td0/README.md

## README.md

      
    Raw
  

              README.md
            
          
    Install & Configure


Install DNSMasq

$ brew install dnsmasq

Install DNSCrypt-proxy

$ brew install dnscrypt-proxy


Configure


/usr/local/etc/dnsmasq.conf ⬇


/Library/LaunchDaemons/homebrew.mxcl.dnscrypt-proxy.plist ⬇


/Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist ⬇


Reload dnscrypt-proxy service
$ cd /Library/LaunchDaemons/
$ sudo launchctl unload homebrew.mxcl.dnscrypt-proxy.plist && sudo launchctl load homebrew.mxcl.dnscrypt-proxy.plist


Reload dnsmasq service
$ sudo launchctl unload homebrew.mxcl.dnsmasq.plist && sudo launchctl load homebrew.mxcl.dnsmasq.plist


Set DNS IP: 127.0.0.1


Check

DNS Configuration

$ scutil --dns
...
resolver #1
  search domain[0] : openvpn
  nameserver[0] : 127.0.0.1
  flags    : Request A records, Request AAAA records
  reach    : Reachable,Local Address
...

DNSCrypt

$ nslookup -type=txt debug.opendns.com
Server:     127.0.0.1
Address:    127.0.0.1#53

Non-authoritative answer:
debug.opendns.com	text = "server 7.ams"
debug.opendns.com	text = "flags 20 0 2f4 800000000000000"
debug.opendns.com	text = "id 0"
debug.opendns.com	text = "source xxx.xxx.xxx.xxx:xxxxx"
debug.opendns.com	text = "dnscrypt enabled (xxxxxxxxxxxxxxxx)"

Authoritative answers can be found from:

Useful links:


dnsleaktest.com
dnscrypt.org
opendns.com
dnscrypt.eu


## dnscrypt-proxy.conf
######################################################
#                                                    #
#    Sample configuration file for dnscrypt-proxy    #
#                                                    #
######################################################


############## Resolver settings ##############

## [CHANGE THIS] Short name of the resolver to use
## Usually the only thing you need to change in this configuration file.
## This corresponds to the first column in the dnscrypt-resolvers.csv file.
## Alternatively, "random" (without quotes) picks a random random resolver
## accessible over IPv4, that doesn't log and supports DNSSEC.

#ResolverName random
#ResolverName d0wn-au-ns1
#ResolverName d0wn-id-ns1
#ResolverName d0wn-sg-ns1
ResolverName okturtles

## Full path to the list of available DNSCrypt resolvers (dnscrypt-resolvers.csv)
## An up-to-date list is available here:
## https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv
## and the dnscrypt-update-resolvers.sh script can be used in order to
## automatically download and verify updates.

ResolversList /usr/local/opt/dnscrypt-proxy/share/dnscrypt-proxy/dnscrypt-resolvers.csv


## Manual settings, only for a custom resolver not present in the CSV file

# ProviderName    2.dnscrypt.resolver.example
# ProviderKey     E801:B84E:A606:BFB0:BAC0:CE43:445B:B15E:BA64:B02F:A3C4:AA31:AE10:636A:0790:324D
# ResolverAddress 203.0.113.1:443


############## Process options ##############

## [NOT AVAILABLE ON WINDOWS] Run the proxy as a background process.
## Unless you are using systemd, you probably want to change this to "yes"
## after having verified that the rest of the configuration works as expected.

Daemonize no


## Write the PID number to a file

PidFile /var/run/dnscrypt-proxy.pid


## [NOT AVAILABLE ON WINDOWS] Start the process, bind the required ports, and
## run the server as a less-privileged system user.
## The value for this parameter is a user name.

User nobody


############## Network/protocol settings ##############

## Local address and port to listen to.
## A 127.0.0.x address is recommended for local use, but 0.0.0.0 or
## a specific interface address can be used on a router, or to
## configure a single machine to act as a DNS proxy for different
## devices.
## If the socket is created by systemd, the proxy cannot change the address
## using this option. You should edit systemd's dnscrypt-proxy.socket file
## instead.

LocalAddress 127.0.0.1:1553


## Cache DNS responses to avoid outgoing traffic when the same queries
## are repeated multiple times in a row.

# LocalCache on


## Creates a new key pair for every query.
## This prevents logging servers from correlating client public keys with
## IP addresses. However, this option implies extra CPU load, and is not
## very useful with trusted/non-logging servers.

# EphemeralKeys on
EphemeralKeys off


## Maximum number of active requests waiting for a response.
## Keep it reasonable relative to the expected number of clients.

