Discuss mailing list

[PJ vM <pjvm742 AT disroot.org>]

Hello all.

Using the information available at servers.opennic.org, I made a server
list file for use with the program dnscrypt-proxy, that contains all the
OpenNIC servers listed as supporting DNSCrypt. I then used
dnscrypt-proxy to test with which of those servers DNSCrypt actually
works. Results are discussed below.
Attached is the file I made, a derived file with only the servers that
currently seem to be working, and some supporting files for easy
replication.

# Discrepancies with the servers website
servers.opennic.org says pass, DNSCrypt doesn't work:
* us-ga-ns4, operated by Vanguard IT
* fr-ns3 and fr-ns4, operated by iriseden
* ca-ns8, operated by Eleix

servers.opennic.org says offline, DNSCrypt works:
* ca-ns3 and ca-ns4 with IPv4, operated by luggs
* mx-ns6 with IPv4, operated by Rico4541, same provider as ca-ns3

With us-ga-ns4, fr-ns3 and fr-ns4 there seems to be something wrong with
the certificate. us-ga-ns4 *is* working as an anonymised-DNSCrypt relay,
which does not involve a certificate. ca-ns8 seems to be unreachable
with DNSCrypt. Not a clue what's going on with ca-ns3, ca-ns4 and
mx-ns8, but those three servers are all related.

# Maintaining this list on the website?
The default configuration for dnscrypt-proxy downloads and uses the
"public-resolvers" server list, which is maintained in the Github repo
DNSCrypt/dnscrypt-resolvers. It contains a lot of non-OpenNIC servers
and currently three servers that use the OpenNIC DNS root:
* the two servers operated by luggs, via IPv4
* publicarray, third party, via IPv4
* ibksturm, third party, via IPv4
This despite there currently being 5 OpenNIC servers that work with
DNSCrypt, two of which seem to also work with IPv6. There used to be
more on there, each of which was removed at a point when it wasn't
working and hasn't been added back.

Now of course, we can go to that Github repo and get the ones that are
missing added, but I think it would make sense to additionally put a
server list file with the working ones up on the OpenNIC website. This
would make it easier to configure dnscrypt-proxy to work with OpenNIC:
instead of loading public-resolvers and selecting a few OpenNIC servers,
you'd simply load the OpenNIC list using simple instructions that could
be at the OpenNIC wiki. That's also robust against the scenario where
the couple of servers you selected are removed from the public-resolvers
list.

I think it should be relatively straightforward to put this up on the
website: only thing is that a minisign signature needs to be generated
each time it changes and served along with it, and me signing the
official version would be a bad idea.


By the way, if you have dnscrypt-proxy installed, maybe see if you can
replicate this with the files I provided. Some of my results might be
specific to my setup.

-- 
pjvm
## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
## Example with both IPv4 and IPv6:
## listen_addresses = ['127.0.0.1:53', '[::1]:53']

listen_addresses = ['127.0.0.1:53', '[::1]:53']



## SOCKS proxy
## Uncomment the following line to route all TCP connections to a local Tor 
node
## Tor doesn't support UDP, so set `force_tcp` to `true` as well.

# proxy = 'socks5://127.0.0.1:9050'

## Always use TCP to connect to upstream servers.
## This can be useful if you need to route everything through Tor.
## Otherwise, leave this to `false`, as it doesn't improve security
## (dnscrypt-proxy will always encrypt everything even using UDP), and can
## only increase latency.

# force_tcp = true



## How long a DNS query will wait for a response, in milliseconds.
## If you have a network with *a lot* of latency, you may need to
## increase this. Startup may be slower if you do so.
## Don't increase it too much. 10000 is the highest reasonable value.

timeout = 4000



## Fallback resolvers
## These are normal, non-encrypted DNS resolvers, that will be only used
## for one-shot queries when retrieving the initial resolvers list, and
## only if the system DNS configuration doesn't work.

fallback_resolvers = ['9.9.9.9:53']

