Home / ubuntu / Questions / 1153293
Accepted
Xosrov
Asked: 2019-06-23 21:50:01 +0800 CST

Does dnscrypt-proxy's configuration replace /etc/hosts?

  • 772

I've recenly installed dnscrypt-proxy. The configuration file for it at /etc/dnscrypt-proxy/dnscrypt-proxy.toml has a blacklist section I'm currently using:

[blacklist]

  ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)

blacklist_file = '/etc/dnscrypt-proxy/CustomIgnores.txt'

I was wondering whether this option replaces the redirects at /etc/hosts? Or that both are used?
What does the /etc/hosts file even belong to? And how does the Blacklist option for dnscrypt even work(I assume it also just redirects to localhost)? Thanks.

networking hosts dnscrypt-proxy

1 Answers

  1. Best Answer

    When making DNS queries, the order of lookup is determined via Name Service Switch configuration in /etc/nsswitch.conf. You can check yours via:

    cat /etc/nsswitch.conf | grep -i hosts

    As an example, it might output the following:

    hosts: files dns

    Here files refers to local hosts file (/etc/hosts) and dns refers to the server specified in /etc/resolv.conf. The lookup is processed in the order they are written, therefore /etc/hosts will be processed first in this case. If the domain name is not found in the file, then it will try the server in /etc/resolv.conf.

    Coming back to your case, if your nsswitch.conf file has files value before dns, and a particular domain is listed both in /etc/hosts and blacklist entry in dnscrypt-proxy.toml, the one in /etc/hosts will precede. Also, if a correponding enty does not exists in /etc/hosts, but in dnscrypt-proxy blacklist, it will result in refused response. Quoting from dnscrypt-proxy GitHub wiki page:

    blacklists: names, or patterns that will cause a query to immediately receive a REFUSED response.

    References:

    • 1