Package: encrypted-dns
Encrypted-DNSIntroductionIssues|Pull requests|ContributorsEncrypted-DNS operates as a DNS server that forward DNS queries over UDP, TCP, TLS or HTTPS, thus preventing your device from DNS cache poisoning and censorship.
It could also cache DNS records to accelerate further queries, block specific client, and ignore particular domain names.FeaturesEncrypted DNS upstream servers (DNS-over-HTTPS, DNS-over-TLS)Improve accuracy with EDNS-Client-SubnetAuthenticate DNS response with DNSSECTransparent redirection of specific domains to specific resolversSend queries through HTTP proxiesCache DNS response with default or customized TTL to reduce latencyForce Safe search on search engines (Google, DuckDuckGo, Bing, etc.)Firewall rules: Rate limiting, client blacklist, and disable AAAA or ANY lookups.InstallationInstallPython3.6+Installencrypted-dnspackage viapip$ python3 -m pip install encrypted-dnsGenerate and edit config file$ sudo encrypted-dns
$ vim ~/.config/encrypted_dns/config.jsonRun Encrypted-DNS Server$ sudo encrypted-dnsTest DNS LookupLinux or MacOS:
$ dig @127.0.0.1 www.google.com

Windows:
$ nslookup www.google.com 127.0.0.1Change DNS Address to127.0.0.1ConfigurationEncrypted-DNS will generate a JSON file~/.config/encrypted_dns/config.jsonInboundsEncrypted-DNS will listen on the address and ports to receive DNS lookups.The format of each inbound isprotocol://address:port.Currently, Encrypted-DNS only supports inbounds withudpandtcpprotocols.Ifprotocolis not provided, Encrypted-DNS will listen to this inbound address through theudpprotocol.Ifportis not provided, Encrypted-DNS will use the default port of each protocol. (53forudpandtcp)'inbounds': [
                '0.0.0.0',
                '0.0.0.0:5301',
                'tcp://0.0.0.0:5302'
            ]OutboundsEncrypted-DNS will forward the DNS quires to the upstream DNS servers.TheOutboundsis a JSON array of DNS groups.Here is an example of a DNS group:'outbounds': [
    {
        'tag': 'unencrypted',
        'dns': ['1.0.0.1', 'tcp://8.8.4.4'],
        'concurrent': False,
        'domains': ['time.windows.com', sub:youtube.com', 'include:netflix.com']
    },
    {
        'tag': 'encrypted',
        'dns': ['https://cloudflare-dns.com', 'tls://dns.google'],
        'proxies': {
            'http': 'http://127.0.0.1:1088',
            'https': 'http://127.0.0.1:1088'
        },
        'concurrent': False,
        'domains': ['all']
    }
]tagis the name of the DNS groupdnsis an array of DNS upstreamsThe format of each upstream isprotocol://address:portEncrypted-DNS supports these protocols:udp,tcp,tls,httpsIfprotocolis not provided, Encrypted-DNS will connect to the upstream throughudpprotocol.Ifportis not provided, Encrypted-DNS will use the default port of each protocol. (53forudpandtcp,853fortls,443forhttps)concurrentIfconcurrentisTrue, Encrypted-DNS will forward queries to all servers in this group concurrently and send the first response to the clientIfconcurrentisFalse, Encrypted-DNS will forward queries to a random server in this group.Encrypted-DNS will only forward queries to this group only if the domain is included in thedomains. For example:www.google.com: exact domainsub:youtube.com: subdomains ofyoutube.com, such asm.youtube.com,www.youtube.cominclude:netflix.com: domains includenetflix.com, such aswww.netflix.com,netflix.com.example.com,whatisnetflix.commandall: all domainsBootstrap DNS GroupEncrypted-DNS will send DNS queries to the server in thebootstrapDNS group to retrieve the IP addresses of DNS-over-HTTPS or DNS-over-TLS server.If the group is not specified, Encrypted-DNS will use1.0.0.1to resolve the IP addresses.'outbounds': [
    {
        'tag': 'bootstrap',
        'dns': ['1.0.0.1', '8.8.4.4']
    },
    ...
]DNS CacheCache DNS responses to reduce latency for further queries.Ifoverride_ttlis-1, Encrypted-DNS will use default TTL for each record.'dns_cache': {
    'enable': True,
    'override_ttl': 3600
}Firewallrefuse_ANYwill ignore all queries withANYtype since it's often used in DNS reflection attacks.AAAA_disabledwill ignore all quires withAAAAtype.rate_limitwill limit the amount of quires Encrypted-DNS could process every minute.client_blacklistwill ignore all quires sent by specific clients.'firewall': {
    'refuse_ANY': True,
    'AAAA_disabled': False,
    'rate_limit': 30,
    'client_blacklist': [
        '128.97.0.0',
    `   '128.97.0.1'
    ]
}Rulesforce_safe_searchwill enable Safe search on search engines: Google, Bing, Yahoo, DuckDuckGo, and Youtube.hostswill specify A record or CNAME record for domain names.Rules to match domain inhosts:www.google.com: exact domainsub:youtube.com: subdomains ofyoutube.com, such asm.youtube.com,www.youtube.cominclude:netflix.com: domains includenetflix.com, such aswww.netflix.com,netflix.com.example.com,whatisnetflix.commandall: all domains'rules': {
    'force_safe_search': False,
    'hosts': {
        'localhost': '127.0.0.1',
        'sub:cloudflare-dns.com': '1.0.0.1',
        'dns.google': '8.8.4.4'
    }
},EDNS Client SubnetEDNS Client Subnet is a DNS extension that allows Encrypted-DNS to specify the network subnet for the host on which behalf it is making a DNS query.This is generally intended to help speed up the delivery of data from CDN, by allowing better use of DNS-based load balancing to select a service address serving the content expected to be hosted at that domain name, when the client computer is in a different network location from the recursive resolver.To disable this feature, setecs_ip_addresstonull.'ecs_ip_address': '128.97.0.0'