Editing Domain Name System (section)

===DNSCrypt===
The [[DNSCrypt]] protocol, which was developed in 2011 outside the [[Internet Engineering Task Force|IETF]] standards framework, introduced DNS encryption on the downstream side of recursive resolvers, wherein clients encrypt query payloads using servers' public keys, which are published in the DNS (rather than relying upon third-party certificate authorities) and which may in turn be protected by [[DNSSEC]] signatures.<ref>{{Cite web |last=Ulevitch |first=David |date=6 December 2011 |title=DNSCrypt – Critical, fundamental, and about time. |url=https://umbrella.cisco.com/blog/dnscrypt-critical-fundamental-and-about-time |url-status=live |archive-url=https://web.archive.org/web/20200701221715/https://umbrella.cisco.com/blog/dnscrypt-critical-fundamental-and-about-time |archive-date=1 July 2020 |website=Cisco Umbrella |language=en-US}}</ref> DNSCrypt uses either TCP port 443, the same port as [[HTTPS]] encrypted web traffic, or UDP port 443. This introduced not only privacy regarding the content of the query, but also a significant measure of firewall-traversal capability. In 2019, DNSCrypt was further extended to support an "anonymized" mode, similar to the proposed "Oblivious DNS", in which an ingress node receives a query which has been encrypted with the public key of a different server, and relays it to that server, which acts as an egress node, performing the recursive resolution.<ref name="Anonymized DNSCrypt specification">{{Cite web |title=Anonymized DNSCrypt specification |url=https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol/master/ANONYMIZED-DNSCRYPT.txt |url-status=live |archive-url=https://web.archive.org/web/20191025094649/https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol/master/ANONYMIZED-DNSCRYPT.txt |archive-date=25 October 2019 |website=[[GitHub]] |publisher=DNSCrypt}}</ref> Privacy of user/query pairs is created, since the ingress node does not know the content of the query, while the egress nodes does not know the identity of the client. DNSCrypt was first implemented in production by [[OpenDNS]] in December 2011. There are several free and open source software implementations that additionally integrate ODoH.<ref name="ODoH_(2022)">{{cite web |title=Oblivious DoH · DNSCrypt/dnscrypt-proxy Wiki |url=https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Oblivious-DoH |website=GitHub |publisher=DNSCrypt project |access-date=28 July 2022 |language=en}}</ref> It is available for a variety of operating systems, including Unix, Apple iOS, Linux, Android, and Windows.