DNS Proxy <!-- omit in toc -->
A simple DNS proxy server that supports all existing DNS protocols including
DNS-over-TLS
, DNS-over-HTTPS
, DNSCrypt
, and DNS-over-QUIC
. Moreover,
it can work as a DNS-over-HTTPS
, DNS-over-TLS
or DNS-over-QUIC
server.
How to install
There are several options how to install dnsproxy
.
- Grab the binary for your device/OS from the Releases page.
- Use the official Docker image.
- Build it yourself (see the instruction below).
How to build
You will need Go v1.21 or later.
$ make build
Usage
Usage:
dnsproxy [OPTIONS]
Application Options:
--config-path= yaml configuration file. Minimal working configuration in config.yaml.dist. Options passed through command line will override the ones from this file.
-o, --output= Path to the log file. If not set, write to stdout.
-c, --tls-crt= Path to a file with the certificate chain
-k, --tls-key= Path to a file with the private key
--https-server-name= Set the Server header for the responses from the HTTPS server. (default: dnsproxy)
--https-userinfo= If set, all DoH queries are required to have this basic authentication information.
-g, --dnscrypt-config= Path to a file with DNSCrypt configuration. You can generate one using https://github.com/ameshkov/dnscrypt
--edns-addr= Send EDNS Client Address
--upstream-mode= Defines the upstreams logic mode, possible values: load_balance, parallel, fastest_addr (default: load_balance)
-l, --listen= Listening addresses
-p, --port= Listening ports. Zero value disables TCP and UDP listeners
-s, --https-port= Listening ports for DNS-over-HTTPS
-t, --tls-port= Listening ports for DNS-over-TLS
-q, --quic-port= Listening ports for DNS-over-QUIC
-y, --dnscrypt-port= Listening ports for DNSCrypt
-u, --upstream= An upstream to be used (can be specified multiple times). You can also specify path to a file with the list of servers
-b, --bootstrap= Bootstrap DNS for DoH and DoT, can be specified multiple times (default: use system-provided)
-f, --fallback= Fallback resolvers to use when regular ones are unavailable, can be specified multiple times. You can also specify path to a file with the list of servers
--private-rdns-upstream= Private DNS upstreams to use for reverse DNS lookups of private addresses, can be specified multiple times
--dns64-prefix= Prefix used to handle DNS64. If not specified, dnsproxy uses the 'Well-Known Prefix' 64:ff9b::. Can be specified multiple times
--private-subnets= Private subnets to use for reverse DNS lookups of private addresses
--bogus-nxdomain= Transform the responses containing at least a single IP that matches specified addresses and CIDRs into NXDOMAIN. Can be specified multiple times.
--timeout= Timeout for outbound DNS queries to remote upstream servers in a human-readable form (default: 10s)
--cache-min-ttl= Minimum TTL value for DNS entries, in seconds. Capped at 3600. Artificially extending TTLs should only be done with careful consideration.
--cache-max-ttl= Maximum TTL value for DNS entries, in seconds.
--cache-size= Cache size (in bytes). Default: 64k
-r, --ratelimit= Ratelimit (requests per second)
--ratelimit-subnet-len-ipv4= Ratelimit subnet length for IPv4. (default: 24)
--ratelimit-subnet-len-ipv6= Ratelimit subnet length for IPv6. (default: 56)
--udp-buf-size= Set the size of the UDP buffer in bytes. A value <= 0 will use the system default.
--max-go-routines= Set the maximum number of go routines. A zero value will not not set a maximum.
--tls-min-version= Minimum TLS version, for example 1.0
--tls-max-version= Maximum TLS version, for example 1.3
--pprof If present, exposes pprof information on localhost:6060.
--version Prints the program version
