Make pqdnscrypt a setting

Author: jedisct1

dnscrypt-proxy/config.go

@@ -42,6 +42,7 @@ type Config struct {
 	CertRefreshConcurrency   int                `toml:"cert_refresh_concurrency"`
 	CertRefreshDelay         int                `toml:"cert_refresh_delay"`
 	CertIgnoreTimestamp      bool               `toml:"cert_ignore_timestamp"`
+	PQDNSCrypt               bool               `toml:"pqdnscrypt"`
 	EphemeralKeys            bool               `toml:"dnscrypt_ephemeral_keys"`
 	LBStrategy               string             `toml:"lb_strategy"`
 	LBEstimator              bool               `toml:"lb_estimator"`
@@ -131,6 +132,7 @@ func newConfig() Config {
 		HTTP3:                    false,
 		HTTP3Probe:               false,
 		CertIgnoreTimestamp:      false,
+		PQDNSCrypt:               true,
 		EphemeralKeys:            false,
 		Cache:                    true,
 		CacheSize:                512,

dnscrypt-proxy/config_loader.go

@@ -191,6 +191,7 @@ func configureServerParams(proxy *Proxy, config *Config) {
 	proxy.certRefreshDelay = time.Duration(Max(60, config.CertRefreshDelay)) * time.Minute
 	proxy.certRefreshDelayAfterFailure = 10 * time.Second
 	proxy.certIgnoreTimestamp = config.CertIgnoreTimestamp
+	proxy.pqDNSCrypt = config.PQDNSCrypt
 	proxy.ephemeralKeys = config.EphemeralKeys
 	proxy.monitoringUI = config.MonitoringUI
 }

dnscrypt-proxy/dnscrypt_certs.go

@@ -121,6 +121,10 @@ func FetchCurrentDNSCryptCert(
 			continue
 		}
 		isPQ := cryptoConstruction == XWingPQ
+		if isPQ && !proxy.pqDNSCrypt {
+			dlog.Debugf("[%v] ignoring post-quantum certificate, disabled in the configuration", *serverName)
+			continue
+		}
 		if isPQ && len(binCert) < 1320 {
 			dlog.Warnf("[%v] PQ certificate too short", *serverName)
 			continue

dnscrypt-proxy/example-dnscrypt-proxy.toml

@@ -282,6 +282,14 @@ cert_refresh_delay = 240
 # dnscrypt_ephemeral_keys = false
 
 
+## PQDNSCrypt (DNSCrypt 2026): use post-quantum cryptography when supported
+## by the server.
+## This protects the confidentiality of your queries against future quantum
+## computers ("harvest now, decrypt later").
+
+# pqdnscrypt = true
+
+
 ## DoH: Disable TLS session tickets - increases privacy but also latency
 
 # tls_disable_session_tickets = false

dnscrypt-proxy/proxy.go

@@ -97,6 +97,7 @@ type Proxy struct {
 	ephemeralKeys                 bool
 	pluginBlockUnqualified        bool
 	showCerts                     bool
+	pqDNSCrypt                    bool
 	certIgnoreTimestamp           bool
 	skipAnonIncompatibleResolvers bool
 	anonDirectCertFallback        bool