# MaxActiveRequests 250


## This is the maximum payload size allowed when using the UDP protocol.
## The default is safe, and rarely needs to be changed.

# EDNSPayloadSize 1252


## Ignore the time stamps when checking the certificates
## Do not enable this option ever, unless you know that you need it.

# IgnoreTimestamps no


## Do not send queries using UDP. Only use TCP.
## Even if some resolvers mitigate this, DNS over TCP is almost always slower
## than UDP and doesn't offer additional security.
## Only enable this option if UDP doesn't work on your network.

# TCPOnly no


## Forward queries for specific domains to one or more non-DNSCrypt resolvers.
## For instance, this can be used to redirect queries for local domains to
## the router, or queries for an internal domain to an internal DNS server.
## Multiple whitespace-delimited domains and IP addresses can be specified.
## Do not enable this unless you absolutely know you need it.
## If you see useless queries to these domains, you'd better block them with
## the BlackList feature instead of sending them in clear text to the router.
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.

# Forward domains:"test private localdomain lan" to:"192.168.100.254"


############## Logging ##############

## Log the received DNS queries to a file, so you can watch in real-time what
## is happening on the network.
## The value for this parameter is a full path to the log file.
## The file name can be prefixed with ltsv: in order to store logs using the
## LTSV format (ex: ltsv:/tmp/dns-queries.log).

#QueryLogFile /tmp/dns-queries.log


## Log file to write server errors and information to.
## If you use this tool for privacy, keeping logs of any kind is usually not
## a good idea.

#LogFile /var/log/dnscrypt-proxy.log


## Don't log events with priority above this log level after the service has
## been started up. Default is 6.
## Valid values are between 0 (critical) to 7 (debug-level messages).

#LogLevel 6


## [NOT AVAILABLE ON WINDOWS] Send server logs to the syslog daemon
## Log entries can optionally be prefixed with a string.

# Syslog       off
# SyslogPrefix dnscrypt


############## Local filtering ##############

## If your network doesn't support IPv6, chances are that your
## applications are still constantly trying to resolve IPv6 addresses,
## causing unnecessary slowdowns.
## This causes the proxy to immediately reply to IPv6 requests,
## without having to send a useless request to upstream resolvers, and
## having to wait for a response.
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.

BlockIPv6 no


## Want to filter ads, malware, sensitive or inappropriate websites and
## domain names? This feature can block lists of IP addresses and names
## matching a list of patterns. The list of rules remains private, and
## the filtering process directly happens on your own network. In order
## to filter IP addresses, the list of IPs has to be put into a text
## file, with one IP address per line. Lists of domain names can also be
## blocked as well. Put the list into a text file, one domain per line.
## Domains can include wildcards (*) in order to match patterns. For
## example *sex* will match any name that contains the sex substring, and
## ads.* will match anything starting with ads. The Internet has plenty
## of free feeds of IP addresses and domain names used for malware,
## phishing and spam that you can use with this feature.
##
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.
##
## To enable, uncomment one of the following definitions:

## Block query names matching the rules stored in that file:
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt"

## Block responses whose IP addresses match IPs stored in that file:
# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt"

## Block both domain names and IP addresses:
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt"

## Same as the above + log the blocked queries in a file.
## The log file can be prefixed with ltsv: (ex: ltsv:/tmp/log.txt) in order to
## store logs using the LTSV format.
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" logfile:"/var/log/dnscrypt-blocked.log"
# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"


############## User identification ##############

## Use a client public key for identification
## By default, the client uses a randomized key pair in order to make tracking
## more difficult. This option does the opposite and uses a static key pair, so
## that DNS providers can offer premium services to queries signed with a known
## set of public keys. A client cannot decrypt the received responses without
## also knowing the secret key.
## The value for this property is the path to a file containing the secret key,
## encoded as a hexadecimal string. The corresponding public key is computed
## automatically.

# ClientKey /etc/dnscrypt-client-secret.key


############## Monitoring ##############

## Do not actually start the proxy, but check that a valid certificate can be
## retrieved from the server and that it will remain valid for the specified
## time period. The process exit code is 0 if a valid certificate can be used,
## 2 if no valid certificates can be used, 3 if a timeout occurred, and 4 if a
## currently valid certificate is going to expire before the given margin.
## Useful in a cron job to monitor your own dnscrypt-servers.
## The margin is specified in minutes.

# Test 2880


############## Recursive configuration ##############

## A configuration file can include other configuration files by inserting
## the `Include` directive anywhere (the full path required, no quotes):

# Include /etc/dnscrypt-proxy-common.conf

## dnsmasq.conf
# Configuration file for dnsmasq.
#
# Format is one option per line, legal options are the same
# as the long options legal on the command line. See
# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.

