# Install dnscrypt-proxy with Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, scoop, winget, zypper Secure communications between a client and a DNS resolver. Version 2.1.16 via Homebrew; verified 2026-05-24. ## Install ```sh sudo av install brew:dnscrypt-proxy ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install dnscrypt-proxy ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install dnscrypt-proxy ``` Evidence: MacPorts ports tree: net/dnscrypt-proxy/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add dnscrypt-proxy ``` Evidence: Alpine Linux edge package indexes: dnscrypt-proxy from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install dnscrypt-proxy ``` Evidence: Debian stable package indexes: dnscrypt-proxy from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install dnscrypt-proxy ``` Evidence: Fedora Rawhide package metadata: dnscrypt-proxy from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#dnscrypt-proxy ``` Evidence: nixpkgs package indexes: pkgs/by-name/dn/dnscrypt-proxy/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S dnscrypt-proxy ``` Evidence: Arch Linux sync databases: dnscrypt-proxy from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install dnscrypt-proxy ``` Evidence: openSUSE Tumbleweed package metadata: dnscrypt-proxy from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install dnscrypt-proxy ``` Evidence: Chocolatey community package catalog: dnscrypt-proxy from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='6.9919996','gmkvextractgui' - Scoop (92%): ```sh scoop install main/dnscrypt-proxy ``` Evidence: Scoop official bucket manifest trees: bucket/dnscrypt-proxy.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id DNSCrypt.dnscrypt-proxy -e ``` Evidence: Windows Package Manager source index: DNSCrypt.dnscrypt-proxy from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:dnscrypt-proxy - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.1.16 - **Source summary:** Secure communications between a client and a DNS resolver - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** ISC - **Source archive:** - **Last updated:** 2026-05-24T09:51:37Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - dnscrypt-proxy (cli) - dnscrypt-proxy (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Service: declared - Caveats: After starting dnscrypt-proxy, you will need to point your local DNS server to 127.0.0.1. You can do this by going to System Preferences > "Network" and clicking the "Advanced..." button for your interface. You will see a "DNS" tab where you can click "+" and enter 127.0.0.1 in the "DNS Servers" section. By default, dnscrypt-proxy runs on localhost (127.0.0.1), port 53, balancing traffic across a set of resolvers. If you would like to change these settings, you will have to edit the configuration file: $HOMEBREW_PREFIX/etc/dnscrypt-proxy.toml To check that dnscrypt-proxy is working correctly, open Terminal and enter the following command. Replace en1 with whatever network interface you're using: sudo tcpdump -i en1 -vvv 'port 443' You should see a line in the result that looks like this: resolver.dnscrypt.info - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 2.1.16 - Package-manager updated: 2026-05-24 - Local data: ok - Upstream repository: https://github.com/DNSCrypt/dnscrypt-proxy - Upstream latest detected: 2.1.16 (current) ## Project history and usage dnscrypt-proxy is the long-running client proxy for encrypted DNS in the DNSCrypt project. It sits between local applications and upstream resolvers, giving package-manager users a daemonized way to use DNSCrypt and related encrypted-DNS transports without changing every application. ### Project history The project grew out of DNSCrypt, a protocol for authenticating communication between DNS clients and resolvers. The DNSCrypt project documents the protocol as a way to protect DNS traffic from spoofing and tampering, and dnscrypt-proxy became the practical client-side program that made that protocol usable on Unix-like systems, Windows, and package-managed desktops. The modern dnscrypt-proxy repository is written in Go and presents itself as a flexible DNS proxy rather than a single-protocol experiment. Its documentation and repository cover DNSCrypt, DNS-over-HTTPS, relay support, filtering, caching, and service installation, which is why it has remained the default packaged client for users who want encrypted recursive DNS without running a full resolver stack. ### Adoption history dnscrypt-proxy has unusually broad package-manager coverage for a DNS privacy daemon: it appears in Homebrew, Debian and Ubuntu, Fedora/DNF, Arch, Alpine, MacPorts, Nix, Chocolatey, Scoop, Winget, and openSUSE-style packaging. That spread reflects both the cross-platform Go implementation and the recurring sysadmin need for a local encrypted-DNS forwarder. The project also became part of a wider DNS privacy ecosystem around public resolver lists, DNS stamp configuration, and anonymized DNS relays. Those surrounding lists and conventions matter to adoption because they let packaged clients work from shared resolver metadata rather than hard-coded vendor endpoints. ### How it is used Typical use is to run dnscrypt-proxy as a local service listening on localhost or a LAN address, then point the operating system, dnsmasq, Unbound, or another resolver toward it. The package is popular with users who want encrypted upstream DNS, filtering, cache control, and resolver selection from a single small daemon. In package-manager culture, dnscrypt-proxy is also the command-line counterpart to GUI DNS privacy settings: it gives power users a text configuration file, service manager integration, and auditable resolver lists. ### Why package nerds care dnscrypt-proxy is significant because it carried DNSCrypt from protocol idea to reinstallable infrastructure component. It is the package people reach for when they want encrypted DNS as a local Unix