# Can't specify DNSCrypt-Proxy 2 Listen Address

**URL:** <https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124>\
**Category:** Help\
**Created:** [April 13, 2019, 1:39am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124 "2019-04-13T01:39:32Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 1:39am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/1 "2019-04-13T01:39:32Z")

</div>

## Expected Behaviour:

After getting my Pi-Hole working with Cloudflared and Unbound on separate listening addresses, I installed DNSCrypt-Proxy 2.0.

After doing so, I changed the DNSCrypt listen\_address flag to 127.0.0.4:5554 and expected it to work (my other proxies/resolvers are on .2:5552 and .3:5553).

## Actual Behaviour:

It didn't work. Sudo netstat -tulpen | grep 5554 showed nothing and running the command w/o the | showed that DNSCrypt wasn't listening on any port.

I changed back to 127.0.0.1:5300 and it worked fine.

I would like to be able to change the address so I can name the proxy in Hosts and have it display separately in the Pi-Hole's "Queries answered by" chart.

Having implemented similar changes for Cloudflared and Unbound, I'm not sure what is different about DNSCrypt.

Any advice would be appreciated.

## Debug Token:

[https://tricorder.pi-hole.net/g79xh0u13y](https://tricorder.pi-hole.net/g79xh0u13y)!

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [April 13, 2019, 1:44am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/2 "2019-04-13T01:44:56Z")

</div>

I would inquire on the DNSCrypt support site/github.

Why do you run all of these in parallel? That would seem to negate any advantage that one method has over the others.

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 1:53am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/3 "2019-04-13T01:53:34Z")

</div>

Thanks, I'll do that. I had seen similar questions answered here.

I'm not running all three in parallel.

Right now, I'm running DNSCrypt-Proxy with Unbound (recursive only) as a back up using the "strict-order" flag in dnsmasq.

I am no longer using Cloudflared (it seems unstable) and I may stop using Unbound once I better understand how DNSCrypt handles fallback.

What I've been trying to accomplish from the beginning is using DoH/DoT upstream servers with a local recursive server as a fallback.

I thought Unbound would do this on its own and I believe later versions will. But the 1.6.0 version available on Raspbian Stretch doesn't use tls-cert-bundles. So DoT isn't implemented properly (can't authenticate from what I understand).

Thanks for your help.

Best,

JAW

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [April 13, 2019, 1:54am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/4 "2019-04-13T01:54:53Z")

</div>

> [@JAW](#):
>
> I’m running DNSCrypt-Proxy with Unbound (recursive only) as a back up using the “strict-order” flag in dnsmasq.

You may find that this method doesn't work. I believe there is an open dnsmasq issue regarding strict order.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [April 13, 2019, 1:56am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/5 "2019-04-13T01:56:37Z")

</div>

> [@JAW](#):
>
> What I’ve been trying to accomplish from the beginning is using DoH/DoT upstream servers with a local recursive server as a fallback.

What do you see as the advantages of using encrypted DNS over unbound?

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 1:56am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/6 "2019-04-13T01:56:55Z")

</div>

> [@jfb](#):
>
> You may find that this method doesn’t work. I believe there is an open dnsmasq issue regarding strict order.

I agree. It's difficult to test. If I stop my primary resolver/proxy, it appears to fall back. But I'm not sure what would happen if the primary simply failed.

When I was using Cloudflared with Unbound as a backup and Clouflared crashed, everything stopped working. No backup. Not sure where the issue was.

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 2:01am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/7 "2019-04-13T02:01:22Z")

</div>

> [@jfb](#):
>
> What do you see as the advantages of using encrypted DNS over unbound?

My only answer to this is that it _seems_ that encrypted DNS is more private that running a local recursive resolver. Of course, I appreciate that once I actually browse to a website, this would go out the window (absent ESNI).

Also, sometimes I use a VPN without blocking outside DNS so that I get the benefit of my Pi-Hole. If I'm using encrypted DNS, both my DNS and my traffic are hidden. I'm under the impression that my DNS would be "in the clear" if I used a local recursive resolver under the same scenario.

Please feel free to set me straight if I've got any of this wrong.

Thanks for your help.

Best,

JAW

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [April 13, 2019, 2:07am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/8 "2019-04-13T02:07:09Z")

</div>

For the VPN, I agree with your conclusion. I don't think that encrypted DNS gives you any more privacy without a VPN - the ISP sees all your IP traffic anyway, and with encrypted DNS you are entrusting your entire DNS history to a third party. With unbound, it stays local. For that reason, I believe that unbound gives you better privacy (and equal security) than encrypted DNS.