# Custom development domains
#address=/.dev/127.0.0.1
#address=/.dom/127.0.0.1

# Upstream DNSCrypt
server=127.0.0.1#1553

#user=dnsmasq
#group=

# Don't read the hostnames in /etc/hosts.
#no-hosts

# Do not go into the background at startup but otherwise run as
# normal.
keep-in-foreground

# Do not provide DHCP or TFTP on the loopback interface.
no-dhcp-interface=lo

# Only listen on the loopback interface.
listen-address=127.0.0.1

# Only bind to interfaces dnsmasq is listening on.
bind-interfaces

# Never forward addresses in the non-routed address spaces.
bogus-priv

# Don't read /etc/resolv.conf.
no-resolv

# Reject (and log) addresses from upstream nameservers which are in
# the private IP ranges. This blocks an attack where a browser behind
# a firewall is used to probe machines on the local network.
stop-dns-rebind

# Exempt 127.0.0.0/8 from rebinding checks. This address range is
# returned by realtime black hole servers, so blocking it may disable
# these services.
rebind-localhost-ok

# Never forward plain names (without a dot or domain part).
# domain-needed

# Set the cache size here. If you don't use spam blocking add-ons such
# Adblock Plus or Ghostery, you may want to increase this value as you
# will be resolving more domain names.
cache-size=16384

#no-negcache
#local-ttl=

# Pass through DNSSEC validation results from dnscrypt-proxy.
proxy-dnssec

#mx-host=maildomain.com,servermachine.com,50
#mx-target=servermachine.com
#localmx
#selfmx

# log-queries
# log-facility=/var/log/dnsmasq.log

## homebrew.mxcl.dnscrypt-proxy.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-/Apple/DTD PLIST 1.0/EN" "http:/www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>homebrew.mxcl.dnscrypt-proxy</string>
    <key>KeepAlive</key>
    <true/>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/opt/dnscrypt-proxy/sbin/dnscrypt-proxy</string>
      <string>/usr/local/etc/dnscrypt-proxy.conf</string>
    </array>
    <key>UserName</key>
    <string>root</string>
    <key>StandardErrorPath</key>
    <string>/dev/null</string>
    <key>StandardOutPath</key>
    <string>/dev/null</string>
  </dict>
</plist>

## homebrew.mxcl.dnsmasq.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>homebrew.mxcl.dnsmasq</string>
    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/opt/dnsmasq/sbin/dnsmasq</string>
      <string>--keep-in-foreground</string>
      <string>-C</string>
      <string>/usr/local/etc/dnsmasq.conf</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
  </dict>
</plist>
	######################################################
	# #
	# Sample configuration file for dnscrypt-proxy #
	# #
	######################################################


	############## Resolver settings ##############

	## [CHANGE THIS] Short name of the resolver to use
	## Usually the only thing you need to change in this configuration file.
	## This corresponds to the first column in the dnscrypt-resolvers.csv file.
	## Alternatively, "random" (without quotes) picks a random random resolver
	## accessible over IPv4, that doesn't log and supports DNSSEC.

	#ResolverName random
	#ResolverName d0wn-au-ns1
	#ResolverName d0wn-id-ns1
	#ResolverName d0wn-sg-ns1
	ResolverName okturtles

	## Full path to the list of available DNSCrypt resolvers (dnscrypt-resolvers.csv)
	## An up-to-date list is available here:
	## https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv
	## and the dnscrypt-update-resolvers.sh script can be used in order to
	## automatically download and verify updates.

	ResolversList /usr/local/opt/dnscrypt-proxy/share/dnscrypt-proxy/dnscrypt-resolvers.csv


	## Manual settings, only for a custom resolver not present in the CSV file

	# ProviderName 2.dnscrypt.resolver.example
	# ProviderKey E801:B84E:A606:BFB0:BAC0:CE43:445B:B15E:BA64:B02F:A3C4:AA31:AE10:636A:0790:324D
	# ResolverAddress 203.0.113.1:443



	############## Process options ##############

	## [NOT AVAILABLE ON WINDOWS] Run the proxy as a background process.
	## Unless you are using systemd, you probably want to change this to "yes"
	## after having verified that the rest of the configuration works as expected.

	Daemonize no


	## Write the PID number to a file

	PidFile /var/run/dnscrypt-proxy.pid


	## [NOT AVAILABLE ON WINDOWS] Start the process, bind the required ports, and
	## run the server as a less-privileged system user.
	## The value for this parameter is a user name.

