Heads up: Quad9 signing key has changed

[jedisct1]

Quad9 are publishing resolvers lists on their website and on GitHub: https://github.com/Quad9DNS/dnscrypt-settings

If you're using the DNSCrypt public list of resolvers, you don't need to use them, as the Quad9 resolvers are already included.

But if you are fetching the Quad9 lists from them directly, you may have seen issues related to signatures since yesterday.

They changed the signing key: Quad9DNS/dnscrypt-settings#7

So, the following changes are required to your dnscrypt-proxy configuration file:

Replace: minisign_key = "RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN"

With: minisign_key = "RWTp2E4t64BrL651lEiDLNon+DqzPG4jhZ97pfdNkcq1VDdocLKvl5FW"

[AndLLA]

Hello,
that does not seem to work in dnscrypt-proxy, because it causes a "Invalid Signature Algorithm" error

Config:
[sources.quad9-resolvers]
urls = ["https://quad9.net/dnscrypt/quad9-resolvers.md", "https://raw.githubusercontent.com/Quad9DNS/dnscrypt-settings/main/dnscrypt/quad9-resolvers.md"]
minisign_key = "RWTp2E4t64BrL651lEiDLNon+DqzPG4jhZ97pfdNkcq1VDdocLKvl5FW"
cache_file = "quad9-resolvers.md"
refresh_delay = 72
prefix = "quad9-"

Command Line:
dnscrypt-proxy -show-certs -config dnscrypt-proxy.toml

Log:
[2024-08-07 13:15:46] [NOTICE] dnscrypt-proxy 2.1.5
[2024-08-07 13:15:46] [NOTICE] Service is not usable yet
[2024-08-07 13:15:46] [NOTICE] Resolving server host [raw.githubusercontent.com] using bootstrap resolvers over udp
[2024-08-07 13:15:46] [NOTICE] Service is not usable yet
[2024-08-07 13:15:46] [NOTICE] Resolving server host [quad9.net] using bootstrap resolvers over udp
[2024-08-07 13:15:47] [CRITICAL] Unable to retrieve source [quad9-resolvers]: [Incompatible signature algorithm]
[2024-08-07 13:15:47] [FATAL] Incompatible signature algorithm

[Bad3r]

source: https://quad9.net/dnscrypt/quad9-resolvers.md