Some plain old DNS resolvers may only support UDP

[lessload]

What is affected by this bug?

dnscrypt-proxy 2.0.45 when config force_tcp = true

When does this occur?

All config in Forwarding rules will fail (because dns server not support TCP port 53 ?)
as i saw in firewall dnscrypt-proxy try send TCP 53 to dns server but fail.

Expected behavior (i.e. solution)

dnscrypt-proxy should have force_tcp = true two config setting, One for dnscrypt connection, Two for forwarding rule to use normal UDP port 53.

[jedisct1]

When force_tcp is set to true, connections to upstream resolvers are sent over TCP.

While not impossible, it would be very surprising that your router (I assume the upstream you are forwarding to is your router) doesn't support DNS queries over TCP. This completely prevents some names from being resolved properly.

Since you are referring to a firewall, check that it doesn't have a rule that only allows outgoing connections for port 53 over UDP. TCP should be allowed as well.

[lessload]

from test 8.8.8.8 TCP53 work fine but dns server that i use seem like they only work on UPD53 (seem like drop TCP53).
temporary fix by change dns server.
Why not seperate config?

[ianbashford]

That sounds frustrating... a couple of observations:
The test to 8.8.8.8 will test that the outgoing firewall isn't blocking port 53 TCP, but the router itself might be. If it's linux like, then running netstat -nlp might tell you if it's listening on both (or the web ui), otherwise it might be worth hunting down a manual or checking forums for that router to see if others report the problem.
Is there a specific reason to use force_tcp in dnscrypt-proxy if the forwarding target doesn't support it? It sounds like it might work if the query could start with UDP... if you could explain the use case a little then it might help us help better.

[lessload]

Found the same ploblem again on some public wifi, that i try to forward portal.login.page.com to 10.x.x.x and it not work when use force_tcp = true. it work fine with config force_tcp = false.