DNSCrypt – A protocol to improve DNS security
I prefer <a href="http:&#x2F;&#x2F;curvedns.on2it.net" rel="nofollow">http:&#x2F;&#x2F;curvedns.on2it.net</a><p>This was the original.<p>Other than having to modify their ksh script, it is painless to set up.<p>In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers&#x2F;caches such as OpenDNS and DNSCrypt.<p>A recursive resolver should be authoritative for nothing.  They are middlemen.  Companies that offered this &quot;service&quot;, such as OpenDNS, had to pander to advertisers, or were run by advertising companies themselves, e.g., Google.<p>The &quot;rules&quot; of DNS are easily broken.  This applies to caches.  One does not need to look very far to find resolvers that someone has designated as &quot;authoritative&quot;.  dnsq: &quot;weird ra&quot;.  This often means an open resolver IME.<p>A while back some companies including the ones named above if I am not mistaken were pushing for extensions in DNS to put at least part of user IP addresses into DNS packets so cache operators could track them.  The reason?  Advertising.  (Although maybe they would cite other reasons.)  Not sure what ever happened with that.  BIND had started to implement it.  Thankfully djbdns will never support this garbage.<p>This kind of nonsense is why I cannot get excited about the latest extensions to internet protocols anymore.<p>Too often they are for the benefit of web companies and advertisers, not users.<p>The &quot;encrypted DNS revolution&quot;, if it ever comes, is not going to be initiated by companies running recursive resolvers.  (Unless they also run authoritative nameservers.)<p>Note: When the user runs their own cache on localhost there is no need to determine nearest POP.