dns over https客户端搭建

dnscrypt-proxy是一个开源的DNSCrypt与DNS over HTTPS客户端，项目地址：https://github.com/dnscrypt/dnscrypt-proxy。程序是用go语言写的，下载release即可，没有任何依赖库，找到自己平台对应的版本下载即可。MT7620/MT7621平路由器台下载linux-mipsle版本的build，一般的Linux服务器或NAS下载amd64的build。

下载解压完成后，示例配置文件为example-dnscrypt-proxy.toml。把这个文件复制一份，重命名为dnscrypt-proxy.toml。以下为配置文件前面部分修改样例。

#这个列表用于指定将要使用的服务器。有ipv6网络时建议优先使用ipv6服务器。
#服务器名称能在 https://dnscrypt.info/public-servers 找到。
#server_names = ['dnswarden-doh2-ipv6','cloudflare-ipv6','gridns-jp-ipv6','jp.tiar.app-doh-ipv6']
server_names = ['dnswarden-doh2','cloudflare','doh-jp-blahdns','jp.tiarap.org']
#程序监听地址。如果要对所有地址服务，可以监听'0.0.0.0:53'或'[::]:53'.
#也可以监听多个地址，例如 listen_addresses = ['127.0.0.1:53', '192.168.1.2:53']
listen_addresses = ['127.0.0.1:53']
max_clients = 250
# Use servers reachable over IPv4
ipv4_servers = true
# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
ipv6_servers = true
# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = false
# Use servers implementing the DNS-over-HTTPS protocol
doh_servers = true
## Require servers defined by remote sources to satisfy specific properties
# Server must support DNS security extensions (DNSSEC)
#服务器支持DNSSEC
require_dnssec = false
# Server must not log user queries (declarative)
#服务器不会记录查询
require_nolog = true
# Server must not enforce its own blacklist (for parental control, ads blocking...)
#服务器不会过滤结果
require_nofilter = true
# Server names to avoid even if they match all criteria
#服务器黑名单
disabled_server_names = []

修改这些配置就可以正常使用了，运行dnscrypt-proxy文件即可。程序会在前台运行，Linux及OpenWrt用户推荐在screen里运行，以免ssh断开导致程序停止运行。运行后，会输出类似下面的文本。程序会先对所有服务器进行测速，自动选择响应时间最低的服务器，并过一段时间再对服务器进行测速。

root@1m6js5Z:~/linux-x86_64# ./dnscrypt-proxy
[2020-01-16 19:09:51] [NOTICE] dnscrypt-proxy 2.0.36
[2020-01-16 19:09:51] [NOTICE] Network connectivity detected
[2020-01-16 19:10:05] [NOTICE] Source [public-resolvers] loaded
[2020-01-16 19:10:05] [NOTICE] Source [relays] loaded
[2020-01-16 19:10:05] [NOTICE] Firefox workaround initialized
[2020-01-16 19:10:05] [NOTICE] Now listening to 0.0.0.0:5353 [UDP]
[2020-01-16 19:10:05] [NOTICE] Now listening to 0.0.0.0:5353 [TCP]
[2020-01-16 19:10:05] [NOTICE] [doh-jp-blahdns] OK (DoH) - rtt: 61ms
[2020-01-16 19:10:07] [NOTICE] [cloudflare] OK (DoH) - rtt: 172ms
[2020-01-16 19:10:08] [NOTICE] [jp.tiarap.org] OK (DoH) - rtt: 180ms
[2020-01-16 19:10:08] [NOTICE] Sorted latencies:
[2020-01-16 19:10:08] [NOTICE] -    61ms doh-jp-blahdns
[2020-01-16 19:10:08] [NOTICE] -   172ms cloudflare
[2020-01-16 19:10:08] [NOTICE] -   180ms jp.tiarap.org
[2020-01-16 19:10:08] [NOTICE] Server with the lowest initial latency: doh-jp-blahdns (rtt: 61ms)
[2020-01-16 19:10:08] [NOTICE] dnscrypt-proxy is ready - live servers: 3

搭建chinadns-ng服务加速查询

项目地址 https://github.com/zfl9/chinadns-ng
将上一步中搭建的doh服务监听5353端口。
git clone或下载zip并解压到本地，进入项目目录并编译。
更新chnroute并运行。推荐在screen里运行。

git clone https://github.com/zfl9/chinadns-ng
cd chinadns-ng
make
./update-chnroute.sh
./update-chnroute6.sh
./chinadns-ng -b 0.0.0.0 -l 53 -c 1.2.4.8 -t 127.0.0.1#5353 -g gfwlist.txt -m chnlist.txt

chinadns-ng会同时查询两个上游dns，对于可信结果就直接返回，不可信结果就等待可信dns返回结果。