Forwarding .onion doesn't work with my configuration

[hamedsbt]

Hi there,

forwarding-rules.txt:

onion 127.0.0.1:9053
exit 127.0.0.1:9053

dnscrypt-proxy.toml:

forwarding_rules = '/etc/forwarding-rules.txt'

Tor config:

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
DNSPort 127.0.0.1:9053

dnscrypt-proxy log:

[2025-09-04 06:26:56] [NOTICE] dnscrypt-proxy 2.1.13
[2025-09-04 06:26:56] [NOTICE] Network connectivity detected
[2025-09-04 06:26:56] [NOTICE] Now listening to 192.168.0.1:53 [UDP]
[2025-09-04 06:26:56] [NOTICE] Now listening to 192.168.0.1:53 [TCP]
[2025-09-04 06:26:56] [NOTICE] Source [public-resolvers] loaded
[2025-09-04 06:26:56] [NOTICE] Source [relays] loaded
[2025-09-04 06:26:56] [NOTICE] Source [odoh-servers] loaded
[2025-09-04 06:26:56] [NOTICE] Source [odoh-relays] loaded
[2025-09-04 06:26:56] [NOTICE] Loading the set of allowed names from [/etc/dnscrypt-proxy-allowlist.txt]
[2025-09-04 06:26:56] [NOTICE] Firefox workaround initialized
[2025-09-04 06:26:56] [NOTICE] Loading the set of blocking rules from [/etc/dnscrypt-proxy-blocklist.txt]
[2025-09-04 06:27:00] [NOTICE] Loading the set of cloaking rules from [/etc/dnscrypt-proxy-cloaking-rules.txt]
[2025-09-04 06:27:00] [NOTICE] Loading the set of forwarding rules from [/etc/forwarding-rules.txt]
[2025-09-04 06:27:00] [INFO] Forwarding [onion] to [127.0.0.1:9053]
[2025-09-04 06:27:00] [INFO] Forwarding [exit] to [127.0.0.1:9053]
[2025-09-04 06:27:00] [NOTICE] Hot reload is disabled
[2025-09-04 06:27:00] [NOTICE] Initializing monitoring UI
...

But it can't resolve michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion

It seems that dnscrypt-proxy doesn't forward query:

# nslookup michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Server:		192.168.0.1
Address:	192.168.0.1:53

Non-authoritative answer:

*** Can't find michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion: No answer

But the tor dns service is working:

# nslookup michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion 127.0.0.1:9053
Server:		127.0.0.1:9053
Address:	127.0.0.1:9053

Non-authoritative answer:
Name:	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Address: 127.241.247.60

Non-authoritative answer:
Name:	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Address: febc:1f10:783:686c:a006:7063:da74:c8e7

I have configured the tor dns service as 192.168.0.1:9053 but it didn't work too.

[lifenjoiner]

Works on my Win10.

Enable query log and see?

dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

Line 546 in e27f9b8

# file = 'query.log'

[hamedsbt]

Thank you for your support.

OS: OpenWrt 24.10.2 and I have changed tor and dnscrypt configs from 127.0.0.1 to 192.168.0.1

forwarding-rules.txt:

onion 192.168.0.1:9053
exit 192.168.0.1:9053

Tor config:

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
DNSPort 192.168.0.1:9053

log config:

[query_log]

## Path to the query log file (absolute, or relative to the same directory as the config file)
## Can be set to /dev/stdout in order to log to the standard output.

file = '/var/log/dnscrypt-proxy-query.log'


## Query log format (currently supported: tsv and ltsv)

format = 'tsv'


## Do not log these query types, to reduce verbosity. Keep empty to log everything.

# ignored_qtypes = ['DNSKEY', 'NS']

log:

[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	AAAA	SYNTH	1ms	-
[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	A	DROP	2ms	192.168.0.1:9053
[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	A	DROP	2ms	192.168.0.1:9053

I'm wondering why it was dropped?! Is the Tor config incorrect?

[lifenjoiner]

Test other forwarding rules instead of onion names?

[hamedsbt]

All other forwarding rules are working.

[lifenjoiner]

Let's bring out the big guns!

1. Set log_level to 0
   

   dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

   Line 209 in e27f9b8

   # log_level = 2

2. Set environment variable DEBUG to 1, and then lauch the program

3. Query and get the logs

[hamedsbt]

I've enabled debug mode by adding procd_set_param env DEBUG=1 to the service file.

