4 ms·

Whatever happened to DNSCrypt? I remember setting it up and happily using it for over a year without any issues a few years ago.

zamadatix 7y ago
It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.
jedisct1 7y ago
Still here, still what most public secure DNS run, still secure and reliable, still being constantly improved, and new implementations keep being written. https://dnscrypt.info https://dnscrypt.info The protocol was recently extended with Anonymized DNS, a mechanism that hides client IP addresses from resolvers by using relays dedicated to secure DNS forwarding. A new network of DNS relays is currently being deployed. https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized_dns_is_here/ https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized... dnscrypt-proxy, the reference client implementation, is at version 2.0.29.beta3, released yesterday. There is a new, easy to use and deploy implementation in Rust to add DNSCrypt support server-side, Encrypted DNS Server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server DoH, DNSCrypt and DNS relaying can happily share the same TCP port 443. A complete protocol description has been available for years, but turning it into an IETF document is time consuming. It will eventually happen, but as an independent project, writing software has been prioritized over marketing.
- scrollaway 7y ago
  Thanks for the information. Are you involved with the project?
  - jedisct1 7y ago
    A little bit. I run some public DNS servers.

zamadatix 7y ago

It was never brought forward for standardization and quickly got replaced by protocols that were. While it used UDP or TCP 443 it was a custom protocol so clients had to implement it manually and you couldn't run an HTTPS server on the same port (without modifying the HTTPS server/load balancer). It also relied on a separate certificate infrastructure. Shortly after DoT and DoH came along as standardized proposals with fewer NIH issues and more interoperability. DoH also has the bonus of looking like standard HTTPS traffic to the resolver. Technically e.g. Google could host DoH on google.com/dns-query and it would be hidden in the deluge of HTTPS that already goes to google.com.

jedisct1 7y ago

Still here, still what most public secure DNS run, still secure and reliable, still being constantly improved, and new implementations keep being written. https://dnscrypt.info https://dnscrypt.info The protocol was recently extended with Anonymized DNS, a mechanism that hides client IP addresses from resolvers by using relays dedicated to secure DNS forwarding. A new network of DNS relays is currently being deployed. https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized_dns_is_here/ https://www.reddit.com/r/dnscrypt/comments/dhoxah/anonymized... dnscrypt-proxy, the reference client implementation, is at version 2.0.29.beta3, released yesterday. There is a new, easy to use and deploy implementation in Rust to add DNSCrypt support server-side, Encrypted DNS Server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server DoH, DNSCrypt and DNS relaying can happily share the same TCP port 443. A complete protocol description has been available for years, but turning it into an IETF document is time consuming. It will eventually happen, but as an independent project, writing software has been prioritized over marketing.

scrollaway 7y ago
Thanks for the information. Are you involved with the project?
- jedisct1 7y ago
  A little bit. I run some public DNS servers.