dnscrypt-proxy - Do not edit "/usr/lib/systemd/system/dnscrypt-proxy.socket" because an update might overwrite this!

[EyBmY]

https://docs.pi-hole.net/guides/dns/dnscrypt-proxy/

In this Pi-hole installation documentation, the user is told to edit /usr/lib/systemd/system/dnscrypt-proxy.socket and make the following changes for dnscrypt-proxy listening to Pi-hole's DNS requests:

ListenStream=127.0.0.1:5053
ListenDatagram=127.0.0.1:5053

This is a bad idea as this YouTube video about Systemd units shows:

https://youtu.be/Kzpm-rGAXos?t=1240

Any Systemd unit placed in /usr/lib/systemd/system/ was likely placed by installing a package, and will be overwritten if the package receives an update. This will break any configuration the user put there.

Instead the user should be told to either copy /usr/lib/systemd/system/dnscrypt-proxy.socket to /etc/systemd/system/dnscrypt-proxy.socket and make their changes there, where they will take higher priority and not be affected by changes inside /usr/lib/systemd/system/dnscrypt-proxy.socket or use the systemctl edit dnscrypt-proxy.socket command to use an override file.

That way even when DNSCrypt receives an update which changes the Systemd units. The user configuration remains untouched.

[EyBmY]

I was unable to correctly use an override file with the Systemd unit. For me it failed with:

Feb 09 14:05:35 server systemd[1]: dnscrypt-proxy.service: Job dnscrypt-proxy.service/start failed with result 'dependency'.

So I will do a merge request in where the user will be told to simply cp /usr/lib/systemd/system/dnscrypt-proxy.socket /etc/systemd/system/ and then make their changes to /etc/systemd/system/dnscrypt-proxy.socket instead.

Unless somebody knows how to use the systemctl edit dnscrypt-proxy.socket command properly and wants to improve on my approach, this will be the way for now...

[darkexplosiveqwx]

What kind of override file did you try?

I am on Ubuntu 24.04 LTS and systemd version 255.4-1ubuntu8.12.

This is how I used an override file:

Before:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.2.1:53 (Stream)
Listen=127.0.2.1:53 (Datagram)

After:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.0.1:5053 (Stream)
Listen=127.0.0.1:5053 (Datagram)

The file:

$ cat /etc/systemd/system/dnscrypt-proxy.socket.d/override.conf
[Socket]
ListenStream=
ListenDatagram=
ListenStream=127.0.0.1:5053
ListenDatagram=127.0.0.1:5053

After daemon-reload and explicitly restarting .service and .socket:

$ systemctl status dnscrypt-proxy.service dnscrypt-proxy.socket 
● dnscrypt-proxy.service - DNSCrypt client proxy
     Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-02-09 16:53:29 CET; 19s ago
TriggeredBy: ● dnscrypt-proxy.socket
       Docs: https://github.com/DNSCrypt/dnscrypt-proxy/wiki
   Main PID: 9787 (dnscrypt-proxy)
      Tasks: 12 (limit: 16512)
     Memory: 5.6M (peak: 8.7M)
        CPU: 110ms
     CGroup: /system.slice/dnscrypt-proxy.service
             └─9787 /usr/sbin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] dnscrypt-proxy 2.0.45
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Network connectivity detected
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [WARNING] Systemd sockets are untested and unsupported - use at your own risk
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Wiring systemd TCP socket #0, dnscrypt-proxy.socket, 127.0.0.1:5053
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Wiring systemd UDP socket #1, dnscrypt-proxy.socket, 127.0.0.1:5053
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Source [public-resolvers] loaded
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Firefox workaround initialized
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] [cloudflare] OK (DoH) - rtt: 21ms
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Server with the lowest initial latency: cloudflare (rtt: 21ms)
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] dnscrypt-proxy is ready - live servers: 1

● dnscrypt-proxy.socket - dnscrypt-proxy listening socket
     Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.socket; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/dnscrypt-proxy.socket.d
             └─override.conf
     Active: active (running) since Mon 2026-02-09 16:53:29 CET; 19s ago
   Triggers: ● dnscrypt-proxy.service
       Docs: https://github.com/DNSCrypt/dnscrypt-proxy/wiki
     Listen: 127.0.0.1:5053 (Stream)
             127.0.0.1:5053 (Datagram)
      Tasks: 0 (limit: 16512)
     Memory: 8.0K (peak: 268.0K)
        CPU: 2ms
     CGroup: /system.slice/dnscrypt-proxy.socket

Feb 09 16:53:29 frodo-orange systemd[1]: dnscrypt-proxy.socket: TCP_NODELAY failed: Protocol not available
Feb 09 16:53:29 frodo-orange systemd[1]: Listening on dnscrypt-proxy.socket - dnscrypt-proxy listening socket.

Note:

ListenStream=
ListenDatagram=

are needed to explicitly unset the old values.
Without them we will get:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.2.1:53 (Stream)
Listen=127.0.2.1:53 (Datagram)
Listen=127.0.0.1:5053 (Stream)
Listen=127.0.0.1:5053 (Datagram)

[EyBmY]

What kind of override file did you try?

I am on Ubuntu 24.04 LTS and systemd version 255.4-1ubuntu8.12.