-v, --verbose Verbose output (optional)
--insecure Disable secure TLS certificate validation
--ipv6-disabled If specified, all AAAA requests will be replied with NoError RCode and empty answer
--http3 Enable HTTP/3 support
--cache-optimistic If specified, optimistic DNS cache is enabled
--cache If specified, DNS cache is enabled
--refuse-any If specified, refuse ANY requests
--edns Use EDNS Client Subnet extension
--dns64 If specified, dnsproxy will act as a DNS64 server
--use-private-rdns If specified, use private upstreams for reverse DNS lookups of private addresses
Help Options:
-h, --help Show this help message
Examples
Simple options
Runs a DNS proxy on 0.0.0.0:53
with a single upstream - Google DNS.
./dnsproxy -u 8.8.8.8:53
The same proxy with verbose logging enabled writing it to the file log.txt
.
./dnsproxy -u 8.8.8.8:53 -v -o log.txt
Runs a DNS proxy on 127.0.0.1:5353
with multiple upstreams.
./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8:53 -u 1.1.1.1:53
Listen on multiple interfaces and ports:
./dnsproxy -l 127.0.0.1 -l 192.168.1.10 -p 5353 -p 5354 -u 1.1.1.1
The plain DNS upstream server may be specified in several ways:
-
With a plain IP address:
./dnsproxy -l 127.0.0.1 -u 8.8.8.8:53
-
With a hostname or plain IP address and the
udp://
scheme:./dnsproxy -l 127.0.0.1 -u udp://dns.google -u udp://1.1.1.1
-
With a hostname or plain IP address and the
tcp://
scheme to force using TCP:./dnsproxy -l 127.0.0.1 -u tcp://dns.google -u tcp://1.1.1.1
Encrypted upstreams
DNS-over-TLS upstream:
./dnsproxy -u tls://dns.adguard.com
DNS-over-HTTPS upstream with specified bootstrap DNS:
./dnsproxy -u https://dns.adguard.com/dns-query -b 1.1.1.1:53
DNS-over-QUIC upstream:
./dnsproxy -u quic://dns.adguard.com
DNS-over-HTTPS upstream with enabled HTTP/3 support (chooses it if it's faster):
./dnsproxy -u https://dns.google/dns-query --http3
DNS-over-HTTPS upstream with forced HTTP/3 (no fallback to other protocol):
./dnsproxy -u h3://dns.google/dns-query
DNSCrypt upstream (DNS Stamp of AdGuard DNS):
./dnsproxy -u sdns://AQMAAAAAAAAAETk0LjE0MC4xNC4xNDo1NDQzINErR_JS3PLCu_iZEIbq95zkSV2LFsigxDIuUso_OQhzIjIuZG5zY3J5cHQuZGVmYXVsdC5uczEuYWRndWFyZC5jb20
DNS-over-HTTPS upstream (DNS Stamp of Cloudflare DNS):
./dnsproxy -u sdns://AgcAAAAAAAAABzEuMC4wLjGgENk8mGSlIfMGXMOlIlCcKvq7AVgcrZxtjon911-ep0cg63Ul-I8NlFj4GplQGb_TTLiczclX57DvMV8Q-JdjgRgSZG5zLmNsb3VkZmxhcmUuY29tCi9kbnMtcXVlcnk
DNS-over-TLS upstream with two fallback servers (to be used when the main upstream is not available):
./dnsproxy -u tls://dns.adguard.com -f 8.8.8.8:53 -f 1.1.1.1:53
Encrypted DNS server
Runs a DNS-over-TLS proxy on 127.0.0.1:853
.
./dnsproxy -l 127.0.0.1 --tls-port=853 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0
Runs a DNS-over-HTTPS proxy on 127.0.0.1:443
.
./dnsproxy -l 127.0.0.1 --https-port=443 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0
Runs a DNS-over-HTTPS proxy on 127.0.0.1:443
with HTTP/3 support.
./dnsproxy -l 127.0.0.1 --https-port=443 --http3 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0
Runs a DNS-over-QUIC proxy on 127.0.0.1:853
.
./dnsproxy -l 127.0.0.1 --quic-port=853 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0
Runs a DNSCrypt proxy on 127.0.0.1:443
.
./dnsproxy -l 127.0.0.1 --dnscrypt-config=./dnscrypt-config.yaml --dnscrypt-port=443 --upstream=8.8.8.8:53 -p 0
Please note that in order to run a DNSCrypt proxy, you need to obtain DNSCrypt configuration first. You can use https://github.com/ameshkov/dnscrypt command-line tool to do that with a command like this
./dnscrypt generate --provider-name=2.dnscrypt-cert.example.org --out=dnscrypt-config.yaml
Additional features
Runs a DNS proxy on 0.0.0.0:53