service rather than as a browser feature. It also marks the period when DNS privacy packaging stopped being just resolver software and started including local forwarders, public resolver metadata, relay lists, and policy knobs such as filtering and blocklists. ### Timeline - 2011: DNSCrypt public resolver infrastructure and resolver metadata begin the long-running public-list tradition. - 2017: The current Go-based dnscrypt-proxy release line reaches public 2.x releases. - 2019: The DNSCrypt project documents anonymized DNSCrypt relays, extending the ecosystem beyond simple client-to-resolver encryption. - 2020s: dnscrypt-proxy remains packaged across major Unix, Windows, and macOS package managers as a local encrypted-DNS daemon. ### Related projects - Related projects include dnscrypt-wrapper on the server side, DNSCrypt resolver-list repositories, dnsmasq and Unbound as local forwarders that can chain to dnscrypt-proxy, and dnsdist for higher-volume DNS traffic management. ### Sources - - - - - - ## Security Notes broad file, network, media, or database tool signal. formula declares a Homebrew service. - **Geiger risk:** orange / medium - broad file, network, media, or database tool signal - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: dnscrypt-proxy.toml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** dnscrypt-proxy - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - dnscrypt-proxy - 2.1.8+ds1-1+b4: normalized package name match | Debian stable package indexes: dnscrypt-proxy from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Flexible DNS proxy, with support for encrypted DNS protocols | https://github.com/DNSCrypt/dnscrypt-proxy - Nix - dnscrypt-proxy: normalized package name match | nixpkgs package indexes: pkgs/by-name/dn/dnscrypt-proxy/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - dnscrypt-proxy - 2.0.45+ds1-1.2: normalized package name match | Ubuntu 24.04 LTS package indexes: dnscrypt-proxy from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Flexible DNS proxy, with support for encrypted DNS protocols | https://github.com/DNSCrypt/dnscrypt-proxy - apk - dnscrypt-proxy - 2.1.16-r0: normalized package name match | Alpine Linux edge package indexes: dnscrypt-proxy from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Secure communication to DNS resolvers | https://dnscrypt.info - apk - dnscrypt-proxy-doc - 2.1.16-r0: normalized package name match | Alpine Linux edge package indexes: dnscrypt-proxy-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Secure communication to DNS resolvers (documentation) | https://dnscrypt.info - apk - dnscrypt-proxy-openrc - 2.1.16-r0: normalized package name match | Alpine Linux edge package indexes: dnscrypt-proxy-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Secure communication to DNS resolvers (OpenRC init scripts) | https://dnscrypt.info - apk - dnscrypt-proxy-setup - 2.1.16-r0: normalized package name match | Alpine Linux edge package indexes: dnscrypt-proxy-setup from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Script for setting up dnscrypt proxy | https://dnscrypt.info - dnf - dnscrypt-proxy - 2.1.14-6.fc44: normalized package name match | Fedora Rawhide package metadata: dnscrypt-proxy from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Flexible DNS proxy, with support for encrypted DNS protocols | https://github.com/dnscrypt/dnscrypt-proxy - pacman - dnscrypt-proxy - 2.1.16-1: normalized package name match | Arch Linux sync databases: dnscrypt-proxy from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A flexible DNS proxy, with support for encrypted DNS protocols | https://github.com/DNSCrypt/dnscrypt-proxy - zypper - dnscrypt-proxy - 2.1.16-1.1: normalized package name match | openSUSE Tumbleweed package metadata: dnscrypt-proxy from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A tool for securing communications between a client and a DNS resolver | https://dnscrypt.info/ - MacPorts - dnscrypt-proxy: normalized package name match | MacPorts ports tree: net/dnscrypt-proxy/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Chocolatey - dnscrypt-proxy: normalized package name match | Chocolatey community package catalog: dnscrypt-proxy from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='6.9919996','gmkvextractgui' - Scoop - main/dnscrypt-proxy: normalized package name match | Scoop official bucket manifest trees: bucket/dnscrypt-proxy.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget - DNSCrypt.dnscrypt-proxy: normalized package name match | Windows Package Manager source index: DNSCrypt.dnscrypt-proxy from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [dnscrypt-wrapper](https://www.automicvault.com/pkg/brew/dnscrypt-wrapper/) - Shares av.db curated category or tags: cli, dns, dnscrypt, networking, privacy. - [stubby](https://www.automicvault.com/pkg/brew/stubby/) - Shares av.db curated category or tags: cli, dns, networking, privacy. - [ctrld](https://www.automicvault.com/pkg/brew/ctrld/) - Shares av.db curated category or tags: cli, dns, networking, proxy. - [obfs4proxy](https://www.automicvault.com/pkg/brew/obfs4proxy/) - Shares av.db curated category or tags: cli, networking, privacy, proxy. - [sdns](https://www.automicvault.com/pkg/brew/sdns/) - Shares av.db curated category or tags: cli, dns, networking, privacy. - [technitium-dns](https://www.automicvault.com/pkg/brew/technitium-dns/) - Shares av.db curated category or tags: cli, dns, networking, privacy. - [torsocks](https://www.automicvault.com/pkg/brew/torsocks/) - Shares av.db curated category or tags: cli, networking, privacy, proxy. - [adns](https://www.automicvault.com/pkg/brew/adns/) - Shares av.db curated category or tags: cli, dns, networking. ## Combined YAML source View the package source record on GitHub. [combined/dnscrypt-proxy.yml](https://github.com/automic-vault/db/blob/main/combined/dnscrypt-proxy.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph