dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers

BrueggusBrueggus OG
in Technical

Some of you may remember my VPS flea market which became a bit messy eventually. I was nonetheless able to get rid of some of my idlers, others were canceled since then but I'm still sitting on a pile of them.

In December, I decided to turn some of them into something useful (hopefully...) for the community and dnscry.pt was born:



Public DNSCrypt resolvers hosted by LowEnd providers

Most of the servers have been taken from my collection of idlers, but I'd like to give a shout-out to @Kuroit and @terrahost who are generously sponsoring three servers for the project.

In a nutshell, DNSCrypt is a protocol which encrypt and authenticates your DNS requests, so that a third party (like your ISP) can no longer tinker with them. You have to run a DNSCrypt client like dnscrypt-proxy locally or in your network and point your DNS requests there instead of towards your Wi-Fi router or public resolvers like Google's 8.8.8.8. Your DNSCrypt client will take care of the encryption and forward your requests to a public DNSCrypt resolver (like one of those I run for dnscry.pt).

None of the resolvers do any filtering of any kind. I don't store any logs of your requests. All I do is collect metrics using Munin.

If you're interested in giving it a try, further instructions can be found here. There's also a list of all resolvers.

Singapore may appear offline from time to time but is doing fine for local traffic. Intercontinental traffic is going through Cogent and their lines appear to be congested af. I'm monitoring all resolvers from a server hosted in Jacksonville, FL.

If you're using dnscrypt-proxy, you don't have to handpick resolvers near your location. Instead, use the auto-generated resolver list. Configuration instructions can be found in the file header or in the "Get Started" guide on the website.

I hope this is useful for some of you. I'm using DNSCrypt for years and have switched to my resolver list recently.

Let me know if you have any feedback or questions. I'm also open for suggestions for new locations. :smile:

dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

«1

Comments

  • cmeerwcmeerw

    Is DNSCrypt still a thing? I thought it was superseded by DoH/DoT.

  • FritzFritz Behlnd you

    @cmeerw said:
    Is DNSCrypt still a thing? I thought it was superseded by DoH/DoT.

    DoH/DoT can be intercepted by ISP.. Dunno how.

    https://microlxc.net/

  • BrueggusBrueggus OG

    @cmeerw said:
    Is DNSCrypt still a thing? I thought it was superseded by DoH/DoT.

    I've never been a fan of DoH and DoT due to their protocol overhead. Still, those are more popular nowadays.

    Unlike DoH/DoT, DNSCrypt has never been standardized in form of a RFC. But since it works well for me and is easy to maintain, I'd still say DNSCrypt has its right to exist.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • blissbliss

    This is great.
    Another alternative to commercial companies products. Keep it up, man.

    MicroLXC is lovable.

  • EncodersEncoders

    so how do I run my own instance? possibly with ghetto-rigging it with wireguard

    atm DoH still suffice for my usage (especially for android private dns), but this seems interesting to try

    Fuck this 24/7 internet spew of trivia and celebrity bullshit.

  • salakissalakis OG

    Cool project, I really like the option of a non-commercial DNS, but also gotta say that imo the days of glory of DNSCrypt are long over, the killer feature of DoH and DoT is that they work OOTB on Android, iOS and macOS.

    I also remember that back then when I messed around with DNSCrypt, it was actually pretty darn slow, or more precisely the DNS proxy implementations that I used at that time.
    Since I run my own DoH/DoT instance, what made you pick unbound over knot-resolver, I feel like it works better on LE platforms.

    Either way, thanks @Brueggus for the community effort and keep it up!

    If I dare to state some wishes - considering adding DoT/DoH with nice and signed iOS MDM profiles (like dnsforge.de) and adding an option for blocklists (oisd.nl is superb).

  • benzbenz
    edited February 2023

    Great project, finally some more servers that actually respond with a RRSIG.
    For anyone wondering - the opnsense version of dnscrypt-proxy isn't recent enough for the provided DNS Stamps.