## Always use the fallback resolver before the system DNS settings.
ignore_system_dns = true



## Maximum time (in seconds) to wait for network connectivity before
## initializing the proxy.
## Useful if the proxy is automatically started at boot, and network
## connectivity is not guaranteed to be immediately available.
## Use 0 to not test for connectivity at all (not recommended),
## and -1 to wait as much as possible.

netprobe_timeout = 60

## Address and port to try initializing a connection to, just to check
## if the network is up. It can be any address and any port, even if
## there is nothing answering these on the other side. Just don't use
## a local address, as the goal is to check for Internet connectivity.
## On Windows, a datagram with a single, nul byte will be sent, only
## when the system starts.
## On other operating systems, the connection will be initialized
## but nothing will be sent at all.

netprobe_address = '9.9.9.9:53'



## Require servers (from static + remote sources) to satisfy specific 
properties

# Use servers reachable over IPv4
ipv4_servers = true

# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 
connectivity
ipv6_servers = true

# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = true

# Use servers implementing the DNS-over-HTTPS protocol
doh_servers = false


## Require servers defined by remote sources to satisfy specific properties

# Server must support DNS security extensions (DNSSEC)
require_dnssec = false

# Server must not log user queries (declarative)
require_nolog = false

# Server must not enforce its own blacklist (for parental control, ads 
blocking...)
require_nofilter = false


# Server names to avoid even if they match all criteria
# disabled_server_names = []


# overrides requirements; default/empty: use all defined
# server_names = []


[sources]

  ## An example of a remote source from 
https://github.com/DNSCrypt/dnscrypt-resolvers

  # [sources.'public-resolvers']
  # urls = 
['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md',
 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
  # cache_file = 'public-resolvers.txt'
  # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  # prefix = ''

  ## Anonymized DNS relays

  # [sources.'relays']
  # urls = 
['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/relays.md',
 'https://download.dnscrypt.info/resolvers-list/v2/relays.md']
  # cache_file = 'relays.txt'
  # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  # refresh_delay = 72
  # prefix = ''

  # [sources.'opennic-from-dnscrypt']
  # urls = ['https://download.dnscrypt.info/dnscrypt-resolvers/v3/opennic.md']
  # cache_file = 'public-resolvers-opennic.txt'
  # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'

  [sources.'opennic']
  cache_file = 'opennic.txt'
  refresh_delay = 6504372
  minisign_key = 'RWTmRtLl9scj4BusZ4DA0dumx/fn3AE9dMZS+3ssLuVyXCbXra2bJQtP'

  # [sources.'opennic-working']
  # cache_file = 'opennic-working.txt'
  # refresh_delay = 6504372
  # minisign_key = 'RWTmRtLl9scj4BusZ4DA0dumx/fn3AE9dMZS+3ssLuVyXCbXra2bJQtP'


 [static]
  # [static.'ca-ns3-ipv4']
  # stamp = 
'sdns://AQIAAAAAAAAADTE0Mi40LjIwNC4xMTEgHBl5MxvoI8zPCJp5BpN-XDQQKlasf2Jw4EYlsu3bBOMfMi5kbnNjcnlwdC1jZXJ0Lm5zMy5jYS5sdWdncy5jbw'
  # [static.'fr-ns3-ipv4']
  # stamp = 
'sdns://AQcAAAAAAAAAEzE0NC43Ni4xNTcuMjQyOjEwNTMgRaXPeIWXV4dJysPqq8J75IMToTXo2qFZ7rRmUliAoZIfMi5kbnNjcnlwdC1jZXJ0Lm5zMS5pcmlzZWRlbi5mcg'
  # [static.'fr-ns4-ipv4']
  # stamp = 
'sdns://AQcAAAAAAAAAEzk1LjIxNy4yMjkuMjExOjEwNTMgotDODatEPvxig7jq5p9fbrUfBzf71kIN_8Nj_QQjLssfMi5kbnNjcnlwdC1jZXJ0Lm5zMi5pcmlzZWRlbi5mcg'

[anonymized_dns]

## Routes are indirect ways to reach DNSCrypt servers.
##
## A route maps a server name ("server_name") to one or more relays that will 
be
## used to connect to that server.
##
## A relay can be specified as a DNS Stamp (either a relay stamp, or a
## DNSCrypt stamp), an IP:port, a hostname:port, or a server name.
##
## The following example routes "example-server-1" via `anon-example-1` or 
`anon-example-2`,
## and "example-server-2" via the relay whose relay DNS stamp
## is "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM".

