Language: English | 中文

This repository is based on AdguardTeam/dnsproxy.

Key differences from upstream:

• Dedicated TLS timeout behavior for DoT connections.
• Configurable PPv2 read timeout (3s default, tunable).
• max-go-routines default adjusted to 32 (tunable).
• TCP Keep-Alive enabled for incoming TCP/DoT sockets.
• Module path isolation for build/distribution (github.com/fcchbjm/dnsproxy).
• Proxy Protocol v2 support for DNS-over-TCP and DNS-over-TLS.
• TCP Fast Open (TFO) on supported DoT listener platforms.
• TLS session resumption paths (server and upstream client side).
• Protocol-level behavior correction for TCP close-phase RST scenarios.
• Robust inbound parsing for DNS-over-TCP and DoT: the 2-byte RFC 1035-style length prefix is always read in full, avoiding intermittent mis-framing when TCP delivers short reads (no configuration change).

Image is published to GHCR by this repository's GitHub Actions:

• ghcr.io/fcchbjm/dnsproxy

docker pull ghcr.io/fcchbjm/dnsproxy:latest

Download the matching binary from GitHub Releases. For automated deployments, this is usually preferred over local build chains.

Build with Go (toolchain/version details are in the upstream section below under "How to build").

In production, DNS is often deployed behind L4/L7 proxies (HAProxy/Nginx/Caddy/cloud LB). Without transport-level client identity propagation, backend services only see the LB source address, which degrades per-client rate limiting, abuse attribution, GeoDNS decisions, and security observability.

This project implements PPv2 on DNS-over-TCP and DNS-over-TLS listeners.

When enabled, strict mode requires PPv2 headers; missing headers are rejected.

• CLI
  • --tcp-proxy-protocol-v2: require PPv2 on DNS-over-TCP listeners.
  • --tls-proxy-protocol-v2: require PPv2 on DoT listeners (parsed before TLS handshake).
  • --proxy-protocol-v2-read-timeout=duration: timeout for reading PPv2 preface and payload on new TCP/DoT connections (default: 3s).
• YAML (config.yaml.dist)
  • tcp-proxy-protocol-v2: true|false
  • tls-proxy-protocol-v2: true|false
  • proxy-protocol-v2-read-timeout: 3s

Recommended baseline with tuning headroom:

• Keep proxy-protocol-v2-read-timeout=3s for most LB -> dnsproxy deployments.
• Reduce to 1s-2s in low-latency trusted networks for faster slow-connection eviction.
• Increase to around 5s only when cross-region/LB jitter causes false timeout drops.
• Keep max-go-routines=32 as the default baseline for PPv2 deployments; tune based on CPU/memory.

PPv2 disabled:

+--------+      +-------------------+      +----------+
| Client | ---> | HAProxy/Nginx/LB  | ---> | dnsproxy |
+--------+      +-------------------+      +----------+

Note: dnsproxy sees remote addr = LB address.

PPv2 enabled:

+--------+      +-------------------+   send-proxy-v2 / PPv2   +----------+      +--------------+
| Client | ---> | HAProxy/Nginx/LB  | -----------------------> | dnsproxy | ---> | Upstream DNS |
+--------+      +-------------------+     (require PPv2)       +----------+      +--------------+

Note: Client -> LB does not carry PPv2.
PPv2 is injected by LB on the LB -> dnsproxy backend connection.

Standalone dnsproxy defaults TrustedProxies to an empty set (trust nobody): DoH forwarding headers and Proxy Protocol v2 from a direct peer are not adopted unless that peer's address is listed.

