Is my config correct? Best practices when using Anonymized DNS.

[CluelessTechnologist]

I'm worried I have misunderstood how to configure Anonymized DNS. Does this look correct to you?
Most of the examples I saw had hard coded server_names but I don't want that. I'd like to hard code as little as possible. I did read in the documentation that hard coding anonymized routes was better for privacy so that's why I hard coded those.

# Empty listen_addresses to use systemd socket activation
listen_addresses = ['0.0.0.0:53']
#server_names = ['']
disabled_server_names = ['anon-cs-belgium', 'anon-cs-fr']

require_dnssec = true
require_nolog = true
require_nofilter = true
dnscrypt_servers = true
doh_servers = false
#odoh_servers = false

cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600

[blocked_names]
  blocked_names_file = '/etc/blocklist.txt'
  log_file = '/var/log/dnscrypt-proxy/blocked-names.log'

[blocked_ips]
  blocked_ips_file = '/etc/blocked-ips.txt'
  log_file = '/var/log/dnscrypt-proxy/blocked-ips.log'

[allowed_names]
  allowed_names_file = '/etc/allowed-names.txt'
  log_file = '/var/log/dnscrypt-proxy/allowed-names.log'

[query_log]
  file = '/var/log/dnscrypt-proxy/query.log'

[nx_log]
  file = '/var/log/dnscrypt-proxy/nx.log'

[sources]
  [sources.'public-resolvers']
  url = 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md'
  cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 72
  prefix = ''

  [sources.relays]
    urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md']
    cache_file = '/var/cache/dnscrypt-proxy/relays.md'
    minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
    refresh_delay = 72
    prefix = ''

[anonymized_dns]

routes = [
   { server_name='*', via=['anon-cs-belgium', 'anon-cs-fr'] }
]

skip_incompatible = true

[jedisct1]

Looks fine to me, although the cs servers and relays have shown to not be very reliable.

disabled_server_names = ['anon-cs-belgium', 'anon-cs-fr']

That line does nothing, though. There are no servers called anon-cs-belgium or anon-cs-fr since these names refer to relays, not servers.

And dnscrypt-proxy will already automatically try to avoid using e.g. anon-cs-belgium as a relay for cs-belgium.

[CluelessTechnologist]

Yeah that's why I hate hard coding, I didn't even know the cs servers were unreliable. Would it help to put in more servers or will it stop working if one of the relays stop working?

What about using wild card instead of hard coding?

[anonymized_dns]

routes = [
   { server_name='*', via=['*'] }
]

Would that make sense?