In addition to responding to standard DNS queries, dnscrypt-proxy can also act as a DoH server, and respond to local queries sent over that protocol.

In particular, this means that Firefox can be configured to use it, so that it will accept to enable ECH (previously known as ESNI) without bypassing your DNS proxy.

In order to enable this, the first thing you need is a self-signed certificate. Since this is just for local usage, you can use that example one or create your own with:

openssl req -x509 -nodes -newkey rsa:2048 -days 5000 -sha256 -keyout \
  localhost.pem -out localhost.pem

Generating the TLS key requires answering a couple of questions (for example, Country Name, Organization Name, and Email Address). However, the answer fields can be empty or left at their default values.

Next, edit dnscrypt-proxy.toml configuration file, search for the local_doh section and uncomment the following lines:

[local_doh]
listen_addresses = ['127.0.0.1:3000']
path = "/dns-query"
cert_file = "localhost.pem"
cert_key_file = "localhost.pem"

The path to the localhost.pem file should be set in the cert_file and cert_key_file options. Make sure that the file can be read by the user that the dnscrypt-proxy service will run as.

Now, dnscrypt-proxy should be restarted. With the above settings, the URL of the local DoH server would be https://127.0.0.1:3000/dns-query. Here is a short excerpt from the system logs/status:

[NOTICE] Now listening to https://127.0.0.1:3000/dns-query [DoH]
[INFO] [cloudflare] TLS version: 304 - Protocol: h2 - Cipher suite: 4865
[NOTICE] [cloudflare] OK (DoH) - rtt: 54ms
[NOTICE] Server with the lowest initial latency: cloudflare (rtt: 54ms)
[NOTICE] dnscrypt-proxy is ready - live servers: 1

Firefox allows you to bypass warnings about self-signed certificates using the method described above. However, other browsers (Chrome/Chromium, Edge, Safari, etc.) prevent you from using DoH with an invalid certificate.

Generally, you can create a local certificate authority (CA) and validate your self-signed certificate, but this process may be tedious and varies from system to system. With mkcert, you can simplify the process and generate a valid certificate for use with other browsers.

• Install mkcert from here
• Create a local CA by running: mkcert -install
• Create a validated certificate for "localhost", "127.0.0.1", and "::1" by running: mkcert localhost 127.0.0.1 ::1
• Edit your dnscrypt-proxy.toml to use the generated certificate and key

Restart dnscrypt-proxy. Now your certificate is locally valid and you can use your local DoH with Chrome and other browsers.

It is possible, but not recommended, to configure local_doh to listen to outside queries, for example:

[local_doh]
listen_addresses = ['123.456.789.1:3000']
path = "/dns-query"
cert_file = "fullchain.pem"
cert_key_file = "privkey.pem"

cert_file and cert_key_file can be generated using Let's Encrypt.

Firefox and Cloudflare used to be running an experiment called ESNI. ESNI was an obsolete predecessor of ECH (Encrypted ClientHello), a TLS extension to hide the server name in TLS (including HTTPS) connections.

ECH is now standardized as RFC 9849, but deployment is still limited. Firefox ECH support was implemented in Firefox 85 in exchange for ESNI, which is no longer supported.

While this may eventually be a significant privacy improvement, ECH currently has some caveats to be aware of:

• ECH is standardized (RFC 9849), but client/server support and deployment are still limited.
• In practice, ECH is mostly available on Cloudflare-enabled sites. Even when using Firefox, ECH will not be used except when connecting to some websites from Cloudflare customers.
• Enabling ECH will trigger an extra DNS query for every single new hostname, even for hosts that don't support ECH. Every time a query for a host that doesn't support is made, an error will be returned (NXDOMAIN).
• Enabling ECH in Firefox breaks some websites ("Secure connection failed - SSL_ERROR_NO_CYPHER_OVERLAP" or "SSL_ERROR_MISSING_ESNI_EXTENSION").
• Implementations are still evolving, so expect occasional breakage or fallback to cleartext SNI.

Firefox has a setting to enable ECH, but for some unexplained reasons, the web browser ignores it unless it was also configured to bypass your DNS settings.

However, dnscrypt-proxy's local DoH server can be configured in Firefox, so that the ECH setting will not be ignored.

After having set up the local DoH feature as documented above, open the DoH server full URL (ex: https://127.0.0.1:3000/dns-query) as a regular website with Firefox.

The first time, the web browser will notice that the certificate is self-signed and complain about it. This is expected. Click "Advanced" and "I accept the risks". This is okay, you are only going to connect to your own machine.

Without the above step, TLS handshakes will fail and dnscrypt-proxy will record entries such as:

dnscrypt-proxy[13628]: http: TLS handshake error from 127.0.0.1:38984: remote error: tls: bad certificate

Next, type about:config in the URL bar, search for trr and make the following changes:

• Set network.trr.custom_uri and network.trr.uri to https://127.0.0.1:3000/dns-query
• Set network.trr.mode to 2 or 3 info
• Set network.dns.echconfig.enabled to true
• Set network.dns.use_https_rr_as_altsvc to true
• Set network.security.esni.enabled to true (deprecated)
• Set network.trr.allow-rfc1918 to true (if you use cloaking or forwarding rules which return private addresses like 192.168.0.0/16)
• Restart Firefox

You can finally check if the Firefox+Cloudflare ECH experiment is enabled here (don't pay attention to the "Secure DNS" column, the green mark will only be shown when using Cloudflare). Note that this test page was built for ESNI and doesn't yet detect ECH.

Note that the actual resolvers don't have to be Cloudflare's, and don't have to use the DoH protocol either. ECH is compatible with DNSCrypt and Anonymized DNSCrypt.

In order to revert the changes, set network.trr.mode to 0. Other parameters will then be ignored, so they can be left as-is.

The Local DoH hack is not required with Chrome. dnscrypt-proxy works with Chrome and ECH out of the box.

However, this still requires using Cloudflare as a resolver.

Some versions of Chrome enable ECH by default, others don't. This is something you can manually set by typing chrome://flags in the URL bar, and then changing the Encrypted ClientHello property.

Enabling ECH doesn't actually do anything unless the website you are connecting to was explicitly configured to support it. This requires TLS 1.3.

As of today, support is still limited, mostly on Cloudflare-enabled sites participating in the experiment.