# Empty listen_addresses to use systemd socket activation
#listen_addresses = ['127.0.0.1:5053', '[::1]:5053']
listen_addresses = ['127.0.0.1:5053']
disabled_server_names = ['cloudflare', 'google', 'dnscry.pt-dusseldorf-ipv4', 'dnscry.pt-dusseldorf02-ipv4']
fallback_resolvers = ['9.9.9.9:53', '212.159.13.49:53', '212.159.6.9:53']
tls_cipher_suite = [52392, 49199]
ignore_system_dns = true

# Use servers reachable over IPv4
ipv4_servers = true

# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
ipv6_servers = false

# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = true

# Use servers implementing the DNS-over-HTTPS protocol
#doh_servers = true
doh_servers = false

## Require servers defined by remote sources to satisfy specific properties

# Server must support DNS security extensions (DNSSEC)
require_dnssec = true

# Server must not log user queries (declarative)
require_nolog = true

# Server must not enforce its own blacklist (for parental control, ads blocking...)
require_nofilter = true

# Don't cache
cache = false

cloaking_rules = 'cloaking-rules.txt'

[query_log]
  file = '/var/log/dnscrypt-proxy/query.log'

[nx_log]
  file = '/var/log/dnscrypt-proxy/nx.log'

# Anonymized DNS section.
# -----------------------
[anonymized_dns]

routes = [
    { server_name='*', via=['sdns://gQ4xODUuMjQ0LjI3LjEzNg', 'sdns://gQ4xOTguMTQwLjE0MS40Ng'] }
]

skip_incompatible = true

[sources]

  [sources.'public-resolvers']
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']
  cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 72
  prefix = ''