Dnscrypt-proxy: [INFO] Want 1.1.1.1 Cloudflare DNS to support DNSCrypt?

[JayBrown]

If you want the new Cloudflare DNS on 1.1.1.1 to support DNSCrypt, you can make yourself heard here: https://community.cloudflare.com/t/cloudflare-dns-1-1-1-1-with-dnscrypt-support-at-some-point/14650 :)

[jedisct1]

It would be nice if they had at least mentioned the existence of dnscrypt-proxy as a potential client for their service.

Cloudflare-proxy probably does the job, but so is a proxy that already works with many more services, including Cloudflare, and that could really get some contributions instead.

Cloudflare DNS is great news no matter what.

[JayBrown]

There has always been a DNSCrypt cloudflare server in the resolver list, right? But that's a different one, I assume, not the new 1.1.1.1.

[jedisct1]

It is the same. Non dnscrypt-proxy users are just a bit late discovering it :)

[JayBrown]

Oh, I didn't know. Then I guess we can close this topic. (And I can close the one in the Cloudflare forum, and rather add a new topic there that links to dnscrypt as an alternative to their own proxy.)

[jedisct1]

It was made public a while back when DoH was added to Firefox, and the experiment to use it with Cloudflare started. This was added to the lists right after, since it worked out of the box with dnscrypt-proxy.

For DoH servers, an IP address is optional. If there is none, the name will be resolved using the system resolver or the fallback resolver. So what was in the list just used the dns.cloudflare.com name as in Firefox.

When 1.1.1.1 was made public, that IP was added to the stamp, so a fallback server is not required any more.

Apparently, some manufacturers are using the IP address 1.1.1.1 even though it was never supposed to be a private IP. So, the address in the stamp was changed to 1.0.0.1.

[ztjal]

I'm thinking about reflecting this, too.
------------------ may be helpful
https://developers.cloudflare.com/1.1.1.1/dns-over-tls/
https://developers.cloudflare.com/1.1.1.1/dns-over-https/

[JayBrown]

I think @jedisct1 wrote somewhere that DNS-over-TLS can be disregarded, because it's basically been replaced by DoH (DNS-over-HTTPS). And DNSCrypt supports DoH, so everything's fine, I guess.

I just didn't know that the Cloudflare DNS in the DNSCrypt public resolvers list was the same as the new one at 1.1.1.1/1.0.0.1.

[jedisct1]

Maybe this clarifies it: https://github.com/DNSCrypt/dnscrypt-resolvers/commit/e3713660df6d5b8b2e4d5f683138db8d40839c31#diff-1b267619c4812cc46ee281747884ca50

[jedisct1]

By the way, the descriptions in the resolvers list are a bit minimal, so feel free to send pull requests to improve them :)

[jedisct1]

https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/

Yay!