Protocol pair
DNSCrypt vs DoH: Cryptography, Relays and When to Use Each
The dnscrypt vs doh question is really about two design philosophies. DNSCrypt is a purpose-built protocol for one job, encrypting and authenticating DNS between a client and a resolver. DNS over HTTPS takes the web’s existing stack, TLS and HTTP, and carries DNS messages inside it. Both protect the same hop; they get there differently.
DNSCrypt vs DoH: how DNSCrypt v2 works
Before the first query, a DNSCrypt client needs four things: the resolver’s IP address and port, its provider name, and the provider’s 32-byte Ed25519 public key. A DNS stamp packs all of them into one string. No certificate authority is involved, so trust comes entirely from that key and how you obtained it.
The client then fetches certificates with an ordinary, unencrypted TXT query for the provider name, conventionally of the form 2.dnscrypt-cert.example.com. Each TXT record holds one binary certificate with a short-term resolver key, a serial number and a validity window, signed with the provider key. The client keeps the valid certificate with the highest serial.
Queries are then encrypted with the encryption system that the chosen certificate names. The specification at dnscrypt.info/protocol describes X25519 key exchange with XChaCha20-Poly1305, padded with ISO/IEC 7816-4 padding. Each query carries everything the resolver needs to decrypt and answer it, so there is no handshake and no per-client session state on the server.
The older XSalsa20-Poly1305 construction still matters in practice. dnscrypt-proxy 2.1.6 removed it, noting that XChaCha20 had superseded it in 2016, and version 2.1.7 brought it back a day later because a number of servers still only supported it. The current draft specification also defines PQDNSCrypt, a hybrid post-quantum system built on X-Wing.
DNSCrypt vs DNS over HTTPS on the wire
On the wire, dnscrypt vs dns over https comes down to transport. DNSCrypt runs over UDP and TCP, and its specification recommends port 443 for both. DoH, defined in RFC 8484, sends DNS messages as HTTP requests over TLS, usually on port 443 too, and the server proves its identity with a certificate issued by a public certificate authority.
That difference shapes deployment. DoH plugs into existing HTTP infrastructure, RFC 8484 even tunes it for HTTP caches, and Windows 11 and Apple platforms speak it natively. DNSCrypt needs a client such as dnscrypt-proxy, but it has fewer moving parts and no dependency on the certificate authority system. A DoH stamp can pin SHA-256 hashes of certificates in the chain.
Over UDP, DNSCrypt avoids connection setup: the first encrypted query leaves as soon as the client holds a valid certificate. A DoH client establishes a TLS session first, then reuses it. For a dnscrypt vs doh decision on speed, measure your own candidates; the DoH speed test covers the DoH side.
Anonymized DNSCrypt vs Oblivious DoH
Encryption hides queries from the network, but the resolver still sees your IP address next to every name you look up. Anonymized DNSCrypt, specified as an extension to DNSCrypt v2, adds a relay. The relay forwards encrypted packets without knowing the shared secret, so it cannot read or alter them, and the server only sees relay addresses.
Oblivious DoH, experimental RFC 9230 from June 2022, applies the same idea to DoH. The client encrypts the DNS message to the target’s HPKE public key and sends it through a proxy, so no single server can read both the client IP address and the message. The split only holds while proxy and target do not collude.
The practical difference is availability. dnscrypt-proxy added Anonymized DNS in version 2.0.29 and ODoH in version 2.1.0, and both relay lists are published in the resolver directory. The Anonymized DNS route builder pairs each server with relays run by other operators, which is the part people most often get wrong.
DNSCrypt vs VPN: different scope
A dnscrypt vs vpn comparison mixes two layers. DNSCrypt protects only DNS: the network can no longer read or rewrite your lookups, but it still sees the IP addresses you connect to afterwards. A VPN tunnels all traffic to the VPN server, which then sees everything the local network used to see, including DNS unless you encrypt it onwards.
DNSCrypt vs DoH: choosing between them
Use DoH when you want encrypted DNS without installing anything, on a phone, a work laptop or a browser. Use DNSCrypt through dnscrypt-proxy when you want relays, local filtering and automatic server selection; it speaks DoH as well, so the two protocols can run side by side. The install guides cover dnscrypt-proxy on Windows, macOS, Linux and routers.
Frequently asked questions
Is DNSCrypt better than DoH?
Neither is better in every case. DNSCrypt is simpler, stateless and independent of certificate authorities, and dnscrypt-proxy supports its relay mode out of the box. DoH is supported natively by Windows 11 and Apple platforms. If you run dnscrypt-proxy, you can use both and let it pick the fastest servers.
Which port does DNSCrypt use?
The DNSCrypt specification recommends port 443 for both UDP and TCP unless a different port is configured. A DNS stamp carries the port when a server uses another one. DoH also uses port 443, but over HTTPS, so the two are not the same traffic even on the same port.
Does DNSCrypt use TLS?
No. DNSCrypt does not use TLS or certificate authorities. The resolver publishes short-term certificates signed with the provider's Ed25519 key, the client verifies them with a public key it already holds, and queries are encrypted with X25519 key exchange and XChaCha20-Poly1305. Trust comes entirely from that provider key and how you obtained it, typically through a DNS stamp.
Is DNSCrypt quantum safe?
The current specification adds PQDNSCrypt, which combines ML-KEM-768 and X25519 in the X-Wing construction to protect query confidentiality against future quantum computers. dnscrypt-proxy enabled it by default from version 2.1.17, and it works with servers that publish a compatible certificate. Both sides must support it, so a resolver without a post-quantum certificate gives you only the classical protection.