	User nobody



	############## Network/protocol settings ##############

	## Local address and port to listen to.
	## A 127.0.0.x address is recommended for local use, but 0.0.0.0 or
	## a specific interface address can be used on a router, or to
	## configure a single machine to act as a DNS proxy for different
	## devices.
	## If the socket is created by systemd, the proxy cannot change the address
	## using this option. You should edit systemd's dnscrypt-proxy.socket file
	## instead.

	LocalAddress 127.0.0.1:1553


	## Cache DNS responses to avoid outgoing traffic when the same queries
	## are repeated multiple times in a row.

	# LocalCache on


	## Creates a new key pair for every query.
	## This prevents logging servers from correlating client public keys with
	## IP addresses. However, this option implies extra CPU load, and is not
	## very useful with trusted/non-logging servers.

	# EphemeralKeys on
	EphemeralKeys off


	## Maximum number of active requests waiting for a response.
	## Keep it reasonable relative to the expected number of clients.

	# MaxActiveRequests 250


	## This is the maximum payload size allowed when using the UDP protocol.
	## The default is safe, and rarely needs to be changed.

	# EDNSPayloadSize 1252


	## Ignore the time stamps when checking the certificates
	## Do not enable this option ever, unless you know that you need it.

	# IgnoreTimestamps no


	## Do not send queries using UDP. Only use TCP.
	## Even if some resolvers mitigate this, DNS over TCP is almost always slower
	## than UDP and doesn't offer additional security.
	## Only enable this option if UDP doesn't work on your network.

	# TCPOnly no


	## Forward queries for specific domains to one or more non-DNSCrypt resolvers.
	## For instance, this can be used to redirect queries for local domains to
	## the router, or queries for an internal domain to an internal DNS server.
	## Multiple whitespace-delimited domains and IP addresses can be specified.
	## Do not enable this unless you absolutely know you need it.
	## If you see useless queries to these domains, you'd better block them with
	## the BlackList feature instead of sending them in clear text to the router.
	## This uses a plugin that requires dnscrypt-proxy to be compiled with
	## the ldns library.

	# Forward domains:"test private localdomain lan" to:"192.168.100.254"


	############## Logging ##############

	## Log the received DNS queries to a file, so you can watch in real-time what
	## is happening on the network.
	## The value for this parameter is a full path to the log file.
	## The file name can be prefixed with ltsv: in order to store logs using the
	## LTSV format (ex: ltsv:/tmp/dns-queries.log).

	#QueryLogFile /tmp/dns-queries.log


	## Log file to write server errors and information to.
	## If you use this tool for privacy, keeping logs of any kind is usually not
	## a good idea.

	#LogFile /var/log/dnscrypt-proxy.log


	## Don't log events with priority above this log level after the service has
	## been started up. Default is 6.
	## Valid values are between 0 (critical) to 7 (debug-level messages).

	#LogLevel 6


	## [NOT AVAILABLE ON WINDOWS] Send server logs to the syslog daemon
	## Log entries can optionally be prefixed with a string.

	# Syslog off
	# SyslogPrefix dnscrypt



	############## Local filtering ##############

	## If your network doesn't support IPv6, chances are that your
	## applications are still constantly trying to resolve IPv6 addresses,
	## causing unnecessary slowdowns.
	## This causes the proxy to immediately reply to IPv6 requests,
	## without having to send a useless request to upstream resolvers, and
	## having to wait for a response.
	## This uses a plugin that requires dnscrypt-proxy to be compiled with
	## the ldns library.

	BlockIPv6 no


	## Want to filter ads, malware, sensitive or inappropriate websites and
	## domain names? This feature can block lists of IP addresses and names
	## matching a list of patterns. The list of rules remains private, and
	## the filtering process directly happens on your own network. In order
	## to filter IP addresses, the list of IPs has to be put into a text
	## file, with one IP address per line. Lists of domain names can also be
	## blocked as well. Put the list into a text file, one domain per line.
	## Domains can include wildcards (*) in order to match patterns. For
	## example sex will match any name that contains the sex substring, and
	## ads.* will match anything starting with ads. The Internet has plenty
	## of free feeds of IP addresses and domain names used for malware,
	## phishing and spam that you can use with this feature.
	##
	## This uses a plugin that requires dnscrypt-proxy to be compiled with
	## the ldns library.
	##
	## To enable, uncomment one of the following definitions:

	## Block query names matching the rules stored in that file:
	# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt"

	## Block responses whose IP addresses match IPs stored in that file:
	# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt"