    If someone needs a list of a couple of other EU servers that respond with RRSIG, let me know.

  • BrueggusBrueggus OG

    @benz said:
    For anyone wondering - the opnsense version of dnscrypt-proxy isn't recent enough for the provided DNS Stamps.

    Is it due to the signature algorithm I use to sign the resolver list? I ran into a similar issue since the version of dnscrypt-proxy I run on my Raspberry Pi at home was too old for "non-legacy" signatures.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • benzbenz

    @Brueggus said: Is it due to the signature algorithm I use to sign the resolver list?

    I guess so, opnsense uses version 2.0.45.

  • alexxggalexxgg OG

    @Brueggus said: Let me know if you have any feedback or questions.

    Nice project, this should be added to DNSCrypt official resolvers.

  • crunchbitscrunchbits Provider

    @Brueggus you already have our primary geographic location covered (same DC), but if you wanted a sponsored one w/IPv6 I'm happy to oblige.

    synteqhpc.com - 2.5Gbps Custom VPS | EPYC Turin Performance VDS | 10G Instant Dedicated Servers | FrankZ still lives on in SPO03

  • BrueggusBrueggus OG
    edited March 2023

    @alexxgg said:

    @Brueggus said: Let me know if you have any feedback or questions.

    Nice project, this should be added to DNSCrypt official resolvers.

    I'm a bit hesitant to open a PR to have them added. I don't have much experience with the components involved. I've seen PRs on their repo of people asking to have their resolvers removed due to the amount of traffic they get. Bandwidth shouldn't be an issue but I don't know how much CPU and memory they require if they're under load. So I'd prefer to get some traffic (and gain experience) first before I open the flood-gates.

    @crunchbits said:
    @Brueggus you already have our primary geographic location covered (same DC), but if you wanted a sponsored one w/IPv6 I'm happy to oblige.

    Thanks for the generous offer. I'll keep it in mind and am looking forward to your next expansion ;)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Practically everything behind the scenes is automated via Ansible, so adding/removing resolvers is a piece of cake.
    So I've taken 14 servers from my collection of idlers and dedicated them to the project. Another one in Stockholm, Sweden has been donated by Internetport who are running a promo on OGF at the moment.

    New Locations:
    * 🇺🇸 Philadelphia, Durham, Denver, Salt Lake City, Atlanta, Chicago
    * 🇨🇦 Castlegar, Montreal
    * 🇨🇱 Valdivia
    * 🇮🇳 Mumbai
    * 🇿🇦 Johannesburg
    * 🇹🇼 Taipeh
    * 🇲🇩 Chișinău
    * 🇸🇪 Stockholm
    * 🇮🇪 Dublin

    Instructions on how to use them can be found here or in the first post.

    Enjoy!

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Woop! Woop!

    image

    We have stickers available now. I'm unsure whether anyone cares, but if you'd like to pimp your laptop lid, let me know and I'll get one shipped.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • risturizristuriz OG

    International shipping for stickers? :-)

  • BrueggusBrueggus OG

    @risturiz said:
    International shipping for stickers? :-)

    Sure, it's not much more expensive than a domestic letter.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • skorousskorous OG
    edited March 2023

    @Brueggus said:

    @risturiz said:
    International shipping for stickers? :-)

    Sure, it's not much more expensive than a domestic letter.

    Oh, in that case I'd be happy to have one. Wasn't going to ask since it had to come across the pond.

    It'll look good next to my Grimm Reaper and Bernie in Mittens. DM you?

  • daffydaffy

    @Brueggus said:
    Woop! Woop!

    image

    We have stickers available now. I'm unsure whether anyone cares, but if you'd like to pimp your laptop lid, let me know and I'll get one shipped.