# routes = [
#    { server_name="*", via=['us-ga-ns4-ipv6-relay'] },
# ]

# skip resolvers incompatible with anonymization instead of using them 
directly 
# skip_incompatible = true



# [local_doh]
## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers
## requiring a direct connection to a DoH server in order to enable some
## features will enable these, without bypassing your DNS proxy.

## Addresses that the local DoH server should listen to
# listen_addresses = ['127.0.0.1:3000']

## Path of the DoH URL. This is not a file, but the part after the hostname
## in the URL. By convention, `/dns-query` is frequently chosen.
## For each `listen_address` the complete URL to access the server will be:
## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`)

# path = "/dns-query"

## Certificate file and key - Note that the certificate has to be trusted.
## See the documentation (wiki) for more information.

# cert_file = "localhost.pem"
# cert_key_file = "localhost.pem"



## Log client queries to a file
# [query_log]
  ## Path to the query log file (absolute, or relative to the same directory 
as the config file)
  ## On non-Windows systems, can be /dev/stdout to log to the standard output 
(also set log_files_max_size to 0)
  # file = 'query.log'
  ## Query log format (currently supported: tsv and ltsv)
  # format = 'tsv'
  ## Do not log these query types, to reduce verbosity. Keep empty to log 
everything.
  # ignored_qtypes = ['DNSKEY', 'NS']

## Log queries for nonexistent zones
## These queries can reveal the presence of malware, broken/obsolete 
applications,
## and devices signaling their presence to 3rd parties.
[nx_log]
  ## Path to the query log file (absolute, or relative to the same directory 
as the config file)
  file = 'nx.log'
  ## Query log format (currently supported: tsv and ltsv)
  format = 'tsv'



[broken_implementations]

## Servers with known bugs
# Cisco servers currently cannot handle queries larger than 1472 bytes, and 
don't
# truncate reponses larger than questions as expected by the DNSCrypt 
protocol.
# This prevents large responses from being received over UDP and over relays.
#
# The `dnsdist` server software drops client queries larger than 1500 bytes.
# They are aware of it and are working on a fix.
#
# The list below enables workarounds to make non-relayed usage more reliable
# until the servers are fixed.

fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 
'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 
'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 
'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 
'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 
'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 
'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']



# [dns64]
## DNS64 is a mechanism for synthesizing AAAA records from A records.
## It is used with an IPv6/IPv4 translator to enable client-server
## communication between an IPv6-only client and an IPv4-only server,
## without requiring any changes to either the IPv6 or the IPv4 node,
## for the class of applications that work through NATs.
##
## There are two options to synthesize such records:
## Option 1: Using a set of static IPv6 prefixes;
## Option 2: By discovering the IPv6 prefix from DNS64-enabled resolver.
##
## If both options are configured - only static prefixes are used.
## (Ref. RFC6147, RFC6052, RFC7050)
##
## Do not enable unless you know what DNS64 is and why you need it, or else
## you won't be able to connect to anything at all.

## (Option 1) Static prefix(es) as Pref64::/n CIDRs.
# prefix = ["64:ff9b::/96"]

## (Option 2) DNS64-enabled resolver(s) to discover Pref64::/n CIDRs.
## These resolvers are used to query for Well-Known IPv4-only Name (WKN) 
"ipv4only.arpa." to discover only.
## Set with your ISP's resolvers in case of custom prefixes (other than 
Well-Known Prefix 64:ff9b::/96).
## IMPORTANT: Default resolvers listed below support Well-Known Prefix 
64:ff9b::/96 only.
# resolver = ["[2606:4700:4700::64]:53", "[2001:4860:4860::64]:53"]
# opennic

the complete list according to servers.opennic.org
for dnssec property, looked at DNS stamp provided in description, if any, and 
rest of description, else assumed no