Debug log:

[2025-09-06 x] [DEBUG] clients count: 1
[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.1:40607
[2025-09-06 x] [DEBUG] Using candidate [dnscry.pt-yerevan-ipv4] RTT: 125 Score: 0.912
[2025-09-06 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-06 x] [DEBUG] Calling UpdateMetrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-06 x] [DEBUG] Updating metrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-06 x] [DEBUG] Total queries now: 31
[2025-09-06 x] [DEBUG] Updated QPS: 0.01
[2025-09-06 x] [DEBUG] Cache miss, total misses: 27
[2025-09-06 x] [DEBUG] Query type AAAA, count: 7
[2025-09-06 x] [DEBUG] Response time: 2ms, avg: 242.97ms
[2025-09-06 x] [DEBUG] No server name or server is '-'
[2025-09-06 x] [DEBUG] Domain michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion, count: 3
[2025-09-06 x] [DEBUG] Added query log entry, total entries: 31,memory usage: 4304 bytes
[2025-09-06 x] [DEBUG] clients count: 0
[2025-09-06 x] [DEBUG] GetMetrics called
[2025-09-06 x] [DEBUG] GetMetrics - total queries: 31
[2025-09-06 x] [DEBUG] Computed and cached new metrics
[2025-09-06 x] [DEBUG] clients count: 1
[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.15:40607
[2025-09-06 x] [DEBUG] Using candidate [cs-de] RTT: 247 Score: 0.827
[2025-09-06 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-06 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-06 x] [DEBUG] clients count: 0

[lifenjoiner]

Over?

Didn't get why it's dropped.

Try the binary from my branch https://github.com/lifenjoiner/dnscrypt-proxy/actions/runs/17523155580, and show the drop reason.

?

[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.1:40607

Vs

[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.15:40607

[hamedsbt]

Thnk you again for your support. I think I found the reason for the drop:

[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused

AFAIK, the Tor client (as a DNS server) only listens on UDP (not TCP) ports. Am I right?

# netstat -tunlp | grep tor
tcp        0      0 192.168.0.1:9050      0.0.0.0:*               LISTEN      2093/tor
udp        0      0 127.0.0.1:9053          0.0.0.0:*                           2093/tor

log:

[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] clients count: 2
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [cs-belgium] RTT: 252 Score: 0.824
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-moscow-ipv4] RTT: 269 Score: 0.812
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-07 x] [DEBUG] Calling UpdateMetrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-07 x] [DEBUG] Updating metrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-07 x] [DEBUG] Total queries now: 48
[2025-09-07 x] [DEBUG] Updated QPS: 0.04
[2025-09-07 x] [DEBUG] Cache miss, total misses: 44
[2025-09-07 x] [DEBUG] Query type AAAA, count: 20
[2025-09-07 x] [DEBUG] Response time: 2ms, avg: 141.98ms
[2025-09-07 x] [DEBUG] No server name or server is '-'
[2025-09-07 x] [DEBUG] Domain michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion, count: 4
[2025-09-07 x] [DEBUG] Added query log entry, total entries: 48, memory usage: 6495 bytes
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] GetMetrics called
[2025-09-07 x] [DEBUG] GetMetrics - total queries: 48
[2025-09-07 x] [DEBUG] Computed and cached new metrics
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-telaviv-ipv4] RTT: 380 Score: 0.734
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.15:53935
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-frankfurt-ipv4] RTT: 272 Score: 0.810
[2025-09-07 x] [DEBUG] Handling query for [excess.duolingo.com]
[2025-09-07 x] [DEBUG] Calling UpdateMetrics for query: excess.duolingo.com
[2025-09-07 x] [DEBUG] Updating metrics for query: excess.duolingo.com
[2025-09-07 x] [DEBUG] Total queries now: 49
[2025-09-07 x] [DEBUG] Updated QPS: 0.08
[2025-09-07 x] [DEBUG] Cache miss, total misses: 45
[2025-09-07 x] [DEBUG] Blocked query (return code: REJECT), total blocks: 10
[2025-09-07 x] [DEBUG] Query type A, count: 29
[2025-09-07 x] [DEBUG] Response time: 0ms, avg: 139.08ms
[2025-09-07 x] [DEBUG] No server name or server is '-'
[2025-09-07 x] [DEBUG] Domain excess.duolingo.com, count: 10
[2025-09-07 x] [DEBUG] Added query log entry, total entries: 49, memory usage: 6622 bytes
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] GetMetrics called
[2025-09-07 x] [DEBUG] GetMetrics - total queries: 49
[2025-09-07 x] [DEBUG] Computed and cached new metrics

[hamedsbt]

I have fixed the issue by set force_tcp = false
Thank you for support.

[hamedsbt]

Is it possible to leave force_tcp = true as the default and overwrite it in the forward rule by specifying the forward type (TCP or UDP) in the forward rule?

I've got to use TCP for plain DNS requests because it can bypass some censorship systems more easily.

[jedisct1]

Set block_undelegated = false

[hamedsbt]

Thank you for support.
Didn't work.