issue if i set dns 127.0.0.1

[Pina1924]

setting in my network ipv4 options manually as per yr guide dns:
127.0.0.1
9.9.9.9
if i run this control:
https://dnscheck.tools/

i got this..:

this is my proxy log

dnscrypt-proxy.log.txt

thxs in advance
cheers

[jedisct1]

dnscrypt-proxy looks like it is working correctly: it is listening on 127.0.0.1:53 and it can reach upstream resolvers without errors.

The likely problem is your network DNS setup:

• 127.0.0.1
• 9.9.9.9

If 9.9.9.9 is set as a secondary DNS server, your system can sometimes use it directly as a fallback, which bypasses dnscrypt-proxy.

To test properly, set:

• IPv4 DNS: only 127.0.0.1
• IPv6 DNS: only ::1 if IPv6 is enabled
• no public DNS like 9.9.9.9 in the adapter settings

Also check that your browser’s Secure DNS / DoH is disabled, or it may bypass the system DNS too.

So this does not look like a dnscrypt-proxy bug — it looks more like DNS fallback/bypass from the OS or browser.

[bw4518]

To test properly, set:

• IPv4 DNS: only 127.0.0.1
• IPv6 DNS: only ::1 if IPv6 is enabled

Should we not add ::1 either way?

Keeping the default config (ipv6_servers = false) I have noticed some DNS leaks, when Windows receives IPv6 DNS server from the router/ISP.

Maybe it could be included in the wiki instructions to also add ::1 in TCP/IPv6 network settings, even if not enabling ipv6_servers, in order to prevent possible leaks?

[Pina1924]

first thxs so much
but i read on the installation guide of dnscrypt to set also the secondary dns...

[jedisct1]

Thanks, you’re right: the guide does mention a secondary DNS as an optional fallback.

The downside is that if a public resolver like 9.9.9.9 is configured there, some queries may bypass dnscrypt-proxy and go there directly.

So:

• use only 127.0.0.1 if you want all DNS traffic to go through dnscrypt-proxy
• use a secondary DNS only if you want fallback behavior, knowing that those fallback queries won’t be protected by the proxy

[concetta41]

@jedisct1 : done...but not solve....:

thxs again
cheers

[Pina1924]

thanks @concetta41 for yr testimony, glad to know i'm not the only one,hoping that this could be solved! Cheers! 👍

[lifenjoiner]

I think a lot of people are freaked out of the term "DNS leak", without correctly understand it. It only occurs with the context that users are using a VPN or encrypted proxy.
Ref: https://en.wikipedia.org/wiki/DNS_leak

The domain host will always know which DNS server resolves the specific subdomain you are connecting to, because it has only provided that information to that server.

Related discussions: https://github.com/DNSCrypt/dnscrypt-proxy/discussions?discussions_q=%22DNS+leak%22

[ACEx86]

If you don't use a VPN everyone will know what you resolve anyway SNI is passing the domain plain text.

[Pina1924]

@lifenjoiner thanks for yr reply so you say that these results on https://dnscheck.tools/ are not valid?
apologize my hard understanding but i do not have understood if you say that only using a vpn it is possible to pass that test?
so this is way we are not authenticated with dnssec?
apologize for my simply and silly question but i'd like to understand
thanks again for yr attention
cheers

[lifenjoiner]

I mean, if you're not using a VPN, it's no big deal if they detect your DNS servers, it should not be called a leak. The "leak" for Non-VPN scenario is that ISP and/or others in the DNS chain peek your plain DNS queries.
Fundamental factors: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Checking#dns-leak-traps

For DNSSEC:

1. turn on the following
   

   dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

   Lines 80 to 81 in 64edfa3

   	# Server must support DNS security extensions (DNSSEC)
   	require_dnssec = false

2. maybe you also need to pick servers carefully, making sure the servers work as they claim
   

   dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

   Line 30 in 64edfa3

   # server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']

[Pina1924]

Hi, first thxs so much for yr kind attention:
i've set that line to -true- and i take a look to what servers claim and how they work...but...i still fail the dnssec test...:

why?
thxs again indeed in advance
cheers

[lifenjoiner]

The settings make sure the selected servers support DNSSEC, but dnscrypt-proxy doesn't adopt it automatically. It just forwards its client's requests.
Don't forget to turn on DNSSEC for your OS (Windows).

