# Empty listen_addresses to use systemd socket activation
#listen_addresses = ['127.0.0.1:5053', '[::1]:5053']
listen_addresses = ['127.0.0.1:5053']
disabled_server_names = ['cloudflare', 'google', 'dnscry.pt-dusseldorf-ipv4', 'dnscry.pt-dusseldorf02-ipv4']
fallback_resolvers = ['9.9.9.9:53', '212.159.13.49:53', '212.159.6.9:53']
tls_cipher_suite = [52392, 49199]
ignore_system_dns = true
# Use servers reachable over IPv4
ipv4_servers = true
# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
ipv6_servers = false
# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = true
# Use servers implementing the DNS-over-HTTPS protocol
#doh_servers = true
doh_servers = false
## Require servers defined by remote sources to satisfy specific properties
# Server must support DNS security extensions (DNSSEC)
require_dnssec = true
# Server must not log user queries (declarative)
require_nolog = true
# Server must not enforce its own blacklist (for parental control, ads blocking...)
require_nofilter = true
# Don't cache
cache = false
cloaking_rules = 'cloaking-rules.txt'
[query_log]
 file = '/var/log/dnscrypt-proxy/query.log'
[nx_log]
 file = '/var/log/dnscrypt-proxy/nx.log'
# Anonymized DNS section.
# -----------------------
[anonymized_dns]
routes = [
 { server_name='*', via=['sdns://gQ4xODUuMjQ0LjI3LjEzNg', 'sdns://gQ4xOTguMTQwLjE0MS40Ng'] }
]
skip_incompatible = true
[sources]
 [sources.'public-resolvers']
 urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']
 cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
 minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
 refresh_delay = 72
 prefix = ''