DNSCrypt command-line interface

Besides the programming interface, DNSCrypt has command-line interface.

Contents

• Server
  • Options
  • Example
• Lookup
  • Options
  • Example
• Generate
  • Options
  • Example
• Convert
  • Options
  • Example
• Common options
  • Help
  • Verbose
  • Version

Server

Starts DNSCrypt server with specified parameters. Config can be generated using generate or convert commands.

Options

• -c/--config <path>: Path to the server configuration file.

  Default: config.yaml

• -f/--forward <addr>: Default upstream for server.

  Default: 94.140.14.140:53

• -l/--listen <addr>: Server listening addresses.

  Default: 0.0.0.0:443

• -t/--timeout <duration>: Timeout for server to request upstream.

  Default: 10s

Example

dnscrypt server --config config.yaml --listen 0.0.0.0:443 --listen 0.0.0.0:8888 --forward 8.8.8.8:53 --timeout 5s

This server can be requested using lookup command, or dnslookup tool. For DNSCrypt stamp generation see https://dnscrypt.info/stamps.

Lookup

Performs DNS lookup via DNSCrypt using stamp or raw server parameters.

Options

• -a/--addr <addr>: Resolver address (IP[:port]).

  Default: No default value. If stamp is not specified, this option is required.

• -d/--domain <domain>: Domain to resolve.

  Default: No default value, option is required.

• -n/--network <proto>: Network protocol (tcp/udp).

  Default: udp

• -pk/--public-key <key>: DNSCrypt resolver public key.

  Default: No default value. If stamp is not specified, this option is required.

• -pn/--provider-name <name>: DNSCrypt provider name.

  Default: No default value. If stamp is not specified, this option is required.

• -s/--stamp <stamp>: DNSCrypt resolver stamp.

  Default: No default value.

• -t/--type <type>: DNS query type.

  Default: A

Example

dnscrypt lookup --domain example.org --stamp sdns://...

dnscrypt lookup --domain example.org --public-key <key> --provider-name 2.dnscrypt-cert.example.org --addr 1.2.3.4:443

Generate

Generates DNSCrypt resolver config.

Options

• -o/--out <path>: Output file path.

  Default: config.yaml

• -pk/--private-key <key>: Server hex-encoded private key.

  Default: No default value. If option is not specified, new private key will be generated.

• -pn/--provider-name <name>: DNSCrypt provider name.

  Default: No default value, option is required.

• -t/--ttl <duration>: Certificate time-to-live.

  Default: 8760h.

Example

dnscrypt generate --provider-name 2.dnscrypt-cert.example.org --out config.yaml

dnscrypt generate --provider-name 2.dnscrypt-cert.example.org --private-key <hex-key> --out config.yaml

Convert

Generates DNSCrypt resolver config from keys generated with dnscrypt-wrapper.

Options

• -o/--out <path>: Output file path.

  Default: config.yaml

• -pk/--private-key <path>: Path to file with server private key.

  Default: No default value, option is required.

• -pn/--provider-name <name>: DNSCrypt provider name.

  Default: No default value, option is required.

• -r/--resolver-secret <path>: Path to file with short-term privacy key.

  Default: No default value, option is required.

• -t/--ttl <duration>: Certificate time-to-live.

  Default: 8760h.

Example

dnscrypt convert --provider-name 2.dnscrypt-cert.example.org --private-key secret.key --resolver-secret crypt_secret.key --out config.yaml

Common options

Help

-h/--help: makes DNSCrypt print out a help message to standard output and exit with a success status-code.

Verbose

-v/--verbose: Enables verbose logging.

Version

--version: makes DNSCrypt print out the version of the application to standard output and exit with a success status-code.