with rate limit set to 10 rps
, enabled DNS cache, and that refuses type=ANY requests.
./dnsproxy -u 8.8.8.8:53 -r 10 --cache --refuse-any
Runs a DNS proxy on 127.0.0.1:5353 with multiple upstreams and enable parallel queries to all configured upstream servers.
./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8:53 -u 1.1.1.1:53 -u tls://dns.adguard.com --upstream-mode parallel
Loads upstreams list from a file.
./dnsproxy -l 127.0.0.1 -p 5353 -u ./upstreams.txt
DNS64 server
dnsproxy
is capable of working as a DNS64 server.
What is DNS64/NAT64 This is a mechanism of providing IPv6 access to IPv4. Using a NAT64 gateway with IPv4-IPv6 translation capability lets IPv6-only clients connect to IPv4-only services via synthetic IPv6 addresses starting with a prefix that routes them to the NAT64 gateway. DNS64 is a DNS service that returns AAAA records with these synthetic IPv6 addresses for IPv4-only destinations (with A but not AAAA records in the DNS). This lets IPv6-only clients use NAT64 gateways without any other configuration.
See also RFC 6147.
Enables DNS64 with the default Well-Known Prefix:
./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8 --use-private-rdns --private-rdns-upstream=127.0.0.1 --dns64
You can also specify any number of custom DNS64 prefixes:
./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8 --use-private-rdns --private-rdns-upstream=127.0.0.1 --dns64 --dns64-prefix=64:ffff:: --dns64-prefix=32:ffff::
Note that only the first specified prefix will be used for synthesis.
PTR queries for addresses within the specified ranges or the Well-Known one could only be answered with locally appropriate data, so dnsproxy will route those to the local upstream servers. Those should be specified and enabled if DNS64 is enabled.
Fastest addr + cache-min-ttl
This option would be useful to the users with problematic network connection.
In this mode, dnsproxy
would detect the fastest IP address among all that were
returned, and it will return only it.
Additionally, for those with problematic network connection, it makes sense to
override cache-min-ttl
. In this case, dnsproxy
will make sure that DNS
responses are cached for at least the specified amount of time.
It makes sense to run it with multiple upstream servers only.
Run a DNS proxy with two upstreams, min-TTL set to 10 minutes, fastest address detection is enabled:
./dnsproxy -u 8.8.8.8 -u 1.1.1.1 --cache --cache-min-ttl=600 --upstream-mode=fastest_addr
who run dnsproxy
with multiple upstreams
Specifying upstreams for domains
You can specify upstreams that will be used for a specific domain(s). We use the
dnsmasq-like syntax, decorating domains with brackets (see --server
[description][server-description]).
Syntax: [/[domain1][/../domainN]/]upstreamString
Where upstreamString
is one or many upstreams separated by space (e.g.
1.1.1.1
or 1.1.1.1 2.2.2.2
).
If one or more domains are specified, that upstream (upstreamString
) is used
only for those domains. Usually, it is used for private nameservers. For
instance, if you have a nameserver on your network which deals with
xxx.internal.local
at 192.168.0.1
then you can specify
[/internal.local/]192.168.0.1
, and dnsproxy will send all queries to that
nameserver. Everything else will be sent to the default upstreams (which are
mandatory!).
- An empty domain specification,
//
has the special meaning of "unqualified names only", which will be used to resolve names with a single label in them, or with exactly two labels in case ofDS
requests. - More specific domains take precedence over less specific domains, so:
--upstream=[/host.com/]1.2.3.4 --upstream=[/www.host.com/]2.3.4.5
will send
编辑推荐精选

