1. Home
2. Documentation
3. How it works
4. Encryption Methods

IMPORTANT

The UK DNS Privacy Project is currently exploring the implemention of DNS Crypt to enhance user privacy and performance. However DNS Crypt is not currently supported by our resolvers.

DNS Crypt

DNSCrypt is a protocol that enhances the security and privacy of DNS queries by encrypting and authenticating communication between a DNS client and a DNS resolver. This prevents unauthorized access and tampering with DNS data.

How Does DNSCrypt Work?

DNSCrypt wraps DNS queries and responses in a cryptographic layer, ensuring that communications are both encrypted and authenticated. Here's how it functions:

1. You enter a domain name (e.g., example.com) into your browser.
2. Your device uses DNSCrypt to encrypt the DNS query with the resolver's public key.
3. The encrypted query is sent to a DNSCrypt-enabled resolver.
4. The resolver decrypts the query using its private key, processes it, and determines the corresponding IP address.
5. The resolver encrypts the response and sends it back to your device.
6. Your device decrypts the response and uses the IP address to establish a connection to the website or service.

Benefits of DNSCrypt

DNSCrypt offers several advantages in enhancing the security and privacy of DNS queries.

Authentication ensures that DNS responses originate from a trusted resolver and have not been altered by an attacker. This protects against DNS spoofing and man-in-the-middle attacks, where malicious entities attempt to redirect users to fraudulent websites.

Encryption safeguards DNS queries by encrypting the communication between the client and the resolver. This prevents third parties, such as ISPs or network administrators, from eavesdropping on DNS traffic and monitoring browsing activity.

Anonymity features are available in some DNSCrypt implementations, allowing users to anonymize their DNS queries further. This enhances privacy by preventing resolvers from easily linking queries to a specific user or device.

Challenges and Considerations

While DNSCrypt provides significant privacy and security benefits, it comes with certain challenges that users should consider.

Compatibility is an essential factor since both the client and the DNS resolver must support DNSCrypt for it to function. Not all public resolvers or network environments offer DNSCrypt support, limiting its widespread adoption.

Centralization can become a concern when relying on specific DNSCrypt resolvers. Unlike traditional DNS, where multiple resolvers are available, DNSCrypt requires users to choose a compatible server, potentially leading to reliance on a limited number of providers.

Performance may be slightly affected due to the encryption and decryption processes involved in DNSCrypt. Although the latency is generally minimal, it can be higher than traditional DNS queries, particularly for users on slower networks or older hardware.