[kqr]

Good suggestion. I sandwhich Dnsmasq between applications and dnscrypt-proxy[1] because the opennic anycast servers were too slow otherwise.

[1]: https://two-wrongs.com/secure-dns-on-a-laptop-with-debian.ht...