If you are not using DHCP and want a statically configured set of default DNS resolvers, enter their IP addresses in this box.
Separate them with spaces.
As a tool designed to protect your privacy, the DNSCrypt proxy does not log anything about your DNS queries. Nothing about them will be saved to disk ever, and log messages are intentionally kept as generic as possible.
However, you still may want to look at the DNS queries sent by your system. This can be useful in order to spot suspicious activity and to refine your domain blacklists and whitelists.
Checking the "Log DNS queries" box dumps all DNS queries sent by your computer to a file named /var/log/dnscrypt-query.log
The "View log" button opens it with the log viewer application so that you can watch it in real time.
A response to a query containing at least one IP address listed here will be blocked.
This make it easy to block spam sources, hosting services and content providers using a lot of different domain names for a single service.
This can also be useful in order to block DNS rebinding attacks, even for non-private network spaces.
IP addresses can be IPv4 and IPv6 addresses, and must be separated with spaces.
This is a list of domain names to be blocked.
"example.com" will only match this specific name, not "www.example.com".
But wildcards are also supported. "*.example.com" will match any name ending with ".example.com" whereas "ads.*" will match any name beginning with "ads."
Wildcards can also perform substring matching. "*xxx*" will match any name containing the string "xxx".
Patterns to be blocked should be separated with spaces, and the blocking takes effect immediately after you hit the Return key. Flushing your DNS cache is not required.
This feature is only enabled when using DNSCrypt.
Some domain names should not be resolved by a third-party DNS resolver, that may not know about them.
This includes local domain names provided by home routers (like "routerlogin.net"), local domain names provided by operating systems and applications (like ".local" or ".lan"), local domain names served by appliances like st-top boxes, and internal domains used in corporate networks.
Domains listed here will bypass DNSCrypt in order to be sent to the default resolvers.
Do not use a tool like hostip(8), drill(1), unbound-host(1), dig(1) or host(1) in order to check that an exception rule works.
These tools use their own resolution mechanisms that have nothing to do with how others apps on your system are resolving names.
They don't use the OSX-specific stub resolver, they don't use the system-wide DNS cache, they have bugs and limitations that the OS doesn't have (and the opposite is also true), and they don't know a thing about specific resolvers that have to be used for specific domains.
Use actual apps, or even a command like ping(8).