Crate dnscrypt 

dnscrypt — a pure-Rust, synchronous DNSCrypt v2 client library.

Overview

This library implements the DNSCrypt v2 protocol for encrypted, authenticated DNS resolution using only pure-Rust cryptographic primitives. No C bindings, no aws-lc-rs, no openssl, no async runtime.

It ships two primary abstractions:

1. Manual API — call resolve or work step-by-step with establish_dnscrypt_session + resolve_domain_via_dnscrypt_session.
2. Reqwest drop-in — plug DnscryptResolver into any reqwest::Client via .dns_resolver(...) to transparently route all hostname lookups through DNSCrypt.

You can also supply your own custom static list of DNSCrypt resolvers, bypassing the built-in defaults.

Cryptography

Primitive	Purpose
X25519 DH	Per-session key agreement with the resolver
HChaCha20	Key derivation from the raw DH shared secret
XChaCha20-Poly1305	Authenticated encryption of DNS queries/responses
Ed25519	Resolver certificate signature verification

All resolvers are hardcoded with their Ed25519 public keys pinned at compile time, preventing MITM via CA compromise.

Quick Start

Synchronous (Blocking) API:

use dnscrypt::{resolve, Error, HARDCODED_RESOLVERS};
fn main() -> Result<(), Error> {
    let ips = resolve(HARDCODED_RESOLVERS, "github.com")?;
    println!("github.com => {:?}", ips);
    Ok(())
}

Asynchronous API:

use dnscrypt::{resolve_async, Error, HARDCODED_RESOLVERS};
let ips = resolve_async(HARDCODED_RESOLVERS, "github.com").await?;
println!("github.com => {:?}", ips);

Reqwest integration

use dnscrypt::DnscryptResolver;
use std::sync::Arc;

// Build a reqwest client that resolves every hostname through DNSCrypt.
// The resolver is synchronous internally; reqwest calls it from a thread pool.
let client = reqwest::Client::builder()
    .dns_resolver(Arc::new(DnscryptResolver::new()))
    .build()
    .unwrap();

Re-exports

pub use error::Error;

pub use reqwest_resolver::DnscryptResolver;reqwest

pub use resolver::DnscryptClientState;

pub use resolver::HARDCODED_RESOLVERS;

pub use resolver::HardcodedResolver;

pub use resolver::establish_dnscrypt_session;

pub use resolver::resolve_domain_via_dnscrypt_session;

pub use resolver::establish_dnscrypt_session_async;tokio

pub use resolver::resolve_async;tokio

pub use resolver::resolve_domain_via_dnscrypt_session_async;tokio

Modules

cert

DNSCrypt v2 certificate parsing and Ed25519 signature verification.

crypto

Raw XChaCha20-Poly1305 AEAD and HChaCha20 key derivation.

error

Unified error type for dnscrypto.

net

Synchronous and asynchronous UDP/TCP transport for raw DNS packets.

packet

DNS packet building, parsing, and padding utilities.

reqwest_resolverreqwest

reqwest drop-in DNS resolver backed by DNSCrypt.

resolver

Core DNSCrypt v2 session management and resolution logic.

Functions

resolve

Resolve a domain name to an IpAddr using DNSCrypt.