I use mdnsresponder nomulitcastannounce -> dnsmasq 127.0.0.1#53 -> dnscrypt-proxy 127.0.0.1#54 -> an encrypted DNS proxy that does dnssec. All of which is lock

I use mdnsresponder nomulitcastannounce -> dnsmasq 127.0.0.1#53 -> dnscrypt-proxy 127.0.0.1#54 -> an encrypted DNS proxy that does dnssec. All of which is locked down by a minimal whitelist leak-preventing fw ruleset like little snitch. I have a script which checks for authentic internet access to allow captive portals to work which leaks temporarily (which I prob need to toggle between rulesets to only allow the captive portal agent to work and deny everything else).