####################################################
# #
# Encrypted DNS Server configuration #
# #
####################################################
##################################
# Global settings #
##################################
## IP addresses and ports to listen to, as well as their external IP
## If there is no NAT involved, `local` and `external` can be the same.
## As many addresses as needed can be configured here, IPv4 and/or IPv6.
= [
{ = "0.0.0.0:443", = "198.51.100.1:443" },
{ = "[::]:443", = "[2001:db8::1]:443" }
]
## Upstream DNS server and port
= "9.9.9.9:53"
## File name to save the state to
= "encrypted-dns.state"
## UDP timeout in seconds
= 10
## TCP timeout in seconds
= 10
## Maximum active UDP sockets
= 1000
## Maximum active TCP connections
= 100
## IP address to connect to upstream servers from.
## You probably do not want to change this. `0.0.0.0` should be fine.
= "0.0.0.0"
## Built-in DNS cache capacity
= 50000
## DNS cache: minimum TTL
= 600
## DNS cache: max TTL
= 86400
## DNS cache: error TTL
= 600
## Run as a background process
= false
## Log file
# log_file = "/tmp/encrypted-dns.log"
## PID file
# pid_file = "/tmp/encrypted-dns.pid"
## User name to drop privileges to, when started as root.
# user = "nobody"
## Group name to drop privileges to, when started as root.
# group = "nobody"
## Path to chroot() to, when started as root.
## The path to the state file is relative to the chroot base.
# chroot = "/var/empty"
####################################
# DNSCrypt settings #
####################################
[]
## Provider name (with or without the `2.dnscrypt-cert.` prefix)
= "secure.dns.test"
## Does the server support DNSSEC?
= true
## Does the server always returns correct answers (no filtering, including ad blocking)?
= true
## Set to `true` if the server doesn't keep any information that can be used to identify users
= true
## Key cache capacity, per certificate
= 10000
###############################
# TLS settings #
###############################
[]
## Where to prooxy TLS connections to (e.g. DoH server)
# upstream_addr = "127.0.0.1:4343"