diff --git a/etc/dnscrypt-proxy/dnscrypt-proxy.toml b/etc/dnscrypt-proxy/dnscrypt-proxy.toml
new file mode 100644
index 00000000..0b571c52
--- /dev/null
+++ b/etc/dnscrypt-proxy/dnscrypt-proxy.toml
@@ -0,0 +1,24 @@
+# Empty listen_addresses to use systemd socket activation
+listen_addresses = []
+server_names = ['cloudflare']
+
+ipv4_servers = true
+ipv6_servers = true
+require_dnssec = true
+fallback_resolver = '8.8.8.8:53'
+cache = true
+cache_size = 10000
+
+[query_log]
+  file = '/var/log/dnscrypt-proxy/query.log'
+
+[nx_log]
+  file = '/var/log/dnscrypt-proxy/nx.log'
+
+[sources]
+  [sources.'public-resolvers']
+  url = 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md'
+  cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
+  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+  refresh_delay = 72
+  prefix = ''