Configure explicitly for LB / reverse-proxy deployments:

• CLI: --trusted-proxies=10.0.0.0/8 (repeatable); same-host HAProxy → 127.0.0.0/8 (and ::1/128 if needed) — see the minimal fragment below
• YAML: trusted-proxies: ["10.0.0.0/8", ...] (see config.yaml.dist)

Also:

• Restrict network access so only LB/proxy can reach PPv2-enabled listeners.
• Do not accept client-provided PPv2 at the public edge (e.g. accept-proxy at boundary listeners), otherwise source address spoofing becomes possible.
• Embedded hosts that construct proxy.Config themselves should pass a tight TrustedProxies set (often loopback-only behind a local reverse proxy).

frontend ft_dot_853
  bind :853
  default_backend bk_dnsproxy_dot_853

backend bk_dnsproxy_dot_853
  server dnsproxy 127.0.0.1:853 send-proxy-v2

On dnsproxy (same host as HAProxy, backend 127.0.0.1), enable PPv2 and trust the loopback peer — empty TrustedProxies rejects even localhost:

--tls-proxy-protocol-v2 --trusted-proxies=127.0.0.0/8 --max-tcp-connections=512

Add --trusted-proxies=::1/128 if the backend dials over IPv6 loopback. For a remote LB, list that LB's CIDRs instead of loopback. Use --tcp-proxy-protocol-v2 when plain TCP listeners also require PPv2. --max-tcp-connections=512 matches the dist comment example; public deployments should set an explicit cap (0 = unlimited).

YAML equivalent:

tls-proxy-protocol-v2: true
trusted-proxies:
  - "127.0.0.0/8"
  # - "::1/128"   # if HAProxy connects via IPv6 loopback
# Public / DoT behind LB: set an explicit Accept cap (0 = unlimited).
max-tcp-connections: 512

DoQ/UDP identity propagation cannot be treated as a direct TCP/DoT extension because of different semantics (datagram model, address validation, connection migration, and proxy injection trade-offs).

Current implementation scope is TCP/DoT PPv2. DoQ/UDP is in evaluation scope and will be driven by real deployment topologies plus executable acceptance criteria. Discussion: Proxy Protocol v2 support (Discussion #1)

If you are running this behind a load balancer in production, feedback on real deployment patterns is valuable.

Particularly interested in:

• HAProxy / Nginx / Caddy / Envoy based setups
• Traffic scale (QPS range)
• Scenarios requiring real client identity (rate limiting, abuse control, GeoDNS)

-> Discussions: https://github.com/fcchbjm/dnsproxy/discussions -> Issues: https://github.com/fcchbjm/dnsproxy/issues

In complex LB + encrypted DNS deployments, this project applies a dedicated connection lifecycle state machine to avoid request loss caused by abnormal RST behavior at close phase under high concurrency.

• Scope: DoT inbound connections (--tls-port / ProtoTLS).
• Config: --tls-timeout / YAML tls-timeout.
• Defaults (dual-layer, same pattern as TrustedProxies):
  • Library / embedders: proxy.Config.TLSTimeout zero → 600s (DefaultTLSTimeout).
  • Standalone dnsproxy: explicit default 60s (config.yaml.dist / cmd seed). This is an intentional break from the historical 600s binary default.
• Behavior:
  • DoT idle window uses read deadline (not full deadline).
  • TLS handshake has explicit deadline to avoid indefinite connection occupancy.
• Tuning: shorten further on public DoT under overload risk; raise only when idle keep-alive longer than 60s is required.

• Scope: DNS-over-TCP and DoT inbound connections.
• Default: defaultTCPKeepAlive = 30s (compile-time default).
• Goal: reduce connection churn and repeated handshake cost.

• Scope: DoT listener socket path only.
• Platform:
  • Unix (except OpenBSD): attempts TCP_FASTOPEN (queue length 256).
  • Windows: no-op.
• Unsupported kernel/platform is non-fatal (logged and continued).

• Server side (DoT/HTTPS): session ticket key initialized for resumption.
• Upstream client side (DoH/DoQ/DoT): ClientSessionCache enabled to reduce repeated handshakes.

Standalone DoT/DoH listeners default to TLS 1.2 when tls-min-version / --tls-min-version is unset. Lower explicitly (e.g. 1.0) only if required for legacy clients.

Standalone defaults --tls-timeout / tls-timeout to 60s. Embedders that leave proxy.Config.TLSTimeout unset keep 600s. See TLS timeout behavior (DoT).

