I've recenly installed dnscrypt-proxy. The configuration file for it at /etc/dnscrypt-proxy/dnscrypt-proxy.toml has a blacklist section I'm currently using:


  ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)

blacklist_file = '/etc/dnscrypt-proxy/CustomIgnores.txt'

I was wondering whether this option replaces the redirects at /etc/hosts? Or that both are used?
What does the /etc/hosts file even belong to? And how does the Blacklist option for dnscrypt even work(I assume it also just redirects to localhost)? Thanks.


When making DNS queries, the order of lookup is determined via Name Service Switch configuration in /etc/nsswitch.conf. You can check yours via:

cat /etc/nsswitch.conf | grep -i hosts

As an example, it might output the following:

hosts: files dns

Here files refers to local hosts file (/etc/hosts) and dns refers to the server specified in /etc/resolv.conf. The lookup is processed in the order they are written, therefore /etc/hosts will be processed first in this case. If the domain name is not found in the file, then it will try the server in /etc/resolv.conf.

Coming back to your case, if your nsswitch.conf file has files value before dns, and a particular domain is listed both in /etc/hosts and blacklist entry in dnscrypt-proxy.toml, the one in /etc/hosts will precede. Also, if a correponding enty does not exists in /etc/hosts, but in dnscrypt-proxy blacklist, it will result in refused response. Quoting from dnscrypt-proxy GitHub wiki page:

blacklists: names, or patterns that will cause a query to immediately receive a REFUSED response.


  • Very helpful indeed, and answers most of my question. Thanks
    – Xosrov
    Dec 31 '19 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.