dnscrypt-proxy on Ubuntu 24.04 LTS

dnscrypt-proxy is a flexible DNS proxy that encrypts your DNS traffic. It sits between your clients and the public internet: it accepts ordinary DNS queries on port 53 and forwards every one of them to a public upstream resolver over an encrypted transport, so your Internet provider and any network on the path can no longer see or tamper with the names you look up. It supports the modern encrypted DNS protocols including DNSCrypt v2, DNS over HTTPS, Anonymized DNSCrypt and Oblivious DoH. This cloudimg image runs dnscrypt-proxy 2.1.18 from the official release binary on Ubuntu 24.04 LTS, as a hardened systemd service.

dnscrypt-proxy is a single self contained Go binary whose behaviour is defined by one plain text configuration file, with no database and no web console to manage. On this image it listens for DNS on port 53 over both UDP and TCP on all interfaces, and forwards to upstreams chosen automatically from a cryptographically signed public resolver list by lowest latency. Upstream selection is restricted to resolvers that validate DNSSEC, keep no logs, and apply no filtering, so you get authentic, private, unfiltered answers. It runs as an unprivileged user with only the CAP_NET_BIND_SERVICE capability, and the systemd resolved stub listener is disabled so the proxy owns port 53 cleanly.

Security is built in. The image ships with no shared or default credentials of any kind, since dnscrypt-proxy has no login. It binds all interfaces so it can serve a whole network, but the stock Azure Network Security Group opens only SSH, so port 53 is not reachable from the internet until you deliberately open it. Because dnscrypt-proxy has no built in allow from access control list, the Network Security Group is your access control: open UDP and TCP 53 only to the client subnets you control, never to the whole internet, so the resolver is never abused as an open resolver.

dnscrypt-proxy is distributed under the ISC License, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the dnscrypt-proxy project or its authors; dnscrypt-proxy is a mark of its owner. cloudimg provides packaging, the secure by default encrypted only upstream policy, per instance first boot automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.