--max-tcp-connections / max-tcp-connections caps concurrently accepted plain TCP and DoT connections right after Accept (before request handling). Default 0 = unlimited (library and standalone). Orthogonal to --max-go-routines (in-flight DNS work). Public deployments should set an explicit value (e.g. 512); see config.yaml.dist.

--doh-max-concurrent / doh-max-concurrent caps in-flight DoH work in Proxy.ServeHTTP (HTTP/1.1, HTTP/2, and HTTP/3 share the limit). Default 0 = unlimited. At capacity the handler returns HTTP 429 with Retry-After: 1. Orthogonal to --max-go-routines and --max-tcp-connections. Public deployments should set an explicit value (e.g. 256); see config.yaml.dist. Embedders that only register ServeHTTP on their own http.Server get the same limit when HTTPConfig.MaxConcurrentRequests is set.

--ratelimit / YAML ratelimit applies only to UDP (ProtoUDP). DoH, DoT, and plain TCP DNS are not constrained by the same switch.

Standalone default ratelimit-subnet-len-ipv6 is 64 (aligned with config.yaml.dist); upgrades that relied on the previous implicit 56 without setting the knob get finer IPv6 rate-limit aggregation—set YAML/CLI explicitly to keep the old behavior.

Allows unencrypted HTTP DoH (plain HTTP to the DoH listener). It does not skip TLS certificate verification; use --insecure for that. --insecure also applies to private-rdns upstreams (aligned with primary/fallback).

Network-dependent tests are enabled by default. Disable in constrained/offline environments with:

• DNSPROXY_ENABLE_NETWORK_TESTS=0

For restricted networks, test endpoints can be overridden via DNSPROXY_TEST_* in:

• upstream/resolver_test.go
• upstream/upstream_internal_test.go

Below is the upstream README content.

A simple DNS proxy server that supports all existing DNS protocols including DNS-over-TLS, DNS-over-HTTPS, DNSCrypt, and DNS-over-QUIC. Moreover, it can work as a DNS-over-HTTPS, DNS-over-TLS or DNS-over-QUIC server.

• How to install
• How to build
• Usage
• Examples
  • Simple options
  • Encrypted upstreams
  • Encrypted DNS server
  • Additional features
  • DNS64 server
  • Fastest addr + cache-min-ttl
  • Specifying upstreams for domains
  • Specifying private rDNS upstreams
  • EDNS Client Subnet
  • Bogus NXDomain
  • Basic Auth for DoH

There are several options how to install dnsproxy.

1. Grab the binary for your device/OS from the Releases page.
2. Use the official Docker image.
3. Build it yourself (see the instruction below).

You will need Go 1.26 or later.