	## Block both domain names and IP addresses:
	# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt"

	## Same as the above + log the blocked queries in a file.
	## The log file can be prefixed with ltsv: (ex: ltsv:/tmp/log.txt) in order to
	## store logs using the LTSV format.
	# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" logfile:"/var/log/dnscrypt-blocked.log"
	# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"
	# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"



	############## User identification ##############

	## Use a client public key for identification
	## By default, the client uses a randomized key pair in order to make tracking
	## more difficult. This option does the opposite and uses a static key pair, so
	## that DNS providers can offer premium services to queries signed with a known
	## set of public keys. A client cannot decrypt the received responses without
	## also knowing the secret key.
	## The value for this property is the path to a file containing the secret key,
	## encoded as a hexadecimal string. The corresponding public key is computed
	## automatically.

	# ClientKey /etc/dnscrypt-client-secret.key



	############## Monitoring ##############

	## Do not actually start the proxy, but check that a valid certificate can be
	## retrieved from the server and that it will remain valid for the specified
	## time period. The process exit code is 0 if a valid certificate can be used,
	## 2 if no valid certificates can be used, 3 if a timeout occurred, and 4 if a
	## currently valid certificate is going to expire before the given margin.
	## Useful in a cron job to monitor your own dnscrypt-servers.
	## The margin is specified in minutes.

	# Test 2880



	############## Recursive configuration ##############

	## A configuration file can include other configuration files by inserting
	## the `Include` directive anywhere (the full path required, no quotes):

	# Include /etc/dnscrypt-proxy-common.conf
	# Configuration file for dnsmasq.
	#
	# Format is one option per line, legal options are the same
	# as the long options legal on the command line. See
	# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.

	# Custom development domains
	#address=/.dev/127.0.0.1
	#address=/.dom/127.0.0.1

	# Upstream DNSCrypt
	server=127.0.0.1#1553

	#user=dnsmasq
	#group=

	# Don't read the hostnames in /etc/hosts.
	#no-hosts

	# Do not go into the background at startup but otherwise run as
	# normal.
	keep-in-foreground

	# Do not provide DHCP or TFTP on the loopback interface.
	no-dhcp-interface=lo

	# Only listen on the loopback interface.
	listen-address=127.0.0.1

	# Only bind to interfaces dnsmasq is listening on.
	bind-interfaces

	# Never forward addresses in the non-routed address spaces.
	bogus-priv

	# Don't read /etc/resolv.conf.
	no-resolv

	# Reject (and log) addresses from upstream nameservers which are in
	# the private IP ranges. This blocks an attack where a browser behind
	# a firewall is used to probe machines on the local network.
	stop-dns-rebind

	# Exempt 127.0.0.0/8 from rebinding checks. This address range is
	# returned by realtime black hole servers, so blocking it may disable
	# these services.
	rebind-localhost-ok

	# Never forward plain names (without a dot or domain part).
	# domain-needed

	# Set the cache size here. If you don't use spam blocking add-ons such
	# Adblock Plus or Ghostery, you may want to increase this value as you
	# will be resolving more domain names.
	cache-size=16384

	#no-negcache
	#local-ttl=

	# Pass through DNSSEC validation results from dnscrypt-proxy.
	proxy-dnssec

	#mx-host=maildomain.com,servermachine.com,50
	#mx-target=servermachine.com
	#localmx
	#selfmx

	# log-queries
	# log-facility=/var/log/dnsmasq.log
	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-/Apple/DTD PLIST 1.0/EN" "http:/www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<dict>
	<key>Label</key>
	<string>homebrew.mxcl.dnscrypt-proxy</string>
	<key>KeepAlive</key>
	<true/>
	<key>RunAtLoad</key>
	<true/>
	<key>ProgramArguments</key>
	<array>
	<string>/usr/local/opt/dnscrypt-proxy/sbin/dnscrypt-proxy</string>
	<string>/usr/local/etc/dnscrypt-proxy.conf</string>
	</array>
	<key>UserName</key>
	<string>root</string>
	<key>StandardErrorPath</key>
	<string>/dev/null</string>
	<key>StandardOutPath</key>
	<string>/dev/null</string>
	</dict>
	</plist>
	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<dict>
	<key>Label</key>
	<string>homebrew.mxcl.dnsmasq</string>
	<key>ProgramArguments</key>
	<array>
	<string>/usr/local/opt/dnsmasq/sbin/dnsmasq</string>
	<string>--keep-in-foreground</string>
	<string>-C</string>
	<string>/usr/local/etc/dnsmasq.conf</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
	<key>KeepAlive</key>
	<true/>
	</dict>
	</plist>