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 2:14am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/9 "2019-04-13T02:14:37Z")

</div>

> [@jfb](#):
>
> For the VPN, I agree with your conclusion.

I'm glad we're in agreement on this as it has been central to my configuration choices.

I agree with your comments about trusting DNS history to a third party being a downside of using encrypted DNS servers.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [April 13, 2019, 2:18am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/10 "2019-04-13T02:18:06Z")

</div>

If you locally compile the current version of unbound, you should be able to have unbound do the whole thing for you with no backup.

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 2:19am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/11 "2019-04-13T02:19:45Z")

</div>

Thank you for suggesting this.

I tried this and it was kind of a nightmare. I'll probably try again sometime soon.

Hope you have a good weekend.

Best,

JAW

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 2:23am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/12 "2019-04-13T02:23:41Z")

</div>

> [@jfb](#):
>
> If you locally compile the current version of unbound, you should be able to have unbound do the whole thing for you with no backup.

This community here stepped up with some instructions for me when I asked.

> [@Compiling Unbound from Source / Getting Unbound to work with DNS-over-TLS?](https://discourse.pi-hole.net/t/compiling-unbound-from-source-getting-unbound-to-work-with-dns-over-tls/19017/2):
>
> ´edit´ This only works if unbount isn't already on your system, uninstall & purge older versions before continuing! /edit compile: #!/bin/bash sudo apt-get -y install libssl-dev sudo apt-get -y install libexpat1-dev sudo groupadd -g 991 unbound sudo useradd -c "unbound-1.9.1" -d /var/lib/unbound -u 991 -g unbound -s /bin/false unbound file=unbound-1.9.1 mkdir -p unbound cd unbound wget https://nlnetlabs.nl/downloads/unbound/$file.tar.gz tar xzf $file.tar.gz cd $file sudo ./configure --p…

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [April 13, 2019, 7:08am UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/13 "2019-04-13T07:08:19Z")

</div>

you'll find some instructions in this old [article](https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378), showing how to run unbound, dnscrypt-proxy and stubby all on the same system.

**partial** content of my current `unbound.conf`:

```auto
server:
	logfile: /unbound.log
	log-time-ascii: yes
	verbosity: 1
	interface: 127.10.10.2@5552
	do-ip4: yes
	do-udp: yes
	do-tcp: yes

```

**partial** content of `/opt/dnscrypt-proxy/dnscrypt-proxy.toml`:

```auto
server_names = ['scaleway-fr', 'de.dnsmaschine.net', 'dnscrypt.me']
listen_addresses = ['127.10.10.4:5554']
ipv4_servers = true
dnscrypt_servers = true
doh_servers = true
require_dnssec = true
require_nolog = true
require_nofilter = true

```

output from `sudo netstat -tulpen | grep 555` (list both port 5554 and port 5552)

```auto
pi@raspberrypi:~ $ sudo netstat -tulpen | grep 555
tcp 0 0 127.10.10.2:5552 0.0.0.0:* LISTEN 0 13515 802/unbound
tcp 0 0 127.10.10.4:5554 0.0.0.0:* LISTEN 0 12460 276/dnscrypt-proxy
udp 0 0 127.10.10.2:5552 0.0.0.0:* 0 13514 802/unbound
udp 0 0 127.10.10.4:5554 0.0.0.0:* 0 12459 276/dnscrypt-proxy

```

`edit`  
**partial** content of `/etc/dnsmasq.d/01-pihole.conf`:

```auto
# dnscrypt-proxy v2
server=127.10.10.4#5554
# unbound
server=127.10.10.2#5552

```

`/edit`

---

<div class="post-metadata">

**Author:** ![JAW](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@JAW](https://discourse.pi-hole.net/u/JAW)\
**Post date:** [April 13, 2019, 4:07pm UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/14 "2019-04-13T16:07:02Z")

</div>

Thanks, @jpgpi250. I saw that post and had consulted it.

I had no issue changing the listening addresses for Unbound and Cloudflared in their respective config files and then conforming that change to dnsmasq.d and my hosts file.

DNSCrypt is the outlier. The same change doesn't take.

I will keep playing with it.

Thanks again.

Best,

JAW

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [May 4, 2019, 4:07pm UTC](https://discourse.pi-hole.net/t/cant-specify-dnscrypt-proxy-2-listen-address/19124/15 "2019-05-04T16:07:07Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.