If you are not using DHCP and want a statically configured set of default DNS resolvers, enter their IP addresses in this box.
Separate them with spaces.
When using DNSCrypt, this will block the following list of OpenDNS categories: lingerie/bikini, adult themes, nudity, pornography, proxy/anonymizer, sexuality and tasteless.
If you have an OpenDNS account and network settings defined for your current location, the network settings will override the advanced parental controls. Having an OpenDNS account allows finer granularity access controls, building reports and more.
As a tool designed to protect your privacy, the DNSCrypt proxy does not log anything about your DNS queries. Nothing about them will be saved to disk ever, and log messages are intentionally kept as generic as possible.
However, you still may want to look at the DNS queries sent by your system. This can be useful in order to spot suspicious activity and to refine your domain blacklists and whitelists.
Checking the "Log DNS queries" box dumps all DNS queries sent by your computer to a file named /var/log/dnscrypt-query.log
The "View log" button opens it with the log viewer application so that you can watch it in real time.
If you have an OpenDNS account, and OpenDNS network settings defined for your current location, you can make these persistent.
Checking this box will make the user interface remember what your current network is.
If you are roaming, the settings for this network will still be used, no matter what actual network you are connected to.
That way, you can stay protected from botnets, malware, phishing and block unwanted content, even when using public Wi-Fi hotspots.
This feature is currently not compatible with the OpenDNS IP updater. If your ISP assigns dynamic IP addresses, use either the OpenDNS IP updater or the DNSCrypt lock-in feature, but not both.
A response to a query containing at least one IP address listed here will be blocked.
This make it easy to block spam sources, hosting services and content providers using a lot of different domain names for a single service.
This can also be useful in order to block DNS rebinding attacks, even for non-private network spaces.
IP addresses can be IPv4 and IPv6 addresses, and must be separated with spaces.
This is a list of domain names to be blocked.
It doesn't affect your OpenDNS network settings. This is a local blacklist, applied in addition to your OpenDNS settings.
"example.com" will only match this specific name, not "www.example.com".
But wildcards are also supported. "*.example.com" will match any name ending with ".example.com" whereas "ads.*" will match any name beginning with "ads."
Wildcards can also perform substring matching. "*xxx*" will match any name containing the string "xxx".
Patterns to be blocked should be separated with spaces, and the blocking takes effect immediately after you hit the Return key. Flushing your DNS cache is not required.
This feature is only enabled when using DNSCrypt.
Some domain names should not be resolved by a third-party DNS resolver, that may not know about them.
This includes local domain names provided by home routers (like "routerlogin.net"), local domain names provided by operating systems and applications (like ".local" or ".lan"), local domain names served by appliances like st-top boxes, and internal domains used in corporate networks.
Domains listed here will bypass DNSCrypt in order to be sent to the default resolvers.
Do not use a tool like hostip(8), drill(1), unbound-host(1), dig(1) or host(1) in order to check that an exception rule works.
These tools use their own resolution mechanisms that have nothing to do with how others apps on your system are resolving names.
They don't use the OSX-specific stub resolver, they don't use the system-wide DNS cache, they have bugs and limitations that the OS doesn't have (and the opposite is also true), and they don't know a thing about specific resolvers that have to be used for specific domains.
Use actual apps, or even a command like ping(8).