    I'm getting a 403 on the image link, but I'd like some! I'll pay for the shipping as well if you can throw in more than one :)

    FreeVPS.org - Grab a free VPS! | SOGo Webmail - Powered by Alinto

  • BrueggusBrueggus OG

    @daffy said:

    @Brueggus said:
    Woop! Woop!

    image

    We have stickers available now. I'm unsure whether anyone cares, but if you'd like to pimp your laptop lid, let me know and I'll get one shipped.

    I'm getting a 403 on the image link, but I'd like some!

    Sorry for that... I have to move my image hosting. The current hoster seems to do some weird geo-blocking stuff.

    I'll pay for the shipping as well if you can throw in more than one :)

    @skorous said: DM you?

    Don't worry about the shipping fees. It's about €1 per letter and Paypal will likely charge the same amount... Just DM me your address and how many stickers you'd like. I ordered only a small batch of 12 stickers, so please keep it within reasonable limits. :)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • daffydaffy

    @Brueggus said:

    @daffy said:

    @Brueggus said:
    Woop! Woop!

    image

    We have stickers available now. I'm unsure whether anyone cares, but if you'd like to pimp your laptop lid, let me know and I'll get one shipped.

    I'm getting a 403 on the image link, but I'd like some!

    Sorry for that... I have to move my image hosting. The current hoster seems to do some weird geo-blocking stuff.

    I'll pay for the shipping as well if you can throw in more than one :)

    @skorous said: DM you?

    Don't worry about the shipping fees. It's about €1 per letter and Paypal will likely charge the same amount... Just DM me your address and how many stickers you'd like. I ordered only a small batch of 12 stickers, so please keep it within reasonable limits. :)

    DM'd :)

    FreeVPS.org - Grab a free VPS! | SOGo Webmail - Powered by Alinto

  • rcy026rcy026

    @Brueggus said:

    Don't worry about the shipping fees. It's about €1 per letter and Paypal will likely charge the same amount... Just DM me your address and how many stickers you'd like. I ordered only a small batch of 12 stickers, so please keep it within reasonable limits. :)

    I don't know where you ordered the stickers, but a lot of those places will let you sell them directly to other people.
    That way anyone could order as many stickers they want directly from the printer and you will not have to pay shipping.

  • BrueggusBrueggus OG

    @rcy026 said:

    @Brueggus said:

    Don't worry about the shipping fees. It's about €1 per letter and Paypal will likely charge the same amount... Just DM me your address and how many stickers you'd like. I ordered only a small batch of 12 stickers, so please keep it within reasonable limits. :)

    I don't know where you ordered the stickers, but a lot of those places will let you sell them directly to other people.
    That way anyone could order as many stickers they want directly from the printer and you will not have to pay shipping.

    That's a good idea. I'll consider it if more people are interested. For now I'm just looking to get the other half of my sample batch off my desk.

    I'll get the stickers shipped tomorrow. If anyone wants some and hasn't PM'ed me yet, please do so now :)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • daffydaffy
    edited March 2023

    Stickers received. Thanks @Brueggus! :)
    Waiting for a new laptop, will put them properly then.

    Edit: made the image slightly smaller.
    Btw, very pretty handwriting @Brueggus, at least compared to mine :p

    FreeVPS.org - Grab a free VPS! | SOGo Webmail - Powered by Alinto

  • BrueggusBrueggus OG

    @daffy said:
    Btw, very pretty handwriting @Brueggus, at least compared to mine

    Oh well... It used to be much cleaner but it's become worse and worse over the years. Glad to hear that you've been able to read it. ;)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • MannDudeMannDude Provider IncogNET - Speech and Privacy

    Happy to donate an instance for you if you'd like a presence in Naaldwijk, Netherlands.

    [ IncogNET LLC ] - Since 2020
    [ The Internet Speech & Privacy Company ]

  • BrueggusBrueggus OG

    @MannDude said:
    Happy to donate an instance for you if you'd like a presence in Naaldwijk, Netherlands.

