The DNS stamp (the sdns: address that clients use) doesn't have to change. That wouldn't be very practical :) See the documentation of dnscrypt-wrapper: https:

The DNS stamp (the sdns: address that clients use) doesn't have to change. That wouldn't be very practical :) See the documentation of dnscrypt-wrapper: https://github.com/cofyc/dnscrypt-wrapper https://github.com/cofyc/dnscrypt-wrapper Two kind of keys are involved: a long-term key ("provider key", used for signatures), and ephemeral keys (used for encryption, and signed by the long-term key). Clients only need the public long-term key, which is included in the DNS stamp. What you are rotating is just the ephemeral key pair (`--gen-crypt-keypair`). This is similar to what happens to TLS certificates: you can update the certificate for a domain name as frequently as needed. But you don't need to install a new version of the operating system every time somebody adds or changes a certificate for their website. dnscrypt-wrapper can serve multiple certificates simultaneously, so you can serve the next certificate even if the current one hasn't expired yet.