what does =duckduckgo.com in cloaking do..

[bcookatpcsd]

❯ drill -Q www.duckduckgo.com @10.120.48.247
duckduckgo.com.
52.149.247.1

/etc/dnscrypt-proxy master*
❯ drill -Q blah.duckduckgo.com @10.120.48.247

[2025-01-17 09:52:39]   ::1     www.duckduckgo.com      A       PASS    5ms     quad9-doh-ip4-port443-nofilter-pri
[2025-01-17 09:52:39]   ::1     safe.duckduckgo.com     A       PASS    4ms     quad9-dnscrypt-ip4-nofilter-pri
[2025-01-17 09:52:39]   ::1     safe.duckduckgo.com     AAAA    SYNTH   0ms     -
[2025-01-17 09:52:39]   ::1     duckduckgo.com  A       CLOAK   5ms     -
[2025-01-17 09:52:55]   ::1     blah.duckduckgo.com     A       NXDOMAIN        5ms     quad9-doh-ip4-port443-nofilter-pri

cannot seem to figure out what this rule does:

=duckduckgo.com safe.duckduckgo.com

www.google.* forcesafesearch.google.com

this takes the wildcard and returns the ip of the entry on the right.. and does not log the query/resolution

;; ANSWER SECTION:
www.google.tld. 450     IN      A       216.239.38.120

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 1 msec
;; SERVER: 10.120.48.247
;; WHEN: Fri Jan 17 09:58:38 2025
;; MSG SIZE  rcvd: 48

and

 grep forcesafesearch /var/log/dnscrypt-proxy/query.log
[2025-01-17 08:21:13]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 08:35:23]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 08:49:34]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 09:03:44]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 09:17:54]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 09:32:04]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
[2025-01-17 09:46:15]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -
-> [2025-01-17 09:58:38]   ::1     forcesafesearch.google.com      AAAA    SYNTH   0ms     -

Thanks in advance.

[jedisct1]

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Filters#filter-patterns

[bcookatpcsd]

What was blocked?

 drill duckduckgo.com @10.120.48.247
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 34167
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; duckduckgo.com.      IN      A

;; ANSWER SECTION:
duckduckgo.com. 450     IN      A       52.149.247.1

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 7 msec
;; SERVER: 10.120.48.247
;; WHEN: Fri Jan 17 10:12:03 2025
;; MSG SIZE  rcvd: 48

logs:

[2025-01-17 10:12:03]   ::1     safe.duckduckgo.com     A       PASS    6ms     quad9-doh-ip4-port443-nofilter-pri
[2025-01-17 10:12:03]   ::1     safe.duckduckgo.com     AAAA    SYNTH   0ms     -
[2025-01-17 10:12:03]   ::1     duckduckgo.com  A       CLOAK   6ms     -

I didn't ask for safe.. but it looks like safe is what was queried (and logged)

but then duckduck.go was cloaked..

but I already was returned the A record of safe

(yes?)

(am I missing something simple? - sorry if I am)

(thank you sir..)

[jedisct1]

Nothing was blocked. You configured the proxy to resolve safe.duckduckgo.com when a query for duckduckgo.com comes in. So, when you sent a query for duckduckgo.com, safe.duckduckgo.com was resolved so that the response you get is the IP of safe.duckduckgo.com.

What doesn't make sense, though, is that the logged source IP is ::1 while you sent the query to a 10.x address.