    Thanks for the offer <3 I'll let you know when I'm adding the next batch.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • MannDudeMannDude Provider IncogNET - Speech and Privacy

    @Brueggus said:

    @MannDude said:
    Happy to donate an instance for you if you'd like a presence in Naaldwijk, Netherlands.

    Thanks for the offer <3 I'll let you know when I'm adding the next batch.

    Sure thing, happy to help.

    [ IncogNET LLC ] - Since 2020
    [ The Internet Speech & Privacy Company ]

  • BrueggusBrueggus OG

    The resolver in Mumbai is offline due to https://lowendspirit.com/discussion/5655/stromonic-has-deadpooled .
    It will most likely not be replaced as there aren't many options in that region.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • treesmokahtreesmokah

    amazing.
    any plans to support anonymized dns with dnscrypt?

  • rubenmdhrubenmdh OG


    I received a letter with some amazing stuff inside :)
    Thanks @Brueggus!

  • rcy026rcy026

    Got the letter, pimped one of the laptops and my workstation.
    Thanks! :smile:

    IMG-20230420-210812
    IMG-20230420-210628

  • BrueggusBrueggus OG

    Quick update:

    • I've migrated New York to a new server with another provider since EasyVM hasn't been able to resolve their IPv6 issues over the last four weeks
    • Taiwan has IPv6 issues as well but there's no budget-friendly alternative. Still waiting for SoftShellWeb to get things sorted
    • The resolver in India is deprecated and will be removed eventually. The renewal fees have quadrupled after Stromonic was merged into LeapSwitch.

    If you're using the resolver list, nothing needs to be done on your side as it gets updated automatically. If not, you should use the resolver list instead of hardcoding your resolvers.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • leapswitchleapswitch Provider

    We have not increased any prices after merging Stromonic. Please provide more details/pm/email us.

  • dwightdwight

    Hope these IPs can be replaced by a single anycasted IP... At least an anycasted IPv6 address

  • BrueggusBrueggus OG

    @dwight said:
    Hope these IPs can be replaced by a single anycasted IP... At least an anycasted IPv6 address

    Not going to happen - most providers I use don't provide BGP or charge high fees. If you use the resolver list (https://www.dnscry.pt/resolvers.md) for dnscrypt-proxy, it'll check the latency and pick the server with the lowest RTT:

    Feb 16 21:17:00 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:00] [NOTICE] Firefox workaround initialized
[...]
Feb 16 21:17:08 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:08] [NOTICE] -   214ms dnscry.pt-singapore-ipv6
Feb 16 21:17:08 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:08] [NOTICE] -   286ms dnscry.pt-tokyo-ipv6
Feb 16 21:17:08 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:08] [NOTICE] -   317ms dnscry.pt-sydney-ipv6
Feb 16 21:17:08 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:08] [NOTICE] Server with the lowest initial latency: dnscry.pt-coventry-ipv6 (rtt: 52ms)
Feb 16 21:17:08 asterisk dnscrypt-proxy[14177]: [2023-02-16 21:17:08] [NOTICE] dnscrypt-proxy is ready - live servers: 20

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • alexxggalexxgg OG

    Hi @Brueggus, testing your service for a few weeks now, doing just great. Deserve a post. Keep the good work.

  • BrueggusBrueggus OG

    @alexxgg said:
    Hi @Brueggus, testing your service for a few weeks now, doing just great. Deserve a post. Keep the good work.

    Uh, nice. Glad you like it and thanks a lot for the post! :)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Sadly @Kuroit, who've been sponsoring the resolver in Zurich, CH for the past months (Thank you! <3) have announced that they're going to close down their operations there.

    I'd love to keep Switzerland in the portfolio, so if any provider out there would be willing to sponsor a VPS, let me know. More info: https://www.dnscry.pt/sponsors/

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • MikeAMikeA ProviderOG

    You should edit your site meta title so SEO ranks properly, hard to find it on search engine.

    If you want to replace some of your out-of-pocket cost locations send me a PM.

