That is, even though you’ve set up your computer or router to connect to OpenDNS (or a VPN or alternate DNS server, such as Google DNS), something on your computer is still making requests to the default DNS server (usually your ISP’s). Basically, for this vulnerability to be present, you’d have to have a “DNS leak” on your connection. The risk of someone eavesdropping on or spoofing a DNS in the “last mile” is very low. With DNSCrypt, hackers won’t be able to snoop on your DNS traffic anymore-nor will they be able to trick your computer into thinking that you’re communicating with a legit DNS server.

That is, hackers could still snoop or divert your DNS traffic by intercepting it before it reaches your ISP. But this still leaves one relatively weak link in the chain: the “last mile” or, the portion of your Internet connection between your ISP and your computer. Once your request reaches the OpenDNS servers, you can be reasonably assured that you’re making a legitimate connection to the website you’re trying to reach. It does so by providing a better DNS server than the one your ISP provides by default. In a nutshell, OpenDNS improves your web browsing security by giving you greater assurance that the website you are connecting to is the one you intended to connect to. This is similar to, but not the same as, HTTPS encryption of web traffic (SSL/TLS). DNSCrypt is an additional service layered on top of OpenDNS that helps protect against vulnerabilities presented by “DNS leaks.” It does so by encrypting DNS traffic to ensure that it can’t be intercepted by a hacker or a man-in-the-middle.

Opendns dnscrypt not working