you've done a bunch of other really cool things also. Holy crap! I'd buy you a beer if I ever met you but you are probably way busy anyway lol.