Option for exclude servers

[sataevr]

At that time there is no option for exclude only some untrusted servers like Google or Yandex and leave all others and i need add all of it to "server_names =" section manually.

[Mikaela]

If server_names is empty and you set require options to true, Google and Yandex get excluded for me, but I would also like an option to exclude specific servers.

https://github.com/jedisct1/dnscrypt-proxy/blob/c52b3ef1242bd093c58ebb8f69292bee1dc1db7d/dnscrypt-proxy/example-dnscrypt-proxy.toml#L67-L76

For example there are some people vocally against Cloudflare, which with I am personally fine with, but everyone using Cloudflare results into centralization which can be undesirable especially with dnscrypt-proxy's ability to pick the fastest servers anywhere, I have only seen Cloudflare not being the fastest on three VPSes which may be sharing datacenter with soem public-resolvers.

I think Opennic also recommended not using (their own) anycast servers due to centralization, but it has been a long time since I read their documentation.

[ghost]

@Mikaela

there are some people vocally against Cloudflare

Problem with CloudFlare
General problem with Cloudflare's MITM attack on the Internet
What you can do to resist Cloudflare?

[Yinchie]

Why option to exclude? Isn't it easier just to pick and choose the servers you wish to use?

[Yinchie]

Why option to exclude? Isn't it easier just to pick and choose the servers you wish to use?

[sataevr]

Isn't it easier just to pick and choose the servers you wish to use?

I want all of them. Except couple of untrusted servers. And with load balancing and filter options i don't need to choose it manually, proxy just do it's job.

[Mikaela]

Why option to exclude? Isn't it easier just to pick and choose the servers you wish to use?

When you have empty server_names, dnscrypt-proxy will automatically attempt to pick the closest servers which can change a lot especially with mobile nodes and there is probably nothing to prevent new public resolvers from appearing close.

[Yinchie]

It doesn't matter if you are mobile. DNSCrypt proxy doesn't continuously check if another one is faster.
Also there isn't much difference if you make your own custom list which ones you prefer to use, this way it saves DNSCrypt checking hundreds of servers for which one is fastest. Another reason would be that some servers aren't as secure or using upstream dns servers you do not wish to use likr cloudflare that someone mentioned before.

I am sure you don't want to check out every single server about whether or not they can be trusted.

[Mikaela]

I should probably clarify that by mobile I mainly meant laptops that may today be in country A and tomorrow travel to country E far away where the hardcoded list for country A may be slower.

At the moment I am seeing 38 servers with my filter_options and checking them seems to only take a few seconds.

I don't think it's very likely for malicious resolver getting added to the public resolvers list and being one of the top two servers for a long period without anyone noticing.