DNSCrypt-proxy uses cloudflare as a DNS even when not specified in config file.

[kalpaj12]

Output of the following commands:

./dnscrypt-proxy -version
2.0.45

./dnscrypt-proxy -check

[2021-06-11 07:44:10] [NOTICE] dnscrypt-proxy 2.0.45
[2021-06-11 07:44:10] [NOTICE] Source [public-resolvers] loaded
[2021-06-11 07:44:10] [NOTICE] Source [relays] loaded
[2021-06-11 07:44:11] [NOTICE] Configuration successfully checked

./dnscrypt-proxy -resolve example.com

Resolving [example.com] using 127.0.0.1 port 54

Resolver      : 74.63.20.246 (res101.qpg.rrdns.pch.net.)
Lying         : no
DNSSEC        : yes, the resolver supports DNSSEC

Canonical name: example.com.

IPv4 addresses: 93.184.216.34
IPv6 addresses: 2606:2800:220:1:248:1893:25c8:1946

Name servers  : b.iana-servers.net., a.iana-servers.net.
DNSSEC signed : yes
Mail servers  : 1 mail servers found

HTTPS alias   : -
HTTPS info    : -

Host info     : -
TXT records   : v=spf1 -all, 8j5nfqld20zpcyr8xjw0ydcfq9rk8hgm

What is affected by this bug?

• I have Pi-hole installed on a Raspberry pi 4B. I am using a Custom upstream DNS (127.0.0.1#54). (Note: This is the only DNS Pi-hole send queries to for resolution)
• At port 54 of the Pi, is where I have dnscrypt-proxy listening at, with server_names = ['quad9-doh-ip4-filter-pri']
• dnsleaktest shows that I resolve via WoodyNet (as expected for quad9), Cloudflare (why?)

When does this occur?

Everytime! Flushed DNS, still occurs.

Where does it happen?

How do we replicate the issue?

Expected behavior (i.e. solution)

No cloudflare DNS;-;

Other Comments

[kalpaj12]

My dnscrypt-proxy.toml

[jedisct1]

Resolver : 74.63.20.246 (res101.qpg.rrdns.pch.net.)

pch.net is Quad9, not Cloudflare.

[kalpaj12]

@jedisct1, example2.com resolved via cloudflare's DNS, correct?

Resolving [example2.com] using 127.0.0.1 port 54

Resolver      : 162.158.234.59
Lying         : no
DNSSEC        : yes, the resolver supports DNSSEC

Canonical name: example2.com.

IPv4 addresses: 173.231.210.103
IPv6 addresses: -

Name servers  : ns1.inmotionhosting.com., ns2.inmotionhosting.com.
DNSSEC signed : no
Mail servers  : 1 mail servers found

HTTPS alias   : -
HTTPS info    : -

Host info     : -
TXT records   : -

Also, I tried example.com again

Resolving [example.com] using 127.0.0.1 port 54

Resolver      : 162.158.234.59
Lying         : no
DNSSEC        : yes, the resolver supports DNSSEC

Canonical name: example.com.

IPv4 addresses: 93.184.216.34
IPv6 addresses: 2606:2800:220:1:248:1893:25c8:1946

Name servers  : b.iana-servers.net., a.iana-servers.net.
DNSSEC signed : yes
Mail servers  : 1 mail servers found

HTTPS alias   : -
HTTPS info    : -

Host info     : -
TXT records   : v=spf1 -all, 8j5nfqld20zpcyr8xjw0ydcfq9rk8hgm

[jedisct1]

If you stop the proxy, what does dnsleaktest show?

[kalpaj12]

@jedisct1 I stopped the proxy, and flushed DNS, couldn't load any website. Had to start the proxy again.

[jedisct1]

Can you try to start the proxy with random junk in the configuration file to verify that this is the file actually being loaded?

[kalpaj12]

I added Quad9 resolvers to [sources] of the configuration file, and I guess that did the job! I now have only Quad9 DNS's in dnsleaktest.

This is my current configuration file dnscrypt-proxy.toml. This works!

P.s. found out Pi-hole is better with using Unbound as a recursive DNS. Although that, but great work team dnscrypt-proxy! :)

[lifenjoiner]

I think the strange part is the resolver IP.

I did tests on Windows with:

1. Only 1 server is specified by server_names. I used uad9-dnscrypt-ip4-filter-pri.
2. file = '/dev/stdout'
3. Run the server in a cmd
4. Run Wrieshark
5. Run dnscrypt-proxy -resolve example.com in another cmd

Similar results. For example:

Resolver      : 74.63.25.248 (res110.ams.rrdns.pch.net.)

In the server window, quad9-dnscrypt-ip4-filter-pri is used for all queries can be seen. Good.
But filtering Wrieshark results, you can see just 9.9.9.9 or 149.112.112.9 is used, rather than 74.63.25.248.

dnscrypt-proxy/dnscrypt-proxy/resolve.go

Lines 85 to 104 in a34258c

	var ip string
	if answer.Header().Rrtype == dns.TypeA {
	ip = answer.(*dns.A).A.String()
	} else if answer.Header().Rrtype == dns.TypeAAAA {
	ip = answer.(*dns.AAAA).AAAA.String()
	}
	if rev, err := dns.ReverseAddr(ip); err == nil {
	response, err = resolveQuery(server, rev, dns.TypePTR)
	if err != nil {
	break
	}
	for _, answer := range response.Answer {
	if answer.Header().Rrtype != dns.TypePTR || answer.Header().Class != dns.ClassINET {
	continue
	}
	ip = ip + " (" + answer.(*dns.PTR).Ptr + ")"
	break
	}
	}
	res = append(res, ip)

[lifenjoiner]

Here Resolver is not the remote server. It is the builtin resolver.dnscrypt.info.
Try dnscrypt-proxy -resolve resolver.dnscrypt.info, you will see.

dnscrypt-proxy/dnscrypt-proxy/resolve.go

Line 74 in a34258c

response, err := resolveQuery(server, myResolverHost, dns.TypeA)