DNSCrypt client proxy The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled upstream resolver. The traffic between the client and the upstream resolver is encrypted and authenticated, mitigating the risk of MITM attacks, DNS poisoning attacks, and third-party snooping (assuming the upstream is trustworthy). Basic configuration To enable the client proxy, set services.dnscrypt-proxy.enable = true; Enabling the client proxy does not alter the system nameserver; to relay local queries, prepend 127.0.0.1 to . As a forwarder for another DNS client To run the DNSCrypt proxy client as a forwarder for another DNS client, change the default proxy listening port to a non-standard value and point the other client to it: services.dnscrypt-proxy.localPort = 43; dnsmasq { services.dnsmasq.enable = true; services.dnsmasq.servers = [ "127.0.0.1#43" ]; } unbound { services.unbound.enable = true; services.unbound.forwardAddresses = [ "127.0.0.1@43" ]; }