Blacklist reaction speed

[sergeevabc]

Dear @jedisct1,
even with a relatively small blacklist (~1 MB) loaded in DNSCrypt 2.1.2 on Windows 7 x64,
I wait for a couple of seconds after executing ping someBlockedAddress.tld (e.g. zykumw.com)
before it reports Ping request could not find host zykumw.com,
whereas I expect it to report instantly.
No logging and other lists (e.g. %systemroot%\system32\drivers\etc\hosts) are used.

Why the delay?
Maybe something should be tuned in dnscrypt-proxy.toml?
Or ping is not a reliable way to measure the blacklist reaction speed?

[lifenjoiner]

Here are the differences:

No.	Time	Source	Destination	Protocol	Length	Info
28	1.816854	127.0.0.1	127.0.0.1	DNS	60	Standard query 0x1879 A zykumw.com
29	1.817132	127.0.0.1	127.0.0.1	DNS	126	Standard query response 0x1879 A zykumw.com HINFO This query has been locally blocked by dnscrypt-proxy

65	3.958121	127.0.0.1	127.0.0.1	DNS	64	Standard query 0xd572 A ads.google.com
66	3.958240	127.0.0.1	127.0.0.1	DNS	80	Standard query response 0xd572 A ads.google.com A 0.0.0.0

22	1.672133	127.0.0.1	127.0.0.1	DNS	59	Standard query 0x85fa A 003999.cc
23	1.672317	127.0.0.1	127.0.0.1	DNS	59	Standard query response 0x85fa A 003999.cc

It returns a HINFO rather than an IP nor an empty Answer.

That seems neither to be recognized by ping nor IE, on Win7; but, it is OK on Win10 22H2.

[sergeevabc]

I changed blocked_query_response from hinfo to refused in dnscrypt-proxy.toml, but it did not help, However, a:0.0.0.0 did, the delay vanished. Should I continue to use this option? Cons?

[lifenjoiner]

I think you've gotten the answer by yourself.

[sergeevabc]

@lifenjoiner, I stumbled upon the solution by accident, by playing with settings. After which I asked if this solution had any cons. Because the default setting is hinfo for some reason.

[lifenjoiner]

dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

Lines 141 to 146 in 5705b60

	## Response for blocked queries. Options are `refused`, `hinfo` (default) or
	## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
	## Using the `hinfo` option means that some responses will be lies.
	## Unfortunately, the `hinfo` option appears to be required for Android 8+
	# blocked_query_response = 'refused'

The comments have explained, and you say it works. Why not?
My local server always return IP/empty answers for blocked domains, on Windows. Cons are welcome to be reported.