_servers switch doesn't work

Thanks for taking the time to report a bug! Before filing, please note:

Need help or have a question? The issue tracker is for confirmed, reproducible bugs only. For installation help, configuration help, troubleshooting, or general questions, please read the documentation first. If you still need assistance, use our Q&A Discussions instead - you'll likely get a faster response there.

---

Before submitting

Please make sure:

• You've read the documentation and this is not answered there already
• You're running the latest version of dnscrypt-proxy (precompiled binaries from this repository)
• The software is correctly installed and configured
• You can reliably reproduce the issue

If the bug requires specific steps to reproduce, please include detailed instructions that would work on a fresh install of macOS, Windows, OpenBSD, or Ubuntu Linux.

Not sure if it's a bug? Start a discussion first - we're happy to help figure it out.

---

Diagnostic output

Please run these commands and paste the output:

2.1.16

• I read the documentation and this is not answered there
• Initially raised as discussion #...

What's happening?

https://dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml](https://github.com/DNSCrypt/dnscrypt-proxy/blob/e7af9f2a3f9d634e6d2513b7bfa37c9682ad035b/dnscrypt-proxy/example-dnscrypt-proxy.toml#L68-L75

The following _servers are not being used - when I switch one of it to false, dnscrypt-proxy still try to connect to them to perform connection test.

Steps

Set DOH server to true, set dnscrypt server to false
Set log level to 2
Start dnscrypt-proxy config toml
Look at output

Expected Result

When I set it to false, don't connect it at all.

When does this occur?

Where does it happen?

How do we replicate the issue?

@jedisct1 Seriously, this is a BUG.

1. Make dnscrypt-proxy.toml by copy example

2. Add some servers like this:

server_names = ['cc',...]


# DNSCrypt and DOH servers' stamps below
[static]
   [static.'cc']
     stamp = 'sdns://ccccc'
...

2. Flip those _servers lines (e.g., dnscrypt false, doh true)

3. Set log level to 2 to make sure those are visible

4. run: dnscrypt-proxy -config /full/path/to/dnscrypt-proxy.toml

4. watch all servers listed in dnscrypt-proxy.toml getting tested

Expected behavior

Additional context

[welwood08]

❯ wget https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.16/dnscrypt-proxy-linux_x86_64-2.1.16.tar.gz
[snip]
❯ tar -xf dnscrypt-proxy-linux_x86_64-2.1.16.tar.gz
❯ cat > dnscrypt-proxy.toml <<EOF
server_names = ['custom']
listen_addresses = ['127.0.0.1:53000']
dnscrypt_servers = false
doh_servers = true
log_level = 2

[sources.public-resolvers]
urls = [
  'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md',
  'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md',
  'https://cdn.jsdelivr.net/gh/DNSCrypt/dnscrypt-resolvers@master/v3/public-resolvers.md'
]
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 73
prefix = ''

[static.custom]
stamp = 'sdns://AgcAAAAAAAAABzEuMC4wLjEAEmRucy5jbG91ZGZsYXJlLmNvbQovZG5zLXF1ZXJ5'
EOF
❯ linux-x86_64/dnscrypt-proxy -config ./dnscrypt-proxy.toml
[2026-07-10 00:00:00] [NOTICE] dnscrypt-proxy 2.1.16
[2026-07-10 00:00:00] [NOTICE] Using default Weighted Power of Two (WP2) load balancing strategy
[2026-07-10 00:00:00] [NOTICE] Network connectivity detected
[2026-07-10 00:00:00] [NOTICE] Now listening to 127.0.0.1:53000 [UDP]
[2026-07-10 00:00:00] [NOTICE] Now listening to 127.0.0.1:53000 [TCP]
[2026-07-10 00:00:01] [NOTICE] Source [public-resolvers] loaded
[2026-07-10 00:00:01] [NOTICE] Firefox workaround initialized
[2026-07-10 00:00:01] [NOTICE] Hot reload is disabled
[2026-07-10 00:00:01] [NOTICE] [custom] OK (DoH) - rtt: 5ms
[2026-07-10 00:00:01] [NOTICE] Server with the lowest initial latency: custom (rtt: 5ms), live servers: 1
^C[2026-07-10 00:00:30] [NOTICE] Stopped.

Since you didn't provide unambiguous steps to reproduce or the .toml file you used, the above was my attempt to follow along. Seems working to me.

[jedisct1]

Filters are part of the server sources configuration. They only apply to servers coming from a source.

Static entries are always available. Useful to add you own servers, that can be exceptions to the rules.

Not a bug, code was written specifically so it works that way :)

@jedisct1

Static entries are always available. Useful to add you own servers, that can be exceptions to the rules.
Not a bug, code was written specifically so it works that way :)

I use my own script to update TOML's [static]s because I fetch/generate dnsstamps from multiple sources.

I expected dnscrypt-proxy to obey _servers and filter booleans to filter out unnecessary servers.

You could filter out poer user's configuration options and simply display:
[2026-07-10 00:00:01] [NOTICE] [custom] SKIP (DoH) - Skipped by user config

or add new config option:
force_filter_options_on_static_also = true

One thing I cannot use sources. is that it cannot use non-dnsstamps like DOH's full URL.
This is why I NEED to use my script to generate stamps & update TOML by myself.

Those filters should be applied to statics too.

[welwood08]

I'm not sure why you have dismissed sources. A source file is essentially just a list of stamps, which as you say, you are already generating with a script. I think you can achieve the filtration you want by generating your own source file filled with exactly the stamps you want and sign it with your own minisign key. An advantage of doing it this way is the stamps are no longer static, and can be updated at runtime.