    ExtraVM - KVM NVMe VPS in USA, EU, APAC -|- RackColo - Find Colo

  • BrueggusBrueggus OG

    @MikeA said:
    You should edit your site meta title so SEO ranks properly, hard to find it on search engine.

    You're right... I relied on the CMS which hasn't been too helpful here. I've just done some adjustments - let's see how it goes!

    If you want to replace some of your out-of-pocket cost locations send me a PM.

    Thanks for the offer! <3 The servers in those locations you're covering as well are paid for until 2024, so I'll keep them as they are for now. I'd be interested to add a resolver in France but have heard of issues with OVH's protection and DNSCrypt traffic. :(

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Thanks to @MannDude , @crunchbits and @skhron, who are generously providing VMs for the project, we're now running 40 resolvers 🎉

    • removed: Zurich
    • added: London
    • added: Warsawa
    • added: Naaldwijk
    • added Liberty Lake, WA
    • added Spokane, WA
    • added Phoenix, AZ

    The dnscry.pt resolvers have been added to the "official" list of DNSCrypt resolvers that ships with dnscrypt-proxy by default yesterday, which I'm very happy about.

    I'm currently looking into adding DoH support to the resolvers which isn't as difficult as I thought, but would still require a weekend or two to get this done properly.

    Let's have another round of stickers to celebrate 40 dnscry.pt resolvers. If you'd like to pimp your laptop or your neighbor's car (don't!), send me your postal address (please include the country!) and whether you'd like one or two* stickers. When they're gone, they're gone.
    * I may only send one if I run our of stickers...


    image

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • somiksomik OG Hostbusters

    @Brueggus said:
    If you'd like to pimp your laptop or your neighbor's car

    How about neighbors' laptop or police car? :lol:

    I speak fluent sarcasm and broken logic. | I would agree with you, but thæn we’d both be wrong.

  • FrankZFrankZ ModeratorOG

    @somik said:
    How about neighbors' laptop or police car? :lol:

    Just know that we'll miss you while your away.

  • somiksomik OG Hostbusters

    @FrankZ said:

    @somik said:
    How about neighbors' laptop or police car? :lol:

    Just know that we'll miss you while your away.

    I pick "Police car laptop" as my final choice :lol:

    I speak fluent sarcasm and broken logic. | I would agree with you, but thæn we’d both be wrong.

  • BrueggusBrueggus OG

    @treesmokah said:
    any plans to support anonymized dns with dnscrypt?

    Sorry, missed your post. I'll look into it - shouldn't be too difficult. Just need to figure out what else is needed besides flipping the switch in the config file.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Last call for stickers! If you want some, let me know within the next 24h. I'll get the next batch shipped on Wednesday.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    Stickers have been sent out to anyone who reached out!

    Salt Lake City will be removed soon due to networking issues the provider is unable to resolve. I'll add Las Vegas instead (nowhere close, I know...) and Los Angeles and another location in the Netherlands (sponsored by Crowncloud <3 ) will be added soon™

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • tmetme

    Awww man even I wanted one... Just saw this post

  • BrueggusBrueggus OG

    @tme said:
    Awww man even I wanted one... Just saw this post

    Send me your address via pm or mail ([email protected]) and I'll get some shipped to you :)

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

  • BrueggusBrueggus OG

    So... bit of a mess here due to the recent announcement by DediPath.

    KnownHost has already agreed to sponsor a VM in Atlanta to replace the current resolver.
    I also have a replacement for Salt Lake City as soon as the dust has settled for hostEONS.

    I'm still looking for a replacement for Denver and adding Las Vegas + Jacksonville was planned for this weekend but will not happen.

    But what's even worse... the gallery of sponsors on the website looks shitty, to say the least:

    image

    I'm no web designer, so if anyone has a good idea how I can arrange the providers' logos and make them look nice no matter whether their text is dark or light, please let me know.

    dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers • Need a free NAT LXC? -> https://microlxc.net/

Sign In or Register to comment.