make build

Usage of ./dnsproxy:
  --bogus-nxdomain=subnet
        Transform the responses containing at least a single IP that matches specified addresses and CIDRs into NXDOMAIN.  Can be specified multiple times.
  --bootstrap/-b
        Bootstrap DNS for DoH and DoT, can be specified multiple times (default: use system-provided).
  --cache
        If specified, DNS cache is enabled.
  --cache-max-ttl=uint32
        Maximum TTL value for DNS entries, in seconds.
  --cache-min-ttl=uint32
        Minimum TTL value for DNS entries, in seconds. Capped at 3600. Artificially extending TTLs should only be done with careful consideration.
  --cache-optimistic
        If specified, optimistic DNS cache is enabled.
  --cache-size=int
        Cache size (in bytes). Default: 64k.
  --config-path=path
        YAML configuration file. Minimal working configuration in config.yaml.dist. Options passed through command line will override the ones from this file.
  --dnssec
        Defines whether the proxy should set the DO bits in the upstream requests.  Default: true.
  --doh-insecure-enabled
        Allow unencrypted HTTP DoH (plain HTTP to the DoH listener). Does not skip TLS certificate verification; use --insecure for that.
  --doh-routes
        Routes for DNS-over-HTTPS.  If not specified, the default routes are registered:
        - "GET /", deprecated and will soon be removed,
        - "POST /", deprecated and will soon be removed.
        - "GET /dns-query",
        - "POST /dns-query".
  --dns64
        If specified, dnsproxy will act as a DNS64 server.
  --dns64-prefix=subnet
        Prefix used to handle DNS64. If not specified, dnsproxy uses the 'Well-Known Prefix' 64:ff9b::.  Can be specified multiple times.
  --dnscrypt-config=path/-g path
        Path to a file with DNSCrypt configuration. You can generate one using https://github.com/AdguardTeam/dnscrypt.
  --dnscrypt-port=port/-y port
        Listening ports for DNSCrypt.
  --edns
        Use EDNS Client Subnet extension.
  --edns-addr=address
        Send EDNS Client Address.
  --fallback/-f
        Fallback resolvers to use when regular ones are unavailable, can be specified multiple times. You can also specify path to a file with the list of servers.
  --help/-h
        Print this help message and quit.
  --hosts-file-enabled
        If specified, use hosts files for resolving.
  --hosts-files=path
        List of paths to the hosts files, can be specified multiple times.
  --http3
        Enable HTTP/3 support.
  --https-port=port/-s port
        Listening ports for DNS-over-HTTPS.
  --https-server-name=name
        Set the Server header for the responses from the HTTPS server.
  --https-userinfo=name
        If set, all DoH queries are required to have this basic authentication information.
  --insecure
        Disable secure TLS certificate validation.
  --ipv6-disabled
        If specified, all AAAA requests will be replied with NoError RCode and empty answer.
  --listen=address/-l address
        Listening addresses.
  --max-go-routines=uint
        Set the maximum number of go routines. A zero value will not not set a maximum.
  --optimistic-answer-ttl
        Default TTL value for expired DNS entries in optimistic cache.  Default: 30s
  --optimistic-max-age
        Period of time after which entries are removed from optimistic cache in human-readable form. Default: 12h.
  --output=path/-o path
        Path to the log file.
  --pending-requests-enabled
        If specified, the server will track duplicate queries and only send the first of them to the upstream server, propagating its result to others. Disabling it introduces a vulnerability to cache poisoning attacks.
  --port=port/-p port
        Listening ports. Zero value disables TCP and UDP listeners.
  --pprof
        If present, exposes pprof information on localhost:6060.
  --private-rdns-upstream
        Private DNS upstreams to use for reverse DNS lookups of private addresses, can be specified multiple times.
  --private-subnets=subnet
        Private subnets to use for reverse DNS lookups of private addresses.
  --quic-port=port/-q port
        Listening ports for DNS-over-QUIC.
  --ratelimit=int/-r int
        Ratelimit (requests per second). Applies to UDP (ProtoUDP) only; DoH, DoT, and plain TCP DNS are not limited by this switch.
  --ratelimit-subnet-len-ipv4=int
        Ratelimit subnet length for IPv4.
  --ratelimit-subnet-len-ipv6=int
        Ratelimit subnet length for IPv6.
  --refuse-any
        If specified, refuses ANY requests.
  --timeout=duration
        Timeout for outbound DNS queries to remote upstream servers in a human-readable form
  --tls-crt=path/-c path
        Path to a file with the certificate chain.
  --tls-key=path/-k path
        Path to a file with the private key.
  --tls-max-version=version
        Maximum TLS version, for example 1.3.
  --tls-min-version=version
        Minimum TLS version, for example 1.0.
  --tls-port=port/-t port
        Listening ports for DNS-over-TLS.
  --udp-buf-size=int
        Set the size of the UDP buffer in bytes. A value <= 0 will use the system default.
  --upstream/-u
        An upstream to be used (can be specified multiple times). You can also specify path to a file with the list of servers.
  --upstream-mode=mode
        Defines the upstreams logic mode, possible values: load_balance, parallel, fastest_addr (default: load_balance).
  --use-private-rdns
        If specified, use private upstreams for reverse DNS lookups of private addresses.
  --verbose/-v
        Verbose output.
  --version
        Prints the program version.

Runs a DNS proxy on 0.0.0.0:53 with a single upstream - Google DNS.

