dnscrypt-proxy

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuratio... >minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with. >https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about. More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.

It's not Cloudflare's fault. In any case in order to maintain privacy I use https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound

Use DNSCrypt with anonymized relays: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... Or, wait until ODoH goes mainstream: https://datatracker.ietf.org/doc/html/draft-pauly-dprive-obl...

I run it on my pihole with Dnscryptproxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH It isn't too hard.

usually I factor cost of data plan into the decision of where I go next for the reasons you mentioned. Since you say you're doing UI and frontend I think this is a big challenge when fetching and pushing binary data like static assets. To reduce your data consumption and improve load times as well as security/privacy you may consider a /etc/hosts blocklist[1]. It's not going to help with reducing data in zoom calls, Netflix and podcasts but it adds up. Also don't forget application/service specific settings like switching all preferred resolution in video to the lowest quality etc. DNS traffic can be reduced (and sped-up) with a local cache (dnsmasq - or better yet dnscrypt-proxy[2]). [1] https://github.com/StevenBlack/hosts [2] https://github.com/DNSCrypt/dnscrypt-proxy

quite rare on HN yes. there are loads depending on the region. if you have no use for them it's a good idea to block them with dnscrypt-proxy[1] or nfq[2] to avoid getting bitten by homograph attacks. [1] https://github.com/DNSCrypt/dnscrypt-proxy [2] https://gitlab.com/jbauernberger/nfq/

or dnscrypt-proxy https://github.com/DNSCrypt/dnscrypt-proxy