--

not working, servers.opennic.org disagrees:

## ca-ns8-ipv4
operator: Eleix; dnssec: no; logging: no; filtering: no

sdns://AQYAAAAAAAAAEjE5OC41MC4xMzUuMjEyOjQ1MyAmwSho5TK78G5IQ-gpJkHcVWb6Z7BZROMEfu0uRR82YB4yLmRuc2NyeXB0LWNlcnQuY2FyYW1lbGZveC5uZXQ

## ca-ns8-ipv6
operator: Eleix; dnssec: no; logging: no; filtering: no

sdns://AQYAAAAAAAAAJ1syMDAxOjY3ODpmNjg6NzA6NTA1NDpmZjpmZTU3OjRhMDddOjQ1MyAmwSho5TK78G5IQ-gpJkHcVWb6Z7BZROMEfu0uRR82YB4yLmRuc2NyeXB0LWNlcnQuY2FyYW1lbGZveC5uZXQ

## fr-ns3-ipv4
operator: iriseden; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAEzE0NC43Ni4xNTcuMjQyOjEwNTMgRaXPeIWXV4dJysPqq8J75IMToTXo2qFZ7rRmUliAoZIfMi5kbnNjcnlwdC1jZXJ0Lm5zMS5pcmlzZWRlbi5mcg

## fr-ns3-ipv6
operator: iriseden; dnssec: yes; logging: no; filtering: no

public key (not mentioned on servers.opennic.org): 
2f3dfff609dfac8e3c23e3d4560666fc9a12862df4452d96469c63a174035ab5

sdns://AQcAAAAAAAAAHVsyYTAxOjRmODoyMDA6MzBmNTo6MjAxXToxMDUzIC89__YJ36yOPCPj1FYGZvyaEoYt9EUtlkacY6F0A1q1HzIuZG5zY3J5cHQtY2VydC5uczEuaXJpc2VkZW4uZnI

## fr-ns4-ipv4
operator: iriseden; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAEzk1LjIxNy4yMjkuMjExOjEwNTMgotDODatEPvxig7jq5p9fbrUfBzf71kIN_8Nj_QQjLssfMi5kbnNjcnlwdC1jZXJ0Lm5zMi5pcmlzZWRlbi5mcg

## fr-ns4-ipv6
operator: iriseden; dnssec: yes; logging: no; filtering: no

public key (not mentioned on servers.opennic.org):
1aced46215eb3e61cfa746880f17fd07d340d4ee2b4c264ee350f800b5a14170

sdns://AQcAAAAAAAAAHFsyYTAxOjRmOTo0YjozOWVhOjozMDFdOjEwNTMgGs7UYhXrPmHPp0aIDxf9B9NA1O4rTCZO41D4ALWhQXAfMi5kbnNjcnlwdC1jZXJ0Lm5zMi5pcmlzZWRlbi5mcg

## us-ga-ns4-ipv4
operator: Vanguard IT services; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAETQ1Ljc2LjI1NC4yMzo4NDQzIHHxMKWw7d3RI8gNOP1VunwdmKG9ueWDg2Nk6-dp-txKJzIuZG5zY3J5cHQtY2VydC5kbnMudmFuZ3VhcmRpdC5zZXJ2aWNlcw

## us-ga-ns4-ipv6
operator: Vanguard IT services; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAALVsyMDAxOjE5ZjA6NTQwMToyYTRhOjU0MDA6M2ZmOmZlMmI6MjcxZl06ODQ0MyBx8TClsO3d0SPIDTj9Vbp8HZihvbnlg4NjZOvnafrcSicyLmRuc2NyeXB0LWNlcnQuZG5zLnZhbmd1YXJkaXQuc2VydmljZXM



not working, servers.opennic.org agrees:

## ca-ns3-ipv6
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAAIVsyNjA3OjUzMDA6MTIwOmE4YToxNDI6NDoyMDQ6MTExXSAcGXkzG-gjzM8ImnkGk35cNBAqVqx_YnDgRiWy7dsE4x8yLmRuc2NyeXB0LWNlcnQubnMzLmNhLmx1Z2dzLmNv

