Crate dnscrypt 

dnscrypt — an asynchronous (Tokio-backed) DNSCrypt v2 client library.

Overview

This library implements the DNSCrypt v2 protocol for encrypted, authenticated DNS resolution. X25519, Ed25519, constant-time comparison, and randomness are backed by aws-lc-rs; the certificate’s ES version selects between XChaCha20-Poly1305 and XSalsa20-Poly1305 (neither supported by aws-lc-rs), provided by the pure-Rust chacha20/salsa20/poly1305 crates.

It ships two primary abstractions:

1. Manual API — call resolve or work step-by-step with establish_dnscrypt_session + resolve_domain_via_dnscrypt_session.
2. Reqwest drop-in — plug DnscryptResolver into any reqwest::Client via .dns_resolver(...) to transparently route all hostname lookups through DNSCrypt.

You can also supply your own custom static list of DNSCrypt resolvers, bypassing the built-in defaults.

Cryptography

Primitive	Purpose
X25519 DH	Per-session key agreement with the resolver
HChaCha20 / HSalsa20	Key derivation from the raw DH shared secret
XChaCha20-Poly1305 / XSalsa20-Poly1305	Authenticated encryption of DNS queries/responses
Ed25519	Resolver certificate signature verification

All resolvers are hardcoded with their Ed25519 public keys pinned at compile time, preventing MITM via CA compromise.

Quick Start

use dnscrypt::{resolve, Error, HARDCODED_RESOLVERS};
let ips = resolve(HARDCODED_RESOLVERS, "github.com").await?;
println!("github.com => {:?}", ips);

Reqwest integration

use dnscrypt::DnscryptResolver;
use std::sync::Arc;

// Build a reqwest client that resolves every hostname through DNSCrypt.
let client = reqwest::Client::builder()
    .dns_resolver(Arc::new(DnscryptResolver::new()))
    .build()
    .unwrap();

Re-exports

pub use error::Error;

pub use reqwest_resolver::DnscryptResolver;

pub use resolver::DnscryptClientState;

pub use resolver::HARDCODED_RESOLVERS;

pub use resolver::HardcodedResolver;

pub use resolver::establish_dnscrypt_session;

pub use resolver::resolve;

pub use resolver::resolve_domain_via_dnscrypt_session;

Modules

cert

DNSCrypt v2 certificate parsing and Ed25519 signature verification.

crypto

Raw XSalsa20-Poly1305 / XChaCha20-Poly1305 AEAD and HSalsa20/HChaCha20 key derivation.

error

Unified error type for dnscrypto.

net

Asynchronous UDP/TCP transport for raw DNS packets.

packet

DNS packet building, parsing, and padding utilities.

reqwest_resolver

reqwest drop-in DNS resolver backed by DNSCrypt.

resolver

Core DNSCrypt v2 session management and resolution logic.