酷表ChatExcel
大模型驱动的Excel数据处理工具
基于大模型交互的表格处理系统,允许用户通过对话方式完成数据整理和可视化分析。系统采用机器学习算法解析用户指令,自动执行排序、公式计算和数据透视等操作,支持多种文件格式导入导出。数据处理响应速度保持在0.8秒以内,支持超过100万行数据的即时分析。


DeepEP
DeepSeek开源的专家并行通信优化框架
DeepEP是一个专为大规模分布式计算设计的通信库,重点解决专家并行模式中的通信瓶颈问题。其核心架构采用分层拓扑感知技术,能够自动识别节点间物理连接关系,优化数据传输路径。通过实现动态路由选择与负载均衡机制,系统在千卡级计算集群中维持稳定的低延迟特性,同时兼容主流深度学习框架的通信接口。


DeepSeek
全球领先开源大模型,高效智能助手
DeepSeek是一家幻方量化创办的专注于通用人工智能的中国科技公司,主攻大模型研发与应用。DeepSeek-R1是开源的推理模型,擅长处理复杂任务且可免费商用。


问小白
DeepSeek R1 满血模型上线
问小白是一个基于 DeepSeek R1 模型的智能对话平台,专为用户提供高效、贴心的对话体验。实时在线,支持深度思考和联网搜索。免费不限次数,帮用户写作、创作、分析和规划,各种任务随时完成!


KnowS
AI医学搜索引擎 整合4000万+实时更新的全球医学文献
医学领域专用搜索引擎整合4000万+实时更新的全球医学文献,通过自主研发AI模型实现精准知识检索。系统每日更新指南、中英文文献及会议资料,搜索准确率较传统工具提升80%,同时将大模型幻觉率控制在8%以下。支持临床建议生成、文献深度解析、学术报告制作等全流程科研辅助,典型用户反馈显示每周可节省医疗工作者70%时间。


Windsurf Wave 3
Windsurf Editor推出第三次重大更新Wave 3
新增模型上下文协议支持与智能编辑功能。本次更新包含五项核心改进:支持接入MCP协议扩展工具生态,Tab键智能跳转提升编码效率,Turbo模式实现自动化终端操作,图片拖拽功能优化多模态交互,以及面向付费用户的个性化图标定制。系统同步集成DeepSeek、Gemini等新模型,并通过信用点数机制实现差异化的资源调配。


腾讯元宝
腾讯自研的混元大模型AI助手
腾讯元宝是腾讯基于自研的混元大模型推出的一款多功能AI应用,旨在通过人工智能技术提升用户在写作、绘画、翻译、编程、搜索、阅读总结等多个领域的工作与生活效率。


Grok3
埃隆·马斯克旗下的人工智能公司 xAI 推出的第三代大规模语言模型
Grok3 是由埃隆·马斯克旗下的人工智能公司 xAI 推出的第三代大规模语言模型,常被马斯克称为“地球上最聪明的 AI”。它不仅是在前代产品 Grok 1 和 Grok 2 基础上的一次飞跃,还在多个关键技术上实现了创新突破。


OmniParser
帮助AI理解电脑屏幕 纯视觉GUI元素的自动化解析方案
开源工具通过计算机 视觉技术实现图形界面元素的智能识别与结构化处理,支持自动化测试脚本生成和辅助功能开发。项目采用模块化设计,提供API接口与多种输出格式,适用于跨平台应用场景。核心算法优化了元素定位精度,在动态界面和复杂布局场景下保持稳定解析能力。


流畅阅读
AI网页翻译插件 双语阅读工具,还原母语级体验
流畅阅读是一款浏览器翻译插件,通过上下文智能分析提升翻译准确性,支持中英双语对照显示。集成多翻译引擎接口,允许用户自定义翻译规则和快捷键配置,操作数据全部存储在本地设备保障隐私安全。兼容Chrome、Edge、Firefox等主流浏览器,基于GPL-3.0开源协议开发,提供持续的功能迭代和社区支持。
推荐工具精选
AI云服务特惠
懂AI专属折扣关注微信公众号
最新AI工具、AI资讯
独家AI资源、AI项目落地

微信扫一扫关注公众号