## ca-ns4-ipv6
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAAIFsyNjA3OjUzMDA6MTIwOmE4YToxNDI6NDoyMDU6NDddILy_t-BQwT2iQiwAsLGsmtZIxcJkvLYXC4g9cYrIbroJHzIuZG5zY3J5cHQtY2VydC5uczQuY2EubHVnZ3MuY28

## mx-ns6-ipv6
operator: Rico4541; dnssec: no; logging: no; filtering: no
same provider details as ca-ns3, different operator

sdns://AQYAAAAAAAAAIVsyNjA3OjUzMDA6MTIwOmE4YToxNDI6NDoyMDQ6MTExXSAcGXkzG-gjzM8ImnkGk35cNBAqVqx_YnDgRiWy7dsE4x8yLmRuc2NyeXB0LWNlcnQubnMzLmNhLmx1Z2dzLmNv



working, servers.opennic.org disagrees:

## ca-ns3-ipv4
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAADTE0Mi40LjIwNC4xMTEgHBl5MxvoI8zPCJp5BpN-XDQQKlasf2Jw4EYlsu3bBOMfMi5kbnNjcnlwdC1jZXJ0Lm5zMy5jYS5sdWdncy5jbw

## ca-ns4-ipv4
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAADDE0Mi40LjIwNS40NyC8v7fgUME9okIsALCxrJrWSMXCZLy2FwuIPXGKyG66CR8yLmRuc2NyeXB0LWNlcnQubnM0LmNhLmx1Z2dzLmNv

## mx-ns6-ipv4
operator: Rico4541; dnssec: no; logging: no; filtering: no
same provider details as ca-ns3, different operator

sdns://AQYAAAAAAAAADTE0Mi40LjIwNC4xMTEgHBl5MxvoI8zPCJp5BpN-XDQQKlasf2Jw4EYlsu3bBOMfMi5kbnNjcnlwdC1jZXJ0Lm5zMy5jYS5sdWdncy5jbw



working, servers.opennic.org agrees:

## de-ns21-ipv4
operator: fische; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAEDc4LjQ3LjI0My4zOjEwNTMgN4CAbUDR-b3uJJMVzfCdL9ivVV7s8wRhifLRPWBfSmQdMi5kbnNjcnlwdC1jZXJ0Lm5zMS5maXNjaGUuaW8

## de-ns21-ipv6
operator: fische; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAHFsyYTAxOjRmODoxYzBjOjgwYzk6OjFdOjEwNTMgcmZXgMxIKLKAtkLUX7t6Lhw7j4-PIqXir5hMytnM-W8dMi5kbnNjcnlwdC1jZXJ0Lm5zMS5maXNjaGUuaW8

## fr-ns8-ipv4
operator: R4SAS; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAADTE1MS44MC4yMjIuNzkgqdYyOk8lgAkmGXUVAs4jHh922d53bIfGu7KKDv_bDk4gMi5kbnNjcnlwdC1jZXJ0Lm9wZW5uaWMuaTJwZC54eXo

## fr-ns8-ipv6
operator: R4SAS; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAF1syMDAxOjQ3MDoxZjE1OmI4MDo6NTNdIKnWMjpPJYAJJhl1FQLOIx4fdtned2yHxruyig7_2w5OIDIuZG5zY3J5cHQtY2VydC5vcGVubmljLmkycGQueHl6

## us-ga-ns4-ipv4-relay
anonymised-DNSCrypt relay
operator: Vanguard IT services

sdns://gRE0NS43Ni4yNTQuMjM6ODQ0Mw

## us-ga-ns4-ipv6-relay
anonymised-DNSCrypt relay
operator: Vanguard IT services

sdns://gS1bMjAwMToxOWYwOjU0MDE6MmE0YTo1NDAwOjNmZjpmZTJiOjI3MWZdOjg0NDM
untrusted comment: signature from minisign secret key
RWTmRtLl9scj4O0mvY/Qr9VCWC3Uz3EI3LaNu0/EYiHTrsuOcNhfVb2S7LXe6X6/LYNSaFZ/mFWFEGj7G6n6+H7B6NoXfXOCtAc=
trusted comment: timestamp:1626638987   file:opennic.txt
vwmyGe3rNFlFDImmARm9NmSMNNKrIq9tH4MmWN1nuiEuy7wbWrNxdcJPk/iX8qjQmihn8yAUWSNRiCrduHEfBA==
# opennic