[Pina1924]

hi and thxs...so it is not enough to have set the 79 parametre from -false- to -true-..??
how to turn on DNSSEC in windows 10 home 64?
thxs again for yr kind attention and helping
cheers

[lifenjoiner]

Unfortunately:
It seems that all Windows do not support DNSSEC and cannot validate DNSSEC themselves.
They use a "security-aware" stub resolver that is able to differentiate between secure and non-secure responses by a recursive name server.
So, Windows can only work together with a trusted DNS server that is using DNSSEC to get DNSSEC capability.
Even Windows Server 2012, it can support DNSSEC only acting as a server, but not a client.
Ref: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Tools

Based on my testing, plan9 servers do not use DNSSEC by default, but only when you request. After excluding them, the DNSSEC tests passed. There may be others, which are not valid on my end.

disabled_server_names = ['plan9dns-fl', 'plan9dns-fl-ipv6', 'plan9dns-mx', 'plan9dns-mx-ipv6', 'plan9dns-nj', 'plan9dns-nj.ipv6', 'plan9dns-fl-doh', 'plan9dns-fl-doh-ipv6', 'plan9dns-mx-doh', 'plan9dns-mx-doh-ipv6', 'plan9dns-nj-doh', 'plan9dns-nj-doh-ipv6']

[Pina1924]

i create a discussion:
#3168 (comment)
@lifenjoiner pls show a .toml file for example to be able to pass dnssec check
thxs so much
cheers

[lifenjoiner]

server_names = ['quad9-doh-ip4-port443-filter-pri', 'cloudflare', 'cloudflare-security', 'meganerd-doh-ipv4', 'uncensoreddns-ipv4']

Only uncensoreddns-ipv4 is available on my end. And it works.

Check your query.log file to ensure it meets the test requirements. For example:

[]   ::1     12345678.test-alg13.dnscheck.tools      A       PASS    263ms   uncensoreddns-ipv4       -
[]   ::1     badsig-12345678.test-alg13.dnscheck.tools       A       SERVFAIL        262ms   uncensoreddns-ipv4      -

PASS means the query passed, while other statuses mean the query failed.

[Pina1924]

query log.rtf
hi @lifenjoiner first so many thxs for yr precious attn
this is a part of my query log i pray you on my knees to take a close look and instruct me how to finally pass this damned dnssec test...:

[2026-04-13 11:24:37] 127.0.0.1 myipv6.addr.tools A PASS 15ms quad9-doh-ip4-port443-filter-pri [2026-04-13 11:24:38] 127.0.0.1 a.nullip-5e7f2c37.test.dnscheck.tools A PASS 92ms cloudflare-security [2026-04-13 11:24:38] 127.0.0.1 b.nullip-5e7f2c37.test.dnscheck.tools A NETWORK_ERROR 14ms quad9-doh-ip4-port443-filter-pri [2026-04-13 11:24:38] 127.0.0.1 c.nullip-5e7f2c37.test.dnscheck.tools A PASS 134ms cloudflare-security [2026-04-13 11:24:38] 127.0.0.1 d.nullip-5e7f2c37.test.dnscheck.tools A PASS 99ms cloudflare [2026-04-13 11:24:39] 127.0.0.1 badsig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 52ms cloudflare-security [2026-04-13 11:24:39] 127.0.0.1 badsig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 54ms cloudflare [2026-04-13 11:24:39] 127.0.0.1 badsig-5e7f2c37.test-alg13.dnscheck.tools AAAA SERVFAIL 38ms cloudflare [2026-04-13 11:24:39] 127.0.0.1 expiredsig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 60ms cloudflare-security [2026-04-13 11:24:40] 127.0.0.1 expiredsig-5e7f2c37.test-alg13.dnscheck.tools AAAA SERVFAIL 33ms cloudflare [2026-04-13 11:24:40] 127.0.0.1 nosig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 50ms cloudflare [2026-04-13 11:24:40] 127.0.0.1 nosig-5e7f2c37.test-alg13.dnscheck.tools AAAA SERVFAIL 55ms cloudflare-security [2026-04-13 11:24:40] 127.0.0.1 expiredsig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 611ms uncensoreddns-ipv4 [2026-04-13 11:24:40] 127.0.0.1 nosig-5e7f2c37.test-alg13.dnscheck.tools A SERVFAIL 279ms uncensoreddns-ipv4 [2026-04-13 11:24:40] 127.0.0.1 badsig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 62ms cloudflare [2026-04-13 11:24:40] 127.0.0.1 badsig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 61ms cloudflare-security [2026-04-13 11:24:40] 127.0.0.1 badsig-5e7f2c37.test-alg14.dnscheck.tools AAAA SERVFAIL 117ms uncensoreddns-ipv4 [2026-04-13 11:24:40] 127.0.0.1 expiredsig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 52ms cloudflare-security [2026-04-13 11:24:41] 127.0.0.1 expiredsig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 18ms cloudflare-security [2026-04-13 11:24:41] 127.0.0.1 expiredsig-5e7f2c37.test-alg14.dnscheck.tools AAAA SERVFAIL 38ms cloudflare [2026-04-13 11:24:41] 127.0.0.1 nosig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 112ms uncensoreddns-ipv4 [2026-04-13 11:24:41] 127.0.0.1 nosig-5e7f2c37.test-alg14.dnscheck.tools A SERVFAIL 56ms uncensoreddns-ipv4 [2026-04-13 11:24:41] 127.0.0.1 nosig-5e7f2c37.test-alg14.dnscheck.tools AAAA SERVFAIL 73ms uncensoreddns-ipv4 [2026-04-13 11:24:41] 127.0.0.1 badsig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 110ms uncensoreddns-ipv4 [2026-04-13 11:24:41] 127.0.0.1 badsig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 55ms cloudflare-security [2026-04-13 11:24:42] 127.0.0.1 badsig-5e7f2c37.test-alg15.dnscheck.tools AAAA SERVFAIL 41ms cloudflare-security [2026-04-13 11:24:42] 127.0.0.1 expiredsig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 51ms cloudflare [2026-04-13 11:24:42] 127.0.0.1 expiredsig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 40ms cloudflare-security [2026-04-13 11:24:42] 127.0.0.1 expiredsig-5e7f2c37.test-alg15.dnscheck.tools AAAA SERVFAIL 55ms cloudflare-security [2026-04-13 11:24:42] 127.0.0.1 nosig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 56ms cloudflare-security [2026-04-13 11:24:42] 127.0.0.1 nosig-5e7f2c37.test-alg15.dnscheck.tools A SERVFAIL 52ms cloudflare [2026-04-13 11:24:42] 127.0.0.1 nosig-5e7f2c37.test-alg15.dnscheck.tools AAAA SERVFAIL 50ms cloudflare [2026-04-13 11:24:42] 127.0.0.1 test-vugyikw0l1c.null-addr.com A PASS 79ms uncensoreddns-ipv4 [2026-04-13 11:24:43] 127.0.0.1 test-nvgu7d28po.null-addr.net A PASS 74ms uncensoreddns-ipv4 [2026-04-13 11:24:43] 127.0.0.1 test-rm60bdp2j6i.null-addr.com A PASS 26ms cloudflare-security [2026-04-13 11:24:43] 127.0.0.1 test-g2wvbbzrjh.null-addr.net A PASS 25ms cloudflare-security [2026-04-13 11:24:43] 127.0.0.1 test-yvmmgseqj6g.null-addr.org A PASS 356ms uncensoreddns-ipv4 [2026-04-13 11:24:43] 127.0.0.1 test-7u15m9se1vr.null-addr.org A PASS 60ms uncensoreddns-ipv4 [2026-04-13 11:24:43] 127.0.0.1 test-93aytc4gmup.null-addr.com A PASS 63ms uncensoreddns-ipv4 [2026-04-13 11:24:43] 127.0.0.1 test-91lft63kiz.null-addr.net A PASS 22ms cloudflare-security [2026-04-13 11:24:43] 127.0.0.1 test-29nwdtycpk8.null-addr.org A PASS 202ms cloudflare-security [2026-04-13 11:24:43] 127.0.0.1 test-f7oam6n0sdk.null-addr.com A NETWORK_ERROR 56ms uncensoreddns-ipv4 [2026-04-13 11:24:44] 127.0.0.1 test-fwg6jlpzysu.null-addr.net A PASS 64ms cloudflare [2026-04-13 11:24:44] 127.0.0.1 test-tdz0m120fc.null-addr.org A PASS 76ms cloudflare-security [2026-04-13 11:24:44] 127.0.0.1 test-zxy250egft.null-addr.com A PASS 23ms cloudflare-security [2026-04-13 11:24:44] 127.0.0.1 test-ijzdap10gu.null-addr.net A PASS 24ms cloudflare-security [2026-04-13 11:24:44] 127.0.0.1 test-tnyk81p9qq8.null-addr.org A PASS 37ms cloudflare
i'm still not passing the test...so what have i to do..??
pls explain to me as you were talking to a little child not skilled at all
thxs so much indeed in adv
cheers

[lifenjoiner]

I don't know either. Seems it should work.
dnscrypt-proxy encrypts the communication. DNSSEC is not that important.