./dnsproxy -u 8.8.8.8:53

The same proxy with verbose logging enabled writing it to the file log.txt.

./dnsproxy -u 8.8.8.8:53 -v -o log.txt

Runs a DNS proxy on 127.0.0.1:5353 with multiple upstreams.

./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8:53 -u 1.1.1.1:53

Listen on multiple interfaces and ports:

./dnsproxy -l 127.0.0.1 -l 192.168.1.10 -p 5353 -p 5354 -u 1.1.1.1

The plain DNS upstream server may be specified in several ways:

• With a plain IP address:

  ./dnsproxy -l 127.0.0.1 -u 8.8.8.8:53

• With a hostname or plain IP address and the udp:// scheme:

  ./dnsproxy -l 127.0.0.1 -u udp://dns.google -u udp://1.1.1.1

• With a hostname or plain IP address and the tcp:// scheme to force using TCP:

  ./dnsproxy -l 127.0.0.1 -u tcp://dns.google -u tcp://1.1.1.1

DNS-over-TLS upstream:

./dnsproxy -u tls://dns.adguard.com

DNS-over-HTTPS upstream with specified bootstrap DNS:

./dnsproxy -u https://dns.adguard.com/dns-query -b 1.1.1.1:53

DNS-over-QUIC upstream:

./dnsproxy -u quic://dns.adguard.com

DNS-over-HTTPS upstream with enabled HTTP/3 support (chooses it if it's faster):

./dnsproxy -u https://dns.google/dns-query --http3

DNS-over-HTTPS upstream with forced HTTP/3 (no fallback to other protocol):

./dnsproxy -u h3://dns.google/dns-query

DNSCrypt upstream (DNS Stamp of AdGuard DNS):

./dnsproxy -u sdns://AQMAAAAAAAAAETk0LjE0MC4xNC4xNDo1NDQzINErR_JS3PLCu_iZEIbq95zkSV2LFsigxDIuUso_OQhzIjIuZG5zY3J5cHQuZGVmYXVsdC5uczEuYWRndWFyZC5jb20

DNS-over-HTTPS upstream (DNS Stamp of Cloudflare DNS):

./dnsproxy -u sdns://AgcAAAAAAAAABzEuMC4wLjGgENk8mGSlIfMGXMOlIlCcKvq7AVgcrZxtjon911-ep0cg63Ul-I8NlFj4GplQGb_TTLiczclX57DvMV8Q-JdjgRgSZG5zLmNsb3VkZmxhcmUuY29tCi9kbnMtcXVlcnk

DNS-over-TLS upstream with two fallback servers (to be used when the main upstream is not available):

./dnsproxy -u tls://dns.adguard.com -f 8.8.8.8:53 -f 1.1.1.1:53

Runs a DNS-over-TLS proxy on 127.0.0.1:853.

./dnsproxy -l 127.0.0.1 --tls-port=853 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0

Runs a DNS-over-HTTPS proxy on 127.0.0.1:443.

./dnsproxy -l 127.0.0.1 --https-port=443 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0

Runs a DNS-over-HTTPS proxy on 127.0.0.1:443 with HTTP/3 support.

./dnsproxy -l 127.0.0.1 --https-port=443 --http3 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0

Runs a DNS-over-QUIC proxy on 127.0.0.1:853.

./dnsproxy -l 127.0.0.1 --quic-port=853 --tls-crt=example.crt --tls-key=example.key -u 8.8.8.8:53 -p 0

Runs a DNSCrypt proxy on 127.0.0.1:443.

./dnsproxy -l 127.0.0.1 --dnscrypt-config=./dnscrypt-config.yaml --dnscrypt-port=443 --upstream=8.8.8.8:53 -p 0

Runs a DNS proxy on 0.0.0.0:53 with rate limit set to 10 rps, enabled DNS cache, and that refuses type=ANY requests.

./dnsproxy -u 8.8.8.8:53 -r 10 --cache --refuse-any

Runs a DNS proxy on 127.0.0.1:5353 with multiple upstreams and enable parallel queries to all configured upstream servers.

