Probably because it was a pain in the ass when I used to do it in systemd. Now I don't have to worry about tuning dns over https in any of my browsers. Here is a guide for dinit. you can likely just do all the same steps with your inits package instead like dnscrypt-proxy-runit etc.
# System-wide Mullvad DNS (DoH) on Artix Linux (dinit) This sets up `dnscrypt-proxy` to route all system DNS through Mullvad's base-filtered DNS-over-HTTPS endpoint, using dinit as the service manager and `doas or sudo` for privilege escalation — no systemd required. --- ## 1. Install the dinit-flavored package Artix ships init-system-specific packages for daemons. For dnscrypt-proxy, that's `dnscrypt-proxy-dinit`, which pulls in `dnscrypt-proxy` itself as a dependency and installs a ready-made dinit service file at `/etc/dinit.d/dnscrypt-proxy`. doas or sudo pacman -S dnscrypt-proxy-dinit ``` --- ## 2. Configure `/etc/dnscrypt-proxy/dnscrypt-proxy.toml` Open the config: doas or sudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.toml ``` Two changes from the stock file: **Set the server to Mullvad's base filter:** ```toml server_names = ['mullvad-base-doh'] ``` **Confirm the listen address is set to loopback:** ```toml listen_addresses = ['127.0.0.1:53'] ``` This should already be the default in the stock config — just confirm it wasn't changed. The `[sources.public-resolvers]` block should already be present and uncommented by default, pointing at the signed, minisign-verified DNSCrypt/DoH resolver list. No changes needed there — this is what lets dnscrypt-proxy resolve the name `mullvad-base-doh` to a real, verified server. --- ## 3. Enable and start the service via dinit Unlike systemd's `systemctl enable --now`, dinit uses `dinitctl`: doas or sudo dinitctl enable dnscrypt-proxy doas or sudo dinitctl start dnscrypt-proxy Check status: doas or sudo dinitctl status dnscrypt-proxy You want to see it listed as **started**. Check the logs if it doesn't come up — dnscrypt-proxy logs to `/var/log/dnscrypt-proxy/dnscrypt-proxy.log` by default, or check the system log depending on your logging setup (e.g. `doas or sudo tail -50 /var/log/dnscrypt-proxy/dnscrypt-proxy.log`). You should see a line like: ``` [NOTICE] [mullvad-base-doh] OK (DoH) - rtt: XXXms ``` confirming it connected successfully. --- ## 4. Point the system resolver at it This is where Artix is actually **simpler** than the systemd/CachyOS case — Artix has no `systemd-resolved` fighting for port 53 or hijacking `/etc/resolv.conf`. How you proceed depends on what's managing your network: ### If you use NetworkManager nmcli connection show Find your active connection name, then: doas or sudo nmcli connection modify "<connection-name>" ipv4.dns "127.0.0.1" doas or sudo nmcli connection modify "<connection-name>" ipv4.ignore-auto-dns yes doas or sudo nmcli connection modify "<connection-name>" ipv6.ignore-auto-dns yes doas or sudo nmcli connection up "<connection-name>" Since there's no systemd-resolved on this box, NetworkManager will write directly to `/etc/resolv.conf` ### If you use dhcpcd, netctl, or manage resolv.conf manually Edit `/etc/resolv.conf` directly: doas or sudo nano /etc/resolv.conf Set it to: nameserver 127.0.0.1 If your network manager tends to overwrite this file on reconnect (common with dhcpcd unless configured otherwise), you may need to add a `resolvconf`-based hook or set `nohook resolv.conf` in `dhcpcd.conf` to keep this pinned. Let me know which network manager you're actually running here and I can give exact steps. --- ## 5. Verify cat /etc/resolv.conf dig archlinux.org You should see `nameserver 127.0.0.1` and a fast, successful resolution. Then check for leaks in a browser: - Visit **https://browserleaks.com/dns** - You should see DNS servers belonging to **M247 Europe SRL** (part of Mullvad's infrastructure) — **not** your actual ISP. If you use Firefox on this system, make sure its built-in DNS-over-HTTPS is set to **Off** (`about:preferences` → Network Settings → DNS over HTTPS → "Off — Use your default DNS resolver"), so Firefox doesn't bypass your system resolver with its own separate DoH provider. --- ## Key differences from the systemd setup | Task | systemd | dinit (Artix) | |---|---|---| | Install | `pacman -S dnscrypt-proxy` (manual unit config) | `pacman -S dnscrypt-proxy-dinit` (ships ready service) | | Enable + start | `systemctl enable --now dnscrypt-proxy` | `dinitctl enable dnscrypt-proxy` + `dinitctl start dnscrypt-proxy` | | Check status | `systemctl status dnscrypt-proxy` | `dinitctl status dnscrypt-proxy` | | Check logs | `journalctl -u dnscrypt-proxy` | `/var/log/dnscrypt-proxy/dnscrypt-proxy.log` or your syslog daemon | | Privilege escalation | `sudo` | `doas or sudo` | | DNS backend conflict | `systemd-resolved` fights for port 53 and `/etc/resolv.conf` | No conflict — nothing else claims port 53 by default | --- # System-wide Mullvad DNS (DoH) on Artix Linux (dinit) This sets up `dnscrypt-proxy` to route all system DNS through Mullvad's base-filtered DNS-over-HTTPS endpoint, using dinit as the service manager and `doas or sudo` for privilege escalation --- ## 1. Install the dinit-flavored package Artix ships init-system-specific packages for daemons. For dnscrypt-proxy, that's `dnscrypt-proxy-dinit`, which pulls in `dnscrypt-proxy` itself as a dependency and installs a ready-made dinit service file at `/etc/dinit.d/dnscrypt-proxy`. doas or sudo pacman -S dnscrypt-proxy-dinit ``` --- ## 2. Configure `/etc/dnscrypt-proxy/dnscrypt-proxy.toml` Open the config: doas or sudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.toml ``` Two changes from the stock file: **Set the server to Mullvad's base filter:** ```toml server_names = ['mullvad-base-doh'] ``` **Confirm the listen address is set to loopback:** ```toml listen_addresses = ['127.0.0.1:53'] ``` This should already be the default in the stock config — just confirm it wasn't changed. The `[sources.public-resolvers]` block should already be present and uncommented by default, pointing at the signed, minisign-verified DNSCrypt/DoH resolver list. No changes needed there — this is what lets dnscrypt-proxy resolve the name `mullvad-base-doh` to a real, verified server. --- ## 3. Enable and start the service via dinit Unlike systemd's `systemctl enable --now`, dinit uses `dinitctl`: doas or sudo dinitctl enable dnscrypt-proxy doas or sudo dinitctl start dnscrypt-proxy Check status: dinitctl status dnscrypt-proxy You want to see it listed as **started**. Check the logs if it doesn't come up — dnscrypt-proxy logs to `/var/log/dnscrypt-proxy/dnscrypt-proxy.log` by default, or check the system log depending on your logging setup (e.g. `doas or sudo tail -50 /var/log/dnscrypt-proxy/dnscrypt-proxy.log`). You should see a line like: ``` [NOTICE] [mullvad-base-doh] OK (DoH) - rtt: XXXms ``` confirming it connected successfully. --- ## 4. Point the system resolver at it This is where Artix is actually **simpler** than the systemd/CachyOS case — Artix has no `systemd-resolved` fighting for port 53 or hijacking `/etc/resolv.conf`. How you proceed depends on what's managing your network: ### If you use NetworkManager nmcli connection show Find your active connection name, then: doas or sudo nmcli connection modify "<connection-name>" ipv4.dns "127.0.0.1" doas or sudo nmcli connection modify "<connection-name>" ipv4.ignore-auto-dns yes doas or sudo nmcli connection modify "<connection-name>" ipv6.ignore-auto-dns yes doas or sudo nmcli connection up "<connection-name>" Since there's no systemd-resolved on this box, NetworkManager will write directly to `/etc/resolv.conf` ### If you use dhcpcd, netctl, or manage resolv.conf manually Edit `/etc/resolv.conf` directly: doas or sudo nano /etc/resolv.conf Set it to: nameserver 127.0.0.1 If your network manager tends to overwrite this file on reconnect (common with dhcpcd unless configured otherwise), you may need to add a `resolvconf`-based hook or set `nohook resolv.conf` in `dhcpcd.conf` to keep this pinned. Let me know which network manager you're actually running here and I can give exact steps. --- ## 5. Verify cat /etc/resolv.conf dig archlinux.org You should see `nameserver 127.0.0.1` and a fast, successful resolution. Then check for leaks in a browser: - Visit **https://browserleaks.com/dns** - You should see DNS servers belonging to **M247 Europe SRL** (part of Mullvad's infrastructure) — **not** your actual ISP. If you use Firefox on this system, make sure its built-in DNS-over-HTTPS is set to **Off** (`about:preferences` → Network Settings → DNS over HTTPS → "Off — Use your default DNS resolver"), so Firefox doesn't bypass your system resolver with its own separate DoH provider. 
Source: r/artixlinux · by /u/talksickwalkquick