Only use dnscrypt-proxy, don't use the backup 9.9.9.9?

[Pina1924]

Hi @lifenjoiner thxs so much again for yr attn, as per yr instructions i've already deleted the 9.9.9.9 backup , i'm only using 127.0.0.1 as primary dns and not anyone as secondary,i can state that the dnssec test still do not pass at all...why are you able to pass it..??
i underline that if i use :https://github.com/msasanmh/DNSveil i can easely pass it...and also using a vpn...so i really think that is a bug of dnscrypt-proxy isn't it..??
waiting for yr kind reply i thxs so much indeed in adv for yr kind helping
cheers

[BrigsLabs]

@Pina1924 , i'm agree with last comment @lifenjoiner above. the problem is your windows. you need more advance tool to proxying secure dns queries. I'm using SDC tool in bridge for my windows client and you can find tool here :

https://github.com/msasanmh/DNSveil

[Pina1924]

hi @BrigsLabs :
unable to navigate if in te section Share+bypassDPI i start proxy and set proxy to system...
pratically the only way i can navigate is to go to youtube site
the problem is that very very few sites are compatible in my personal experience...
so everytime i enter a site and i'm not able to navigate it
how do you do...?
is there a trick?
which?
thxs so much in adv
cheers

[BrigsLabs]

No.. no magic trick. i only choose dns stamp that i want to connect (custom choice) from :
https://status.dnscrypt.info/?type=resolver&sort=name
and prefer to GoodBye-DPI since more private and can bypass some DPI machine with fragmenting package. My experience with Edge not too flawless, no check with another chrome based engine too, but play nicely with firefox based like Librewolf.

If you have more questioning about those toys, you can ask them in their repo. thx.

[Pina1924]

hi @BrigsLabs thxs so much foir yr kind reply and for the link you share
could you pls explain to me as you were talking to a little not skilled at all child this:
"prefer to GoodBye-DPI since more private and can bypass some DPI machine with fragmenting package. "
i'm using firefox and i repeat that if i ,in the section Share+bypassDPI , start proxy and set proxy to system...
pratically the only way i can navigate is to go to youtube site
the problem is that very very few sites are compatible in my personal experience...
so everytime i enter a site and i'm not able to navigate it
there is already opened an issue where you suggest but the maintainer reply that he still have internet connection problems
and so now he could not help anyone... :(
thxs in adv
cheers

[lifenjoiner]

DNSSEC just ensures the response is not modified. But the record can still be plaintext. It is designed for plaintext DNS, I think.

dnscrypt-proxy encrypts the whole request and response records.

[Pina1924]

hi @lifenjoiner : first thxs so much again
i found the point to add yr code:
'plan9dns-fl', 'plan9dns-fl-ipv6', 'plan9dns-mx', 'plan9dns-mx-ipv6', 'plan9dns-nj', 'plan9dns-nj.ipv6', 'plan9dns-fl-doh', 'plan9dns-fl-doh-ipv6', 'plan9dns-mx-doh', 'plan9dns-mx-doh-ipv6', 'plan9dns-nj-doh', 'plan9dns-nj-doh-ipv6'
is where there is:
`Server names to avoid even if they match all criteria
disabled_server_names = []
i changed that field as per yr instructions
but the test still fails...
we am i wrong?
where is my fault?
apologize my few skills
thxs so much again
cheers

[Pina1924]

hi to @lifenjoiner @jedisct1
just to let you know that the latest 2.1.16 finally solve the bug!
now we are finally able to pass the:
https://dnscheck.tools/
dnssec test is finally passed!!
thxs for yr great job and efforts!
cheers
:)

[Pina1924]

just for yr info when i try the test on:
https://dnscheck.tools/
i get this on the log:

2026-05-24 19:52:33] [INFO] A response with status code 2 was received - this is usually a temporary, remote issue with the configuration of the domain name [2026-05-24 19:52:33] [INFO] A response with status code 2 was received - this is usually a temporary, remote issue with the configuration of the domain name [2026-05-24 19:52:33] [INFO] A response with status code 2 was received - this is usually a temporary, remote issue with the configuration of the domain name [2026-05-24 19:52:34] [INFO] A response with status code 2 was received - this is usually a temporary, remote issue with the configuration of the domain name

is it a right behaviour...??
thxs in adv
cheers

[slimshady045]

my set up has a android usb tether as source.
it is catching more of the dns req on dnsfilter-proxy.

[slimshady045]

solved
had to reapply chattr +i /etc/resolv.conf
maybe some update reversed it.