dnscry.pt - Road to 100 resolvers

Brueggus · September 16

➜  ~ whois dnscry.pt
Domain: dnscry.pt
Domain Status: Registered
Creation Date: 10/01/2023 10:26:12

It's been almost two years since I started the project with about 30 resolvers taken from my collection of idlers. And while I still love idling servers, it felt good to have them do something useful. But what is this all about?

The dnscry.pt project is a personal initiative by a developer known as @brueggus. It focuses on enhancing DNS security and privacy through the use of the DNSCrypt protocol. Here are some key points about the project:

DNSCrypt Protocol: This protocol authenticates and encrypts DNS requests between clients and resolvers, preventing third parties (like ISPs) from spying on or tampering with your DNS queries.

Public Resolvers: The project operates public DNSCrypt, DNS over HTTPS (DoH), and DNS over TLS (DoT) resolvers in various locations worldwide. These resolvers are uncensored, unfiltered, encrypted, and support DNSSEC.

No Logging: The project ensures privacy by not storing any query logs.

Accessibility: The resolvers can be used with any client implementing the DNSCrypt protocol, with dnscrypt-proxy being a recommended option.

If you’re interested in securing your DNS traffic, dnscry.pt offers a robust solution. Would you like to know more about how to set it up?

Thanks, Microsoft Copilot. While I wouldn't consider myself a developer, the rest is pretty accurate.

Since then, the project has been growing steadily and while I started it to promote the DNSCrypt protocol, which I still prefer over DoT/DoH, I eventually decided to support these two protocols as well on popular demand. My resolvers have been added to the official DNSCrypt resolver list and I am aware of a handful of open source projects which use my resolvers to circumvent censorship in countries which don't have the privilege of free internet access.

If you haven't looked into switching to an encrypted protocol to prevent your ISP, employer, Google or Cloudflare from analyzing or even tampering with your DNS traffic, I encourage you to do so. Chances are good that there's a dnscry.pt resolver near you.

This wouldn't have been possible without the help of generous providers sponsoring the project. Most of them are active here as well – show them some love, please!

At the moment, I am running 88 resolvers around the globe. 12 to go to reach my next milestone of 100 resolvers worldwide.

I'm particularly interested in expanding in Africa and South America and am still looking into providing a proper solution for Chinese users. But what would you be interested in? Any particular location in mind? Features you are missing? Let me know!

Hey Copilot, tell me a joke about DNSCrypt.

Sure, here’s a lighthearted one for you:

Why did the DNSCrypt protocol go to therapy?

Because it had too many unresolved queries! 😄

Wonder_Woman · September 16

Unfortunately I don't have anything meaningful to contribute at the moment, but I just wanted to say thank you to you and your sponsors for running these resolvers and allowing people to use them for free through dnscry.pt!

I noticed your post back when you started this project, and I was interested in keeping an eye on your progress. I've noticed, over the last few months, that my own Pi-Hole has started using some of your resolvers occasionally through DNSCrypt. It's awesome that dnscry.pt's resolvers were added to the official DNSCrypt resolver list.

Thanks again, it's all very much appreciated, and keep up the great work!

(P.S. - If you have stickers left or plan on having more made, I would love some!)

Kuroit · September 16

@Brueggus I see you dont have Redditch, UK location. Lets add that?

Will do Brisbane in future

terrorgen · September 16

What pain points do you see for users from China?

Brueggus · September 17

@Kuroit said:
@Brueggus I see you dont have Redditch, UK location. Lets add that?

Will do Brisbane in future

Sent you a PM. Thanks

@terrorgen said:
What pain points do you see for users from China?

The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

host_c · September 17

@brueggus

Happy to be part of your project, when I saw the map, I was like:

Keep up the nice work! and congratulations.

As we will expand our operations, I will DM you for further additions to the location list.

Brueggus · September 17

@Wonder_Woman said:
Unfortunately I don't have anything meaningful to contribute at the moment, but I just wanted to say thank you to you and your sponsors for running these resolvers and allowing people to use them for free through dnscry.pt!

I noticed your post back when you started this project, and I was interested in keeping an eye on your progress. I've noticed, over the last few months, that my own Pi-Hole has started using some of your resolvers occasionally through DNSCrypt. It's awesome that dnscry.pt's resolvers were added to the official DNSCrypt resolver list.

Thanks again, it's all very much appreciated, and keep up the great work!

(P.S. - If you have stickers left or plan on having more made, I would love some!)

Thank you a lot for your feedback! Having the resolvers added to the official list has definitely boosted the visibility of the project. Someone even created a script to sync the dnscry.pt resolvers with the official repo which I am very thankful for.

