dnscrypt-proxy

• Resumed PQDNSCrypt queries now use regular UDP padding, protecting their size and response budget. Oversized tickets are rejected, and oversized queries fall back to TCP.
• Network changes are detected more reliably, ensuring PQDNSCrypt key material rotates when connections change.
• Forwarded queries to local or DHCP resolvers now use UDP by default. Bootstrap resolvers still use TCP when force_tcp is enabled.
• Suffix rules now match only at DNS label boundaries. IP allow/block rules now correctly handle IPv4-mapped IPv6 addresses.
• The monitoring dashboard displays the running version. Its endpoints no longer allow cross-origin browser access.

• Forwarding rules now support the $PROXY: prefix to send selected plain DNS upstreams over DNS-over-TCP through the proxy configured by the main proxy setting.
• PQDNSCrypt certificate retrieval is more reliable on paths where fragmented UDP packets are blocked, including when certificates are fetched through Anonymized DNSCrypt relays.
• Resolver latency measurements no longer include setup or certificate-transfer time, so startup benchmarks and server selection better reflect actual query response time.

• Added support for PQDNSCrypt (DNSCrypt 2026), using post-quantum cryptography with compatible DNSCrypt servers to protect query confidentiality against future quantum computers. It is enabled by default and can be disabled with the new pqdnscrypt setting.
• Key material is now rotated when the local network changes, reducing linkability across network changes.
• Fixed a cache issue that could corrupt cached responses or cause data races under concurrent use.
• The netprobe_timeout configuration setting is now honored instead of being silently overridden by its command-line default.
• Forwarded queries now correctly fall back to TCP after a truncated UDP response, and SOCKS-proxied anonymized DNS exchanges are sent to the relay.
• HTTP/3 connections now retry after transient failures, and bootstrap resolution succeeds when at least one address was obtained.
• Cloaking rules that resolve through a rule ending in an IP address are no longer incorrectly rejected as recursive. Actual loops are still rejected.
• The monitoring dashboard now resolves API paths against the page origin, allowing it to work correctly when hosted under a path.

Version 2.1.16

• Dashboard HTML pages are no longer cached, preventing stale content from being served after upgrades.
• The IP allow/block plugins now support CIDR ranges in addition to single addresses and prefix matching.
• Forwarding rules now support $RESOLVCONF:<file> to pick up upstream resolvers from a resolv.conf-style file, complementing the existing $DHCP syntax.
• Recursive cloaking rules are now rejected at load time instead of being detected only when a matching query arrives.
• Servers that hit a transient high RTT could previously stay penalized forever and never come back into rotation; their RTT estimate now decays so they can recover.
• Servers are no longer penalized for slow responses when the response is actually being served from the stale cache.
• HTTP/3 probing now consults a negative cache before retrying, avoiding repeated probes against servers known not to support it.
• The HTTP transport now handles Alt-Svc: clear properly and reuses HTTP connections more aggressively.
• The cache TTL is now an explicit, configurable parameter rather than being derived implicitly.
• Log entries now include the relay name when a query was sent through an anonymized DNS or ODoH relay.
• A new tls_prefer_rsa option has been added to prefer RSA cipher suites during the TLS handshake, useful on systems without hardware AES.
• The tls_cipher_suite option is now a no-op. Modern TLS stacks no longer expose cipher suite selection in a meaningful way, and the option had become misleading.
• The -resolve command now reports incomplete DNSSEC support instead of silently treating partial signatures as a success.
• ODoH: the 401 key-refresh path has been hardened against panics, races and bad server state, refreshes are now coalesced, and the blocking sleep on refresh has been removed.
• A log size of 0 no longer means "unlimited"; it now correctly disables rotation by size.
• • jsdelivr is now offered as an alternative source URL for resolver lists, providing more redundancy when the primary mirrors are unreachable.
• The miekg/dns library has been updated to the v2 series.