./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8:53 -u 1.1.1.1:53 -u tls://dns.adguard.com --upstream-mode parallel

Loads upstreams list from a file.

./dnsproxy -l 127.0.0.1 -p 5353 -u ./upstreams.txt

dnsproxy is capable of working as a DNS64 server.

[!NOTE] What is DNS64/NAT64 This is a mechanism of providing IPv6 access to IPv4. Using a NAT64 gateway with IPv4-IPv6 translation capability lets IPv6-only clients connect to IPv4-only services via synthetic IPv6 addresses starting with a prefix that routes them to the NAT64 gateway. DNS64 is a DNS service that returns AAAA records with these synthetic IPv6 addresses for IPv4-only destinations (with A but not AAAA records in the DNS). This lets IPv6-only clients use NAT64 gateways without any other configuration. See also RFC 6147.

Enables DNS64 with the default Well-Known Prefix:

./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8 --use-private-rdns --private-rdns-upstream=127.0.0.1 --dns64

You can also specify any number of custom DNS64 prefixes:

./dnsproxy -l 127.0.0.1 -p 5353 -u 8.8.8.8 --use-private-rdns --private-rdns-upstream=127.0.0.1 --dns64 --dns64-prefix=64:ffff:: --dns64-prefix=32:ffff::

Note that only the first specified prefix will be used for synthesis.

PTR queries for addresses within the specified ranges or the Well-Known one could only be answered with locally appropriate data, so dnsproxy will route those to the local upstream servers. Those should be specified and enabled if DNS64 is enabled.

This option would be useful to the users with problematic network connection. In this mode, dnsproxy would detect the fastest IP address among all that were returned, and it will return only it.

Additionally, for those with problematic network connection, it makes sense to override cache-min-ttl. In this case, dnsproxy will make sure that DNS responses are cached for at least the specified amount of time.

It makes sense to run it with multiple upstream servers only.

Run a DNS proxy with two upstreams, min-TTL set to 10 minutes, fastest address detection is enabled:

./dnsproxy -u 8.8.8.8 -u 1.1.1.1 --cache --cache-min-ttl=600 --upstream-mode=fastest_addr

who run dnsproxy with multiple upstreams

You can specify upstreams that will be used for a specific domain(s). We use the dnsmasq-like syntax, decorating domains with brackets (see --server description).

Syntax: [/[domain1][/../domainN]/]upstreamString

Where upstreamString is one or many upstreams separated by space (e.g. 1.1.1.1 or 1.1.1.1 2.2.2.2).

If one or more domains are specified, that upstream (upstreamString) is used only for those domains. Usually, it is used for private nameservers. For instance, if you have a nameserver on your network which deals with xxx.internal.local at 192.168.0.1 then you can specify [/internal.local/]192.168.0.1, and dnsproxy will send all queries to that nameserver. Everything else will be sent to the default upstreams (which are mandatory!).

1. An empty domain specification, // has the special meaning of "unqualified names only", which will be used to resolve names with a single label in them, or with exactly two labels in case of DS requests.
2. More specific domains take precedence over less specific domains, so: --upstream=[/host.com/]1.2.3.4 --upstream=[/www.host.com/]2.3.4.5 will send queries for *.host.com to 1.2.3.4, except *.www.host.com, which will go to 2.3.4.5.
3. The special server address # means, "use the common servers", so: --upstream=[/host.com/]1.2.3.4 --upstream=[/www.host.com/]# will send queries for *.host.com to 1.2.3.4, except *.www.host.com which will be forwarded as usual.
4. The wildcard * has special meaning of "any sub-domain", so: --upstream=[/*.host.com/]1.2.3.4 will send queries for *.host.com to 1.2.3.4, but host.com will be forwarded to default upstreams.