This is how I used an override file:

Before:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.2.1:53 (Stream)
Listen=127.0.2.1:53 (Datagram)

After:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.0.1:5053 (Stream)
Listen=127.0.0.1:5053 (Datagram)

The file:

$ cat /etc/systemd/system/dnscrypt-proxy.socket.d/override.conf
[Socket]
ListenStream=
ListenDatagram=
ListenStream=127.0.0.1:5053
ListenDatagram=127.0.0.1:5053

After daemon-reload and explicitly restarting .service and .socket:

$ systemctl status dnscrypt-proxy.service dnscrypt-proxy.socket 
● dnscrypt-proxy.service - DNSCrypt client proxy
     Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; preset: enabled)
     Active: active (running) since Mon 2026-02-09 16:53:29 CET; 19s ago
TriggeredBy: ● dnscrypt-proxy.socket
       Docs: https://github.com/DNSCrypt/dnscrypt-proxy/wiki
   Main PID: 9787 (dnscrypt-proxy)
      Tasks: 12 (limit: 16512)
     Memory: 5.6M (peak: 8.7M)
        CPU: 110ms
     CGroup: /system.slice/dnscrypt-proxy.service
             └─9787 /usr/sbin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] dnscrypt-proxy 2.0.45
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Network connectivity detected
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [WARNING] Systemd sockets are untested and unsupported - use at your own risk
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Wiring systemd TCP socket #0, dnscrypt-proxy.socket, 127.0.0.1:5053
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Wiring systemd UDP socket #1, dnscrypt-proxy.socket, 127.0.0.1:5053
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Source [public-resolvers] loaded
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Firefox workaround initialized
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] [cloudflare] OK (DoH) - rtt: 21ms
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] Server with the lowest initial latency: cloudflare (rtt: 21ms)
Feb 09 16:53:29 frodo-orange dnscrypt-proxy[9787]: [2026-02-09 16:53:29] [NOTICE] dnscrypt-proxy is ready - live servers: 1

● dnscrypt-proxy.socket - dnscrypt-proxy listening socket
     Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.socket; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/dnscrypt-proxy.socket.d
             └─override.conf
     Active: active (running) since Mon 2026-02-09 16:53:29 CET; 19s ago
   Triggers: ● dnscrypt-proxy.service
       Docs: https://github.com/DNSCrypt/dnscrypt-proxy/wiki
     Listen: 127.0.0.1:5053 (Stream)
             127.0.0.1:5053 (Datagram)
      Tasks: 0 (limit: 16512)
     Memory: 8.0K (peak: 268.0K)
        CPU: 2ms
     CGroup: /system.slice/dnscrypt-proxy.socket

Feb 09 16:53:29 frodo-orange systemd[1]: dnscrypt-proxy.socket: TCP_NODELAY failed: Protocol not available
Feb 09 16:53:29 frodo-orange systemd[1]: Listening on dnscrypt-proxy.socket - dnscrypt-proxy listening socket.

Note:

ListenStream=
ListenDatagram=

are needed to explicitly unset the old values. Without them we will get:

$ systemctl show dnscrypt-proxy.socket | grep Listen
Listen=127.0.2.1:53 (Stream)
Listen=127.0.2.1:53 (Datagram)
Listen=127.0.0.1:5053 (Stream)
Listen=127.0.0.1:5053 (Datagram)

I tried to edit the .socket unit file with systemctl edit dnscrypt-proxy.socket.

This is the way I tried to override the unit:

### Editing /etc/systemd/system/dnscrypt-proxy.socket.d/override.conf
### Anything between here and the comment below will become the contents of the drop-in file

[Socket]
ListenStream=127.0.0.1:5053
ListenDatagram=127.0.0.1:5053


### Edits below this comment will be discarded


### /usr/lib/systemd/system/dnscrypt-proxy.socket
# [Unit]
# Description=dnscrypt-proxy listening socket
# Documentation=https://github.com/DNSCrypt/dnscrypt-proxy/wiki
# Before=nss-lookup.target
# Wants=nss-lookup.target
# Wants=dnscrypt-proxy-resolvconf.service
# 
# [Socket]
# ListenStream=127.0.2.1:53
# ListenDatagram=127.0.2.1:53
# NoDelay=true
# DeferAcceptSec=1
# 
# [Install]
# WantedBy=sockets.target

But using that approach makes the socket unit fail to start with the above mentioned error. The only way I could get it to work is by copying the socket unit to /etc/systemd/... and edit it there.

[darkexplosiveqwx]

Note that for correct behavior, you should clear ListenStream and ListenDatagram before you assign another value. See the Note: in my first post.

Otherwise dnscrypt-proxy will try to bind to port 53, which is likely already taken up by pihole-FTL and fail.

It should be:

### Editing /etc/systemd/system/dnscrypt-proxy.socket.d/override.conf
### Anything between here and the comment below will become the contents of the drop-in file

[Socket]
ListenStream=
ListenDatagram=
ListenStream=127.0.0.1:5053
ListenDatagram=127.0.0.1:5053

### Edits below this comment will be discarded

[EyBmY]

Ah, I didn't know that you had to unset the values first by giving them no value and then assigning new values. That's what my issue was. I have been used to systemd but there are still areas where my knowledge is limited.

Now it works for me too.

I will retreat my merge request then and do another one to tell the user to use an override file. That way their changes take highest priority in Systemd and will not be overwritten by DNSCrypt updates.

[yubiuser]

Fixed with #1343