Configuring DNSCrypt forwarders

[Singijeon]

After 3 years using TDNS as stub resolver for DNSCrypt forwarders I got resilient configuration:

1. I found top 6 stable DNSCrypt servers and relays for my ISP ASN
2. I configured 6 instances of DNSCrypt server services to use only one in each of them:
   Part of dnscrypt-proxy configuration example

   server_names = ['resolver-name']
   
   listen_addresses = ['[::1]:1153']
   
   cache = false
   
   [anonymized_dns]
   routes = [
       { server_name='resolver-name', via=['relay-name'] },
   ]
   
   [static]
     # Resolver
     [static.'resolver-name']
     stamp = 'sdns://…'
   
     # Relay
     [static.'relay-name']
     stamp = 'sdns://…'

3. In TDNS I filled forwarder list:
   Example of Settings → Proxy & Forwarders → Forwarders

   [::1]:1153
   [::1]:1253
   [::1]:1353
   [::1]:1453
   [::1]:1553
   [::1]:1653
   

   Forwarder Concurrency increase traffic consumption but allow avoid response timeout errors.
4. I had to patch dnscrypt-proxy due to the lack of support PMTUD to avoid timeout error of too big query:
   Force set UDP packet fragmentation for PPPoE connection in common.go

   var (
   	MaxDNSUDPPacketSize = 1472
   )

Thus I reached 0.01% server failures.

[Singijeon]

In such case GeoDNS doesn't work and ECS is not supported properly by dnscrypt-proxy so if you need it you should add Conditional Forwarder Zone for necessary zones and specify Forwarder of your ISP or second instance of TDNS which configured as recursive resolver. Also you can try to use Decentraleyes add-on in browser to increase page loading speed.