Release history
dnscrypt-proxy Download: Releases, Verification and History
The only safe dnscrypt-proxy download is the one published by the project itself, on the releases page of DNSCrypt/dnscrypt-proxy on GitHub. This page records where to find each build, how to verify it, and how the versions developed from the old 1.x line to the current 2.1 series. It hosts no binaries and mirrors none.
Where to get the dnscrypt-proxy download today
Every release on GitHub carries source code and pre-built archives for a long list of platforms: Linux on x86_64, ARM, MIPS, RISC-V and LoongArch, the BSDs, Solaris, macOS on Apple silicon and Intel, Android, and Windows. Unix archives are .tar.gz files, while Windows, macOS and Android builds come as .zip. Each one has a matching .minisig file.
The latest release when this page was updated is 2.1.20, published on 22 October 2026. The project README links straight to the latest release, so bookmarking that link always gets you the current build. Older versions remain listed on the same page, which is useful if a regression forces you back to a previous build for a while.
The Windows download: ZIP or MSI
The Windows download comes in two forms. ZIP archives exist for win32, win64 and winarm, and MSI installers for x86 and x64. The 2.1.7 release notes added Windows on ARM builds, at first without an MSI. With the ZIP, you unpack the folder, adjust dnscrypt-proxy.toml and register the program as a service from an elevated console.
If you prefer a graphical tool, Simple DNSCrypt is a Windows front-end that configures dnscrypt-proxy for you, and the project wiki lists it among the graphical clients. Whichever Windows download you choose, verify the archive first, then follow the Windows install guide for the service setup and the network adapter settings that point Windows at the proxy.
Verify the minisign signature
The project signs every archive with Minisign. Download the archive and its .minisig file into the same folder and check the minisign signature with the project’s public key, copied exactly from the installation instructions in the wiki. The key is a long single line, and its last characters are jB5, a quick check that nothing was cut off.
minisign -Vm dnscrypt-proxy-*.tar.gz -P RWTk1xXqcTODeYttYMCMLo0YJHaFEHn7a3akqHlb/7QvIQXHVPxKbjB5
On Windows, use dnscrypt-proxy-*.zip in place of the .tar.gz file name. If the minisign signature does not verify, do not run the file. The wiki also publishes the same key in a DNSSEC-signed TXT record at dnscrypt-proxy.key.dnscrypt.info, so you can cross-check it with dig txt dnscrypt-proxy.key.dnscrypt.info. on a validating resolver.
Version history
The table lists milestones from the GitHub releases and the ChangeLog. Dates are the GitHub publication dates; the highlights are taken from the release notes of each version. Bug-fix releases in between are left out, and the full list, with every intermediate version and its notes, stays available on the releases page.
| Version | Released | Highlights |
|---|---|---|
| 1.x | before 2018 | C implementation, DNSCrypt v1 and v2 only, one server at a time |
| 2.0.0 | 2018-02-06 | Go rewrite reaches its first stable release |
| 2.0.3 | 2018-02-23 | First Android binaries |
| 2.0.29 | 2019-10-28 | Anonymized DNS support |
| 2.0.34 | 2019-12-03 | Name filters also apply to CNAME aliases |
| 2.0.45 | 2021-01-03 | [blacklist] becomes [blocked_names], [whitelist] becomes [allowed_names] |
| 2.1.0 | 2021-08-14 | Oblivious DoH; fallback_resolvers renamed bootstrap_resolvers |
| 2.1.2 | 2022-08-01 | DoH over HTTP/3 (QUIC) |
| 2.1.5 | 2023-08-11 | Extended error codes in blocked responses |
| 2.1.7 | 2025-01-11 | XSalsa20 support restored; Windows on ARM builds |
| 2.1.10 | 2025-05-20 | Configuration hot-reloading becomes optional, off by default |
| 2.1.12 | 2025-05-26 | WP2 load balancing by default; optional Prometheus metrics |
| 2.1.14 | 2025-09-03 | Client IP encryption in logs with IPCrypt |
| 2.1.16 | 2026-05-24 | CIDR ranges in IP allow and block lists |
| 2.1.17 | 2026-07-13 | PQDNSCrypt (post-quantum DNSCrypt), on by default |
| 2.1.20 | 2026-10-22 | regex: rules in name lists; DoH certificate hash checks per connection |
Why v1 builds should not be used
The project’s own comparison of the two lines describes 1.x as an old proof of concept that is barely maintained, written in C, and bundling patched versions of old system libraries. It supports only DNSCrypt, one server at a time, with no DoH, no automatic failover and no built-in download and verification of resolver lists.
The same comparison notes that IP filtering in 1.x can be bypassed through a vulnerability that version 2 does not have, and that its handling of TCP connections and small MTUs was unreliable. A 1.x client today is a security risk with no upside, so replace it with a current 2.1 build.
Packages per operating system
Package managers are a good alternative to a manual dnscrypt-proxy download, because updates arrive with the rest of the system. The project wiki documents the commands below for each distribution. Distribution packages can lag behind GitHub, so compare the packaged version with the latest release before relying on it for a new feature.
- Debian:
sudo apt install -t testing dnscrypt-proxy(or-t unstable) - Ubuntu 18.10 and later:
sudo apt install dnscrypt-proxy - Arch Linux:
pacman -S dnscrypt-proxy - Alpine Linux:
apk add dnscrypt-proxy dnscrypt-proxy-openrc - Gentoo:
emerge dnscrypt-proxy -av - OpenWrt:
opkg install dnscrypt-proxy2 - macOS and Windows: the signed archives from GitHub, see the install guides
Upgrading an existing dnscrypt-proxy download
Before replacing a running binary, read the ChangeLog for configuration changes. Then test the new version against your current file with dnscrypt-proxy -config /path/to/dnscrypt-proxy.toml -check, which should print no errors. Replace the old executable, restart the service, and keep the previous dnscrypt-proxy download until the new one has run cleanly for a day.
Frequently asked questions
Where can I download dnscrypt-proxy safely?
From the releases page of the DNSCrypt/dnscrypt-proxy repository on GitHub, or from your operating system's package manager. Each release archive comes with a Minisign signature file, so you can confirm that the file was signed with the project's key before installing it. If the signature does not verify, do not run the file.
What is the latest version of dnscrypt-proxy?
At the time of writing, the latest release is 2.1.20, published on 22 October 2026. It added regex rules for name lists and an option to check DoH certificate hashes on every new connection. The releases page always shows the current version. Read the ChangeLog for configuration changes before you upgrade a running installation.
Is there an installer for Windows?
Yes. Recent releases include MSI packages for 32-bit and 64-bit Windows alongside ZIP archives for win32, win64 and Windows on ARM. The ZIP archives contain the executable and an example configuration, and the program can install itself as a Windows service. Verify the archive with its Minisign signature before installing either form.
Should I still use dnscrypt-proxy 1.x?
No. The project describes the 1.x line as an old proof of concept that is barely maintained, written in C with bundled, patched libraries, and with an IP filtering weakness that version 2 fixed. Version 2 is a rewrite in Go and supports DoH, ODoH and Anonymized DNSCrypt. Replace any remaining 1.x client with a current 2.1 build.