trust-dns

Well, basically because there are TLS libraries available in nearly every language. DNSCrypt is a custom protocol. For example here is my implementation over rustls in TRust-DNS: https://github.com/bluejekyll/trust-dns/blob/master/rustls/s... Basically that’s a thin wrapper over the TLS library, and I was able to do three different libraries. DNSCrypt on the other hand was a much larger project, and I gave up on implementing it when I saw the DNS-over-TLS RFC complete.

People may be interested in a discussion we had about the trust-dns-resolver and some preventative measures in this area: https://github.com/bluejekyll/trust-dns/issues/347 The thing I’m most disappointed with is that because we’ve been so lax about 127.0.0.1 and it’s usage, it’s become a means of different applications to blackhole requests suchas ad-blocking networks. Better than that though, are the applications that are using localhost resolution from public names to communicate with local versions of their applications from the browser. The sad thing, is that because of these we can’t just make a simple resolution policy. The one I would like to be true is that only localhost names can resolve to localhost (this doesn’t require any remote resolution), and that you must whitelist private domains for private address spaces (e.g. 10/8).