Simple DNSCrypt

Simple DNSCrypt is a simple management tool to configure dnscrypt-proxy on windows based systems.

If you are looking for an only command line tool, you can use the dnscrypt-proxy software. There are pre-compiled versions for any os. The dnscrypt-proxy software is written and maintained by Frank Denis (@jedisct1).


Missing features:


To install Simple DNSCrypt use the latest MSI packages: x86 or x64. You don`t need to download the dnscrypt-resolvers.csv or the dnscrypt-proxy package at all. Both are included in the msi package, the dnscrypt-resolvers.csv can be updated from inside the software (and will be verified with minisign).

File Signing

The MSI package and the SimpleDnsCrypt.exe are signed via a COMODO RSA Code Signing CA. The files are signed under the name: EAM Experience Area Münsingen GmbH

You also can verify the MSI package with minisign. The minisign signatures x86 and x64 can be verified with the following command:

minisign -Vm SimpleDNSCrypt.msi -P RWTSM+4BNNvkZPNkHgE88ETlhWa+0HDzU5CN8TvbyvmhVUcr6aQXfssV


To uninstall Simple DNSCrypt and dnscrypt-proxy, just go to the Windows Control Panel (Programs and Features) and search for Simple DNSCrypt.


Simple DNSCrypt will automatically check for new versions on startup.


choco install simplednscrypt


Standard Settings

standard view

Block and Blacklist

Block and Blacklist view

Advanced Settings

advanced view


plugin view

Live Log

Live Log view

Simple DNSCrypt currently supports four plugins:


If your network doesn't support IPv6, chances are that your applications are still constantly trying to resolve IPv6 addresses, causing unnecessary slowdowns. This plugin causes the proxy reply immediately to to IPv6 requests, without having to send a useless request to upstream resolvers, and having to wait for a response.


This plugin logs the DNS queries received by the proxy. The logs are stored in a local file. You can choose the folder, where dnscrypt-proxy will store the logfile (dns.log).


This plugin implements a simple, zero-configuration DNS response cache. The mimimum time to keep a record in cache can be specified in the cache plugin: 60 - 86400 seconds.


This plugin returns a REFUSED response if the query name is in a list of blacklisted names, or if at least one of the returned IP addresses happens to be in a list of blacklisted IPs.
A file should list one entry per line.
IPv4 and IPv6 addresses are supported. For names, leading and trailing wildcards () are also supported (e.g. *xxx,, ads.)

Note: If the file(s) is/are empty, the service may not start!


This plugin redirects queries for specific zones to a set of non-DNSCrypt resolvers. This can be useful for private zones that can only be resolved by a local DNS server.

Note: Requests are synchronous, so this plugin should not be enabled with untrusted clients.


This software was tested on:

32 bit 64 bit
Windows 7 tested tested
Windows 8.1 tested tested
Windows 10 tested tested

Feel free to report your success or failure: here



SimpleDNSCrypt currently speaks the following languages (16):

If you are able to translate the resx files into more languages, please feel free to send a pull request.

Want to say thanks?

Click here to lend your support to: Simple DNSCrypt and make a donation at !

Alternative Software

If you don`t like this software, there are two similar projects:

Used Software

Special Thanks

Frank Denis (@jedisct1) for developing libsodium and DNSCrypt

The EAM GmbH and bytejail for funding this project