Bitping + DNSCrypt

[engageub]

Diagnostic Output

Please run the following commands and share the output:

/proxy-dns # ./dnscrypt-proxy -version
2.1.16

/proxy-dns # ./dnscrypt-proxy --config dns-config.toml -check

/proxy-dns # ./dnscrypt-proxy --config dns-config.toml -resolve example.com
Resolving [example.com] using 127.0.0.1 port 53

Resolver      : 172.253.214.124

Canonical name: example.com.

IPv4 addresses: 172.66.147.243, 104.20.23.154
IPv6 addresses: 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a

Name servers  : elliott.ns.cloudflare.com., hera.ns.cloudflare.com.
DNSSEC signed : yes
Mail servers  : 1 mail server found

HTTPS alias   : -
HTTPS info    : [alpn]=[h2], [ipv4hint]=[104.20.23.154,172.66.147.243], [ipv6hint]=[2606:4700:10::6814:179a,2606:4700:10::ac42:93f3]

Host info     : -
TXT records   : v=spf1 -all, _k2n1y4vw3qtb4skdx9e7dxt97qrmmq9

DNS Configuration

/proxy-dns # cat dns-config.toml

listen_addresses = ['127.0.0.1:53']
server_names = ['google1', 'google2', 'cloudflare1', 'cloudflare2', 'quad9']
log_level = 6
cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
max_clients = 500

[static]
  [static.google1]
  stamp = 'sdns://AgcAAAAAAAAABzguOC40LjQABzguOC40LjQKL2Rucy1xdWVyeQ'

  [static.google2]
  stamp = 'sdns://AgcAAAAAAAAABzguOC44LjgABzguOC44LjgKL2Rucy1xdWVyeQ'

  [static.cloudflare1]
  stamp = 'sdns://AgcAAAAAAAAABzEuMS4xLjEABzEuMS4xLjEKL2Rucy1xdWVyeQ'

  [static.cloudflare2]
  stamp = 'sdns://AgcAAAAAAAAABzEuMC4wLjEABzEuMC4wLjEKL2Rucy1xdWVyeQ'

  [static.quad9]
  stamp = 'sdns://AgcAAAAAAAAABzkuOS45LjkABzkuOS45LjkKL2Rucy1xdWVyeQ'

• I have reviewed the documentation and could not find an answer to this issue.

Description

When the Bitping application is used with DNSCrypt, Hickory DNS emits warning messages indicating DNS message ID mismatches. These warnings do not occur when:

• Bitping uses the Hickory DNS client directly.
• DNS queries are sent over a direct UDP connection.
• DNSCrypt is not involved in the DNS resolution path.

This suggests a possible issue in how DNS responses are being returned to the client when DNSCrypt is used as an intermediary resolver.

Although Bitping already uses Hickory DNS (as shown in the logs), the warnings only appear when DNS traffic is routed through DNSCrypt.

Bitping Logs

2026-07-08T05:15:22.293420Z  WARN hickory_proto::udp::udp_client_stream: expected message id: 64203 got: 25223, dropped
    at /builds/uptimesv/rust-monorepo/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hickory-proto-0.24.4/src/udp/udp_client_stream.rs:356

2026-07-08T05:15:22.293543Z  WARN hickory_proto::udp::udp_client_stream: expected message id: 7649 got: 32464, dropped
    at /builds/uptimesv/rust-monorepo/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hickory-proto-0.24.4/src/udp/udp_client_stream.rs:356

2026-07-08T05:15:22.293580Z  WARN hickory_proto::udp::udp_client_stream: expected message id: 3050 got: 1574, dropped
    at /builds/uptimesv/rust-monorepo/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hickory-proto-0.24.4/src/udp/udp_client_stream.rs:356

When Does This Occur?

The issue occurs while running a Bitping node with DNS traffic redirected through DNSCrypt.

Where Does It Occur?

Bitping node application.

Steps to Reproduce

1. Download the Internet Income test branch:
   https://github.com/engageub/InternetIncome/tree/test

2. Update properties.conf:

   • Set USE_DNS_OVER_HTTPS=true
   • Set BITPING_EMAIL and BITPING_PASSWORD
   • Set USE_PROXIES=true
   • Set ENABLE_LOGS=true

3. Start the application:

   sudo bash internetIncome.sh --start

4. Monitor the Bitping Docker logs.

5. Observe the Hickory DNS warnings related to mismatched DNS message IDs.

Alternative Setup

Bitping can also be installed without Docker:

https://github.com/BitpingApp/Bitping-Node/blob/master/README.md

Expected Behavior

DNS responses returned through DNSCrypt should be handled in the same manner as responses received through direct UDP or standard Hickory DNS resolution, without generating message ID mismatch warnings.

Additional Context

The DNSCrypt proxy successfully resolves domains and passes health checks. The issue appears to be specific to the interaction between DNSCrypt and Hickory DNS, where Hickory receives responses containing unexpected DNS message IDs and subsequently drops them.

[github-actions]

This issue was automatically closed because it did not follow the issue template. We use the issue tracker exclusively for bug reports and feature additions that have been previously discussed. However, this issue appears to be a support request. Please use the discussion forums for support requests.