And sure thing - I still have some stickers left as well as some new merch. Just shoot me a message with your address and I'll get them shipped next week.

@host_c said: Happy to be part of your project,

Thanks for your support It means a lot to me. As said before, growing the project to its current extend wouldn't have been possible without providers like you backing it up.

terrorgen · September 17

@Brueggus said:

@terrorgen said:
What pain points do you see for users from China?

The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

All valid pain points
Do you want to try https://hk.skywolf.cloud/store/sjc-vps?language=english? I have been following them on telegram and they seem to be a pretty solid provider.

taizi · September 17

@Brueggus said: The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

also the possible that blocked by gfw(try not use default path like /dns-query ,gfw have active scan)

skhron · September 19

@taizi said:

@Brueggus said: The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

also the possible that blocked by gfw(try not use default path like /dns-query ,gfw have active scan)

I think it makes public DNSCrypt useless and changing URI to something else won't help much but defer block for a bit.

AuroraZero · September 19

@Brueggus can I put my weed in it?

Brueggus · September 20

@AuroraZero said:
@Brueggus can I put my weed in it?

Sure.

("weed" appears to be on the list of naughty words, so I had to replace them with dandelions.)

AuroraZero · September 20

@Brueggus said:

@AuroraZero said:
@Brueggus can I put my weed in it?

Sure.

("weed" appears to be on the list of naughty words, so I had to replace them with dandelions.)

You bad boy you, breaking all the rules

host_c · September 20

Sniffing dandelions

taizi · September 20

@skhron said:

@taizi said:

@Brueggus said: The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

also the possible that blocked by gfw(try not use default path like /dns-query ,gfw have active scan)

I think it makes public DNSCrypt useless and changing URI to something else won't help much but defer block for a bit.

i mean DoH

SGraf · September 20

@Brueggus said:
At the moment, I am running 88 resolvers around the globe. 12 to go to reach my next milestone of 100 resolvers worldwide.

Send me an email to [email protected]. I'm considering supporting this project with a vm in vienna and one in amsterdam.

skhron · September 20

@taizi said:

@skhron said:

@taizi said:

@Brueggus said: The RTT and/or packet loss, for sure. None of the resolvers has "China-optimized bandwith" and from what I've been able to check using public looking glasses, this makes a huge difference. But services with direct links to Chinese ISPs are outside my comfort zone price-wise.

also the possible that blocked by gfw(try not use default path like /dns-query ,gfw have active scan)

I think it makes public DNSCrypt useless and changing URI to something else won't help much but defer block for a bit.

i mean DoH

Anyway, my point is that dnscry.pt runs a public service that publishes the list of DNSCrypt/DoT/DoH servers, making it not useful for circumventing censorship due to service design. Also, maintenance of censorship-resistant public service, like Tor Bridges or anything similar is pretty time-consuming and expensive task.

Given all of that, I see no sense in attempting changing some connection parameters as they will be inevitably leaked to censorship operators due to publicity.

Brueggus · December 25

It's been about two years since I came up with the wet idea to turn my idlers into something useful for the public. Today, I am running 106 resolvers worldwide. Oopsie.
This wouldn't have been possible without the generosity of the sponsors of this project, of course. Most of them are active members of the LowEnd community.

I'd like to celebrate this by giving away two of these brand new dnscry.pt mugs:

ChatGPT and I have created a small CTF challenge which can be found at https://raffle.dnscry.pt/
More information on how to participate can be found here.
If you don't live in the EU or rather spend your time on smashing F5 in the Christmas thread, I still have few dnscry.pt stickers in stock. Just shoot me a PM - I ship these worldwide.

Good luck and Merry Christmas!

AuroraZero · December 25

Merry Christmas @Brueggus!!! Thank You for all the hard work!!!

rcy026 · December 25

@Brueggus said:

Where can I buy that mug?

Wonder_Woman · 4:23AM

@Brueggus said:
It's been about two years since I came up with the wet idea to turn my idlers into something useful for the public. Today, I am running 106 resolvers worldwide. Oopsie.
This wouldn't have been possible without the generosity of the sponsors of this project, of course. Most of them are active members of the LowEnd community.

I'd like to celebrate this by giving away two of these brand new dnscry.pt mugs:

ChatGPT and I have created a small CTF challenge which can be found at https://raffle.dnscry.pt/
More information on how to participate can be found here.
If you don't live in the EU or rather spend your time on smashing F5 in the Christmas thread, I still have few dnscry.pt stickers in stock. Just shoot me a PM - I ship these worldwide.

Good luck and Merry Christmas!

This was really fun! Unfortunately I'm not in the EU

dnscry.pt - Road to 100 resolvers

Comments