Tool
Anonymized DNS route builder: relays and a ready configuration
Build your anonymized DNS routes
# Pick at least one server above.How anonymized DNS works
Anonymized DNS is a feature of the DNSCrypt protocol that sends each query through a relay before it reaches the resolver. The relay learns who you are but cannot read the query, and the resolver reads the query but only sees the relay’s address. Splitting that knowledge between two independent parties is the whole point of the design.
dnscrypt-proxy configures it as routes: for every server, you name the relays it may travel through. Writing those routes by hand is tedious, because you need to know which relays exist, who operates them and where they sit on the network. The builder above reads the public lists and does that matching for you.
How the builder picks relays
For each DNSCrypt server you select, the builder decodes the server stamp to find its address, then removes every relay that belongs to the same operator, judged by the operator prefix in the name, and every relay inside the same /24 network block. Among the rest it prefers relays outside the server’s wider /16 network, then spreads choices across operators.
The picks are deterministic, so the same selection always produces the same routes and a shared link reproduces exactly what you saw. For different relays, add a third relay or swap a server; the anonymized DNS routes update instantly. Relay availability changes over time, so regenerate the block now and then rather than keeping it unchanged for years.
Putting the routes in dnscrypt-proxy.toml
With the complete config option on, the output is a working dnscrypt-proxy.toml with listen address, server names, filters, sources for the resolver and relay lists, and the anonymized_dns section. Without it, you get only server_names and the routes block, ready to paste into an existing file below its current settings without touching anything else you configured.
Keep skip_incompatible at true. It tells dnscrypt-proxy to ignore a route when the server or relay cannot be used, for example after a relay retires, instead of refusing to start. After saving the dnscrypt-proxy.toml file, restart the service and check its log: each relayed server shows up with the relay it was reached through, which confirms the routes are live.
Choosing servers for anonymized DNS
Only DNSCrypt servers can be relayed, so step one lists DNSCrypt entries alone. The no logging and DNSSEC filters start switched on, because relays hide your address while the server’s own policy still decides what happens to the query. Search by operator name to pick servers you trust, then let the builder assign relays to them.
Two or three servers are plenty: dnscrypt-proxy sends each query to a fast one, and with two relays per server it has several working paths if one disappears. For background on the protocol behind all this, the comparison of DNSCrypt and DNS-over-HTTPS explains how relays differ from Oblivious DoH, and the resolver directory lists every server with its flags.
Why relays beat a single trusted resolver
Picking one resolver you trust and sending everything to it is simple, but it concentrates your whole browsing history in one place, tied to your address. Relays spread that risk: even a resolver that logs against its stated policy ends up holding queries from a relay address shared by many users, not a record of your household.
Anonymized DNS is also lighter than routing DNS through Tor. There is no circuit to build and no exit node to trust, only one extra hop per query on the usual DNSCrypt ports. On mobile connections and slow links that difference is noticeable, which is why many setups combine relays with a local cache.
Checking that relays are in use
A quick end-to-end test helps too. Look up a name you have never visited, then search the query log for it: the entry should name a relayed server. Repeat the lookup and the answer should come from the local cache instantly. If lookups fail entirely, temporarily remove the routes block to tell a relay problem from a server problem.
After a restart, the dnscrypt-proxy log lists each relayed server together with its relay, and latency figures include the extra hop. If a server appears without a relay, check the spelling of its name in the routes block against the resolver list, and confirm that the relay list source is present and has been downloaded at least once.
Frequently asked questions
What does an anonymized DNS relay actually see?
The relay sees your IP address and the address of the server it forwards to, but the query itself stays encrypted for that server, so the relay cannot read the names you look up. The server sees the query but only the relay's address, never yours, unless the two operators share data.
Why must the relay and the server belong to different operators?
Anonymization works only if no single party holds both halves of the information. If one company runs the relay and the server, it can match your address to your queries. The builder therefore skips relays whose name matches the server operator and relays on the same network block as the server.
Does anonymized DNS work with DNS-over-HTTPS servers?
No. Anonymized DNSCrypt relays forward DNSCrypt traffic only. dnscrypt-proxy offers Oblivious DoH as the comparable mechanism for DNS-over-HTTPS, configured separately. With skip_incompatible set to true, dnscrypt-proxy ignores routes for servers that cannot be relayed instead of refusing to start. Only DNSCrypt servers can be relayed, so the builder lists DNSCrypt entries alone in step one.
Will relays make my DNS slower?
Usually a little, because each query takes an extra hop. Choosing relays and servers in the same region keeps the delay small, and the local cache in dnscrypt-proxy answers repeated lookups without any network trip at all. Two relays per server let the proxy fall back when one of them is unreachable.
Is the generated configuration sent anywhere?
No. The server and relay lists are loaded once as static files from this site, and the configuration is assembled in your browser. Nothing you select is transmitted. The page address stores your selection after the hash sign, which browsers never send to the server when the link is opened.