Sends requests for *.local domains to 192.168.0.1:53. Other requests are sent to 8.8.8.8:53:

./dnsproxy \
    -u "8.8.8.8:53" \
    -u "[/local/]192.168.0.1:53" \
    ;

Sends requests for *.host.com to 1.1.1.1:53 except for *.maps.host.com which are sent to 8.8.8.8:53 (along with other requests):

./dnsproxy \
    -u "8.8.8.8:53" \
    -u "[/host.com/]1.1.1.1:53" \
    -u "[/maps.host.com/]#" \
    ;

Sends requests for *.host.com to 1.1.1.1:53 except for host.com which is sent to 9.9.9.10:53, and all other requests are sent to 8.8.8.8:53:

./dnsproxy \
    -u "8.8.8.8:53" \
    -u "[/host.com/]9.9.9.10:53" \
    -u "[/*.host.com/]1.1.1.1:53" \
    ;

Sends requests for com (and its subdomains) to 1.2.3.4:53, requests for other top-level domains to 1.1.1.1:53, and all other requests to 8.8.8.8:53:

./dnsproxy \
    -u "8.8.8.8:53" \
    -u "[//]1.1.1.1:53" \
    -u "[/com/]1.2.3.4:53" \
    ;

You can specify upstreams that will be used for reverse DNS requests of type PTR for private addresses. Same applies to the authority requests of types SOA and NS. The set of private addresses is defined by the --private-rdns-upstream, and the set from RFC 6303 is used by default.

The additional requirement to the domains specified for upstreams is to be in-addr.arpa, ip6.arpa, or its subdomain. Addresses encoded in the domains should also be private.

Sends queries for *.168.192.in-addr.arpa to 192.168.1.2, if requested by client from 192.168.0.0/16 subnet. Other queries answered with NXDOMAIN:

./dnsproxy \
    -l "0.0.0.0" \
    -u "8.8.8.8" \
    --use-private-rdns \
    --private-subnets="192.168.0.0/16" \
    --private-rdns-upstream="192.168.1.2" \
    ;

Sends queries for *.in-addr.arpa to 192.168.1.2, *.ip6.arpa to fe80::1, if requested by client within the default RFC 6303 subnet set. Other queries answered with NXDOMAIN:

./dnsproxy\
    -l "0.0.0.0"\
    -u 8.8.8.8\
    --use-private-rdns\
    --private-rdns-upstream="192.168.1.2"\
    --private-rdns-upstream="[/ip6.arpa/]fe80::1"

To enable support for EDNS Client Subnet extension you should run dnsproxy with --edns flag:

./dnsproxy -u 8.8.8.8:53 --edns

Now if you connect to the proxy from the Internet - it will pass through your original IP address's prefix to the upstream server. This way the upstream server may respond with IP addresses of the servers that are located near you to minimize latency.

If you want to use EDNS CS feature when you're connecting to the proxy from a local network, you need to set --edns-addr=PUBLIC_IP argument:

./dnsproxy -u 8.8.8.8:53 --edns --edns-addr=72.72.72.72

Now even if your IP address is 192.168.0.1 and it's not a public IP, the proxy will pass through 72.72.72.72 to the upstream server.

This option is similar to dnsmasq bogus-nxdomain. dnsproxy will transform responses that contain at least a single IP address which is also specified by the option into NXDOMAIN. Can be specified multiple times.

In the example below, we use AdGuard DNS server that returns 0.0.0.0 for blocked domains, and transform them to NXDOMAIN.

./dnsproxy -u 94.140.14.14:53 --bogus-nxdomain=0.0.0.0

CIDR ranges are supported as well. The following will respond with NXDOMAIN instead of responses containing any IP from 192.168.0.0-192.168.255.255:

./dnsproxy -u 192.168.0.15:53 --bogus-nxdomain=192.168.0.0/16

By setting the --https-userinfo option you can use dnsproxy as a DoH proxy with basic authentication requirements.

For example:

./dnsproxy \
    --https-port='443' \
    --https-userinfo='user:p4ssw0rd' \
    --tls-crt='…/my.crt' \
    --tls-key='…/my.key' \
    -u '94.140.14.14:53' \
    ;

This configuration will only allow DoH queries that contain an Authorization header containing the BasicAuth credentials for user user with password p4ssw0rd.

Add -p 0 if you also want to disable plain-DNS handling and make dnsproxy only serve DoH with Basic Auth checking.