OpenNIC servers offering DNSCrypt that seem to be in working order as of 
18-07-2021

--


## ca-ns3-ipv4
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAADTE0Mi40LjIwNC4xMTEgHBl5MxvoI8zPCJp5BpN-XDQQKlasf2Jw4EYlsu3bBOMfMi5kbnNjcnlwdC1jZXJ0Lm5zMy5jYS5sdWdncy5jbw

## ca-ns4-ipv4
operator: luggs; dnssec: no; logging: no; filtering: allow

sdns://AQIAAAAAAAAADDE0Mi40LjIwNS40NyC8v7fgUME9okIsALCxrJrWSMXCZLy2FwuIPXGKyG66CR8yLmRuc2NyeXB0LWNlcnQubnM0LmNhLmx1Z2dzLmNv

## mx-ns6-ipv4
operator: Rico4541; dnssec: no; logging: no; filtering: no
same provider details as ca-ns3, different operator

sdns://AQYAAAAAAAAADTE0Mi40LjIwNC4xMTEgHBl5MxvoI8zPCJp5BpN-XDQQKlasf2Jw4EYlsu3bBOMfMi5kbnNjcnlwdC1jZXJ0Lm5zMy5jYS5sdWdncy5jbw

## de-ns21-ipv4
operator: fische; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAEDc4LjQ3LjI0My4zOjEwNTMgN4CAbUDR-b3uJJMVzfCdL9ivVV7s8wRhifLRPWBfSmQdMi5kbnNjcnlwdC1jZXJ0Lm5zMS5maXNjaGUuaW8

## de-ns21-ipv6
operator: fische; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAHFsyYTAxOjRmODoxYzBjOjgwYzk6OjFdOjEwNTMgcmZXgMxIKLKAtkLUX7t6Lhw7j4-PIqXir5hMytnM-W8dMi5kbnNjcnlwdC1jZXJ0Lm5zMS5maXNjaGUuaW8

## fr-ns8-ipv4
operator: R4SAS; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAADTE1MS44MC4yMjIuNzkgqdYyOk8lgAkmGXUVAs4jHh922d53bIfGu7KKDv_bDk4gMi5kbnNjcnlwdC1jZXJ0Lm9wZW5uaWMuaTJwZC54eXo

## fr-ns8-ipv6
operator: R4SAS; dnssec: yes; logging: no; filtering: no

sdns://AQcAAAAAAAAAF1syMDAxOjQ3MDoxZjE1OmI4MDo6NTNdIKnWMjpPJYAJJhl1FQLOIx4fdtned2yHxruyig7_2w5OIDIuZG5zY3J5cHQtY2VydC5vcGVubmljLmkycGQueHl6

## us-ga-ns4-ipv4-relay
anonymised-DNSCrypt relay
operator: Vanguard IT services

sdns://gRE0NS43Ni4yNTQuMjM6ODQ0Mw

## us-ga-ns4-ipv6-relay
anonymised-DNSCrypt relay
operator: Vanguard IT services

sdns://gS1bMjAwMToxOWYwOjU0MDE6MmE0YTo1NDAwOjNmZjpmZTJiOjI3MWZdOjg0NDM
untrusted comment: signature from minisign secret key
RWTmRtLl9scj4BStS8644b2myZSaZpNsvdHkkPdy3xZl9gIDW2xxKNLCefxB0DPkbektXhk9i8CAD0tYPoFPRqNsLzgunoGryQ4=
trusted comment: timestamp:1626639015   file:opennic-working.txt
R5LMp7zo8DwYNEvqryO6OViQRTNk3+lFBmxVpQwt0HeTjwiYhGcuLCv9Ylsf45lA4gIH1FIpDfDQLuB+lrl8Dw==