A flexible DNS proxy, with support for modern encrypted DNS protocols.
A flexible DNS proxy, with support for modern encrypted DNS protocols such as DNSCrypt v2, DNS-over-HTTPS, Anonymized DNSCrypt and ODoH (Oblivious DoH).
Added support for PQDNSCrypt (DNSCrypt 2026), using post-quantum cryptography with compatible DNSCrypt servers to protect query confidentiality against future quantum computers. It is enabled by default and can be disabled with the new pqdnscrypt setting.
Key material is now rotated when the local network changes, reducing linkability across network changes.
Fixed a cache issue that could corrupt cached responses or cause data races under concurrent use.
The netprobe_timeout configuration setting is now honored instead of being silently overridden by its command-line default.
Forwarded queries now correctly fall back to TCP after a truncated UDP response, and SOCKS-proxied anonymized DNS exchanges are sent to the relay.
HTTP/3 connections now retry after transient failures, and bootstrap resolution succeeds when at least one address was obtained.
Cloaking rules that resolve through a rule ending in an IP address are no longer incorrectly rejected as recursive. Actual loops are still rejected.
The monitoring dashboard now resolves API paths against the page origin, allowing it to work correctly when hosted under a path.
