Why your DNS traffic is a privacy leak and how to fix it once and for all

Are you concerned about your privacy? Do you worry about your ISP collecting your data? DNS queries are one way that snoopers can profile you, and encrypted DNS is the answer. However, they're not all made equal, but I have a solution that can truly protect your anonymity.

The problem and solution

Your DNS queries leak every web request you make

DNS ( Domain Name System ) is a means to map domain names (like example.com) to IP addresses. When you make a web request, your system sends a DNS packet out onto the internet to a DNS server (called a recursive resolver). That system then makes a series of subsequent requests to resolve your query. The entire process occurs over a clear text protocol, which means any snooper on the network (like your ISP) can build a detailed profile of your browsing habits. I covered this extensively in another article I wrote . I recommend you read that first.

So what can we do about it? The conclusion reached previously was to encrypt the DNS queries. While not a perfect solution, it offers the best protection we have and certainly makes profiling much more difficult.

DNSCrypt Proxy is one such option. It's a software program (service) that runs on any computer, like your desktop or laptop. You then update your operating system's DNS configuration to route queries through it—more on that later.

Install DNSCrypt Proxy

A local service that accepts and encrypts DNS queries

This is the software program you run on your computer that accepts and encrypts DNS queries. In the configuration file, we tell it where to send them.

The rest of the guide will focus on Linux, but you can refer to the official guides for Linux , Windows , macOS , or several other platforms . The following configuration section is universal for all of them, and so are the explanations—so, following along is useful regardless of what you use.

Any of these mentioned methods will help you install and set up the service.

Configure DNSCrypt Proxy

A universal configuration format across all platforms

The configuration is the hard part, and I'll share with you my experience on what works.

To locate the configuration file for your platform, refer to the official guides, but on Linux, the location is:/etc/dnscrypt-proxy/dnscrypt-proxy.toml.

We shall edit the configuration file ( TOML ) to make DNS queries go through a relay.

First, set the listen addressso the service listens on your local computer using the typical DNS port (53):

This allows programs to easily find and use the DNSCrypt Proxy. "127.0.0.1" and "[::1]" are the local computer (aka localhost) for IPv4 and IPv6 , respectively.

Next are the server names. DNSCrypt Proxy downloads resolver lists, which include remote configurations called stamps . We provide the names of these stamps like this:

A stamp is an encoded, public configuration string—it contains a public address and encryption information. For example, this is one of Quad9's stamps for the server named "quad9-dnscrypt-ip4-filter-ecs-pri":

sdns://AQMAAAAAAAAADTkuOS45LjExOjg0NDMgZ8hHuMh1jNEgJFVDvnVnRt803x2EwAuMRwNo34Idhj4ZMi5kbnNjcnlwdC1jZXJ0LnF1YWQ5Lm5ldA

Here's what it looks like decoded:

This just shows the purpose and function of stamps.

As a side note, the first half of this video introduces Quad9. It's separate from DNSCrypt, so don't confuse them. You can use Quad9 without DNSCrypt, which the second half of the video explains. However, you do not get encrypted queries that way, so beware. It's best to use them together via Quad9's DNSCrypt service.

Back to DNSCrypt. When you set a server name, you're telling DNSCrypt Proxy which public servers (stamps) to use. To use the above stamp, you'd set:

You choose servers from the DNSCrypt public server list .

To select a suitable server, order the list ("1") by the "DNSCrypt" protocol first ("2"), then use the name on the left ("3"). The second image shows extra server information, including the stamp—this is what DNSCrypt Proxy downloads when you give it a server name.

Now for relays , which are privacy-respecting intermediate servers that anonymize your queries. If you want to use them (and you should), then you need to set the "routes" option under the "anonymized_dns" section. The easiest approach is to make DNSCrypt Proxy relay all requests while choosing those hops at random:

Also, the above approach may take a while to work initially, because it needs to find a working relay.

However, you can choose specific relays like this:

That will send all queries bound for any server through relays called "relay-example-1" and "relay-example-2."

You can get a complete list of relays from the DNSCrypt public server list.

If you click on the heading (annotation "1"), you can sort the list by relays ("2"). The name of the relay server is on the left ("3").

Many of these relay servers are community-owned, so be cautious with your choice. However, remember that they cannot read your query. Lastly, to protect your anonymity, be sure your relays and servers are not owned by the same people.

You can further configure servers to use specific relays:

Now you need to change your DNS settings. We have guides to do that on Windows 10 , Windows 11 , and macOS . On Linux, you need only update a single file:

Making a file immutable means even root cannot change it. However, you can make it mutable again with sudo chattr -i /etc/resolv.conf. Use lsattr /etc/resolv.confto view the current file attribute status.

Making theresolv.conffile immutable on Linux is sometimes necessary because some programs (like NetworkManager) like to reset it when they activate. You should consider this the nuclear option, and if achievable via some other method, then prefer that.

There are some extra settingsthat enable a pure, anonymized DNSCrypt protocol connection. Some act as filters for the downloaded server list.

Additionally, under the "anonymized_dns" section, set:

If you find a server doesn't make a connection, it's probably because one of these filters excludes it from the final filtered selection list. Double-check your target server and your settings.

Start and test the service

It's different for each platform

Once configured, you need to bring the service up and test it. For platforms other than Linux, refer to the relevant guide linked earlier.

For Linux, the service is typically called "dnscrypt-proxy":

To test it:

Alternatively, if you use dig , you can execute:

You should see it resolve using the local server:

---

I've put together a complete, working configuration file for you. It uses Quad9's filtered DNSCrypt service, which filters malware domains. It also relays connections through Austria and Sweden. You can add or remove relays as you deem necessary or use the information covered to customize your setup.

For the options we've covered today, I labeled them with "CUSTOM!" For everything else, you can find them in the example configuration file.

You can execute dnscrypt-proxy -check(while in the same directory as the configuration file) to ensure your queries get routed through Austria or Sweden. Once you do that, it's a case of starting the service and performing DNS queries.

While encrypted DNS does a lot for your privacy, a VPN does more. With encrypted DNS, it's like closing your curtains, but with a VPN, it's like locking all your doors too. If you're serious about privacy, I recommend ProtonVPN, which I personally use and love.

Check out Yahoo's latest VPN advice, based on hands-on testing.

Best VPNs in 2026 | The best VPNs for streaming in 2026 | The fastest VPNs in 2026 | Best VPN for Mac in 2026 | Most secure VPN in 2026 | 8 ways to make your VPN run faster | Does using a VPN impact internet speeds? | Are VPNs really safe? | See Yahoo Tech's full VPN coverage