Simple DNSCrypt on Windows 11, the Windows Service and Alternatives

Where Simple DNSCrypt stands in 2026

The original project now lives in the DNSCrypt organisation on GitHub and is not archived. Its last tagged release is 0.7.1 from April 2020, while commits in November 2025 and March 2026 moved the bundled proxy to 2.1.15. Those newer builds are offered as unsigned, portable CI previews for x86 and x64 rather than as a signed installer.

A fork by the GitHub user instantsc took a different route and published 0.8.2 on 17 November 2023 as an MSI, built on .NET 8 and bundling proxy 2.1.5. Its README says only Windows 10 LTSC 21H2 was tested and that updates are manual. Compare either with release 2.1.20 from October 2026 and the gap becomes obvious.

Installing Simple DNSCrypt

If the gap does not bother you, installation is short and needs no command line at all. Choose one of the two projects rather than mixing them: the fork states it is not a drop-in replacement, and its settings are stored next to the program, so moving between versions or folders means migrating them yourself.

1. Download the MSI from the fork’s releases page, or a preview zip from the original repository.
2. Run it and start Simple DNSCrypt as administrator.
3. Install the bundled service from the main screen.
4. Pick resolvers on the resolver tab and apply.
5. Uninstall later through Programs and Features, which removes both parts.

A GUI hides details, and that is both the appeal and the catch. When something breaks, you end up reading the same log lines and TOML options that the command-line guide below covers, only one layer further away. Many users therefore keep Simple DNSCrypt for browsing resolvers and run a separately updated proxy underneath, which is tidier than it sounds.

dnscrypt-proxy as a Windows service on Windows 11

The wiki’s own route skips the GUI and gives you the current release. Download the win64 zip (or winarm on ARM laptops) from the releases page, verify it as described on the installation hub, and extract it to a plain folder such as D:\dnscrypt-proxy. Do not change any DNS setting yet; that comes after the first successful test.

cd D:\dnscrypt-proxy
copy example-dnscrypt-proxy.toml dnscrypt-proxy.toml
.\dnscrypt-proxy
.\dnscrypt-proxy -resolve example.com
.\dnscrypt-proxy -service install
.\dnscrypt-proxy -service start

The releases page also carries MSI packages of the proxy itself for x64 and x86 machines, next to the zip archives. They suit administrators who deploy software through the usual Windows installer tools, but the zip remains the format the wiki documents, and it keeps the executable, the TOML file and the lists together in one folder you control.

Run those lines in PowerShell opened with elevated privileges, and send the resolve test from a second window while the foreground copy is still running. Once it answers, stop it with Control-C, then install and start the Windows service. The same command also takes stop, restart and uninstall; restart after every edit to the configuration file.

Pointing the adapter at 127.0.0.1 and ::1

Microsoft’s steps for Windows 11 run through Start, Settings, Network and internet, then Wi-Fi (Manage known networks) or Ethernet, and the Edit button for the DNS settings. Choose Manual, turn on IPv4, enter 127.0.0.1 as Preferred DNS and save. Note the old addresses first so you can undo the change in seconds if needed.

IPv6 needs one extra step. The example configuration listens only on 127.0.0.1:53, so entering ::1 in the IPv6 Preferred DNS box points Windows at nothing until you add '[::1]:53' to listen_addresses and restart the Windows service. Leave the DNS over HTTPS drop-down on the loopback entries switched off; the proxy already handles encryption upstream.

The Alternate DNS box is a judgment call. The wiki explains that Windows applications generally try the primary server first and turn to the secondary only when the proxy stops answering, so a public resolver such as 9.9.9.9 keeps you online during an outage. Everything sent there travels unencrypted, though, which is why many users leave the box empty.

Alternatives worth knowing

Windows 11 itself can send DNS over HTTPS to a public resolver: enter the resolver’s addresses, choose an automatic or manual template and decide whether plaintext fallback is allowed. That covers a single protocol and no filtering, but it needs no extra software at all, and Microsoft notes the option is missing on Windows 10.

The project wiki names YogaDNS as a further alternative to Simple DNSCrypt on Windows, with the remark that it is not open source, and lists AdGuard as a commercial interface that embeds the proxy. Whichever you pick, relays for Anonymized DNS still have to be chosen sensibly, which the route builder does for a plain proxy setup.

Troubleshooting

• listen udp 127.0.0.1:53: bind: permission denied: PowerShell is not elevated.
• bind: address already in use: another DNS program, or an earlier proxy copy, still holds port 53.
• bare keys cannot contain '\n': a syntax error in the TOML file.
• Yellow network icon or “No internet access”: see the NCSI fix below.

The connectivity warning is the most common complaint after a switch. Windows probes a few hard-coded names before it calls a connection online, and on build 1709 or later you can make those probes use the proxy by enabling Specify Global DNS under Computer Configuration, Administrative Templates, Network, Network Connectivity Status Indicator in gpedit.msc.

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\Windows\NetworkConnectivityStatusIndicator" /v UseGlobalDNS /t REG_DWORD /d 1 /f

Editions without the policy editor take the registry value above instead, followed by a reboot. Another option is the captive portals map in the TOML file: the shipped example-captive-portals.txt already lists the NCSI names. Afterwards, confirm from outside with the DNS leak check that queries leave through the proxy rather than your provider’s resolver.