
##############################################
#                                            #
#        dnscrypt-proxy configuration        #
#                                            #
##############################################

## Online documentation is available here: https://dnscrypt.info/doc

server_names = ['brahma-world', 'cz.nic', 'dnscrypt-de-blahdns-ipv4', 'dnscrypt-fi-blahdns-ipv4', 'dnscrypt-jp-blahdns-ipv4', 'dnscrypt-sg-blahdns-ipv4', 'doh-de-blahdns', 'doh-jp-blahdns', 'doh-fi-blahdns', 'doh-sg-blahdns', 'doh.appliedprivacy.net', 'doh-fi-snopyta', 'powerdns-doh', 'lelux.fi']

listen_addresses = ['127.0.0.1:53']
max_clients = 250

ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = true
require_dnssec = true
require_nolog = true
#require_nofilter = true

force_tcp = false

timeout = 100
keepalive = 30

cert_refresh_delay = 240

fallback_resolvers = ['1.0.0.2:53']

ignore_system_dns = true

netprobe_timeout = -1
netprobe_address = '9.9.9.9:53'

block_ipv6 = true
block_unqualified = true
block_undelegated = true
reject_ttl = 600

cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600


###############################
#        Query logging        #
###############################

[query_log]

  file = 'query.log'
  format = 'tsv'
  ignored_qtypes = ['DNSKEY', 'NS']



############################################
#        Suspicious queries logging        #
############################################

[nx_log]

  file = 'nx.log'
  format = 'tsv'



##############################
#         Blacklists         #
##############################

[blacklist]
  blacklist_file = 'blacklist.txt'
  log_file = 'blocked.log'
  log_format = 'tsv'


################################################
#        Whitelists (blacklists bypass)        #
################################################

[whitelist]

  whitelist_file = 'whitelist.txt'
  log_file = 'whitelisted.log'
  log_format = 'tsv'




#########################
#        Servers        #
#########################

[sources]

  ## An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers

  [sources.'public-resolvers']
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
  cache_file = 'public-resolvers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  prefix = ''

  ## Anonymized DNS relays

  [sources.'relays']
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/relays.md', 'https://download.dnscrypt.info/resolvers-list/v2/relays.md']
  cache_file = 'relays.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 72
  prefix = ''

  
#########################################
#        Servers with known bugs        #
#########################################

[broken_implementations]

fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']


################################
#        Anonymized DNS        #
################################

[anonymized_dns]

skip_incompatible = false