The simplified sequence diagram really helps to picture it. I’ll PM you with the logs.

Routing DNSCrypt through the Tor network should, in theory, anonymize DNS queries. This configuration would result in the DNS resolver observing the IP address of the Tor exit node rather than my actual IP address, thus hiding my identity from the resolver. I’m not sure why the actual request to the site would go to the IP directly.

For implementing DNS over HTTPS (DoH) via Tor, I followed the guidelines from this GitHub repository and translated them into my current approach.

I’ve gone through DNSCrypt’s logs, but nothing really stood out. I’m a bit lost with Wireshark - there’s so much data even if I filter it by DNS or Tor Socks Port (From my relay).

While you asked about the basis for my conclusions, it’s worth noting that if the Tor proxy were working as intended, I would also anticipate a considerable increase in latency. There’s a huge difference when I enter https://one.one.one.one/help/ normally with "Use system proxy settings" in my browser and when I enter it with a "Manual proxy configuration" with the SOCKS Host set up and "Proxy DNS when using SOCKS v5" checked on.

It’s not hiding my real ip from websites such as https://whatismyipaddress.com/. If it was torrified, I’d expect something changing on “am i using tor” websites as well.

I’m using Cloudflare and I get no output from dig 1.0.0.1.email.teatastic.org +short which should mean that my dns is not blocked. Additionally, I discovered that my self hosted email just appeared as a destination address on Cloudflare. The problem is that it’s “Pending verification”, yet I don’t receive any mails to actually confirm it.

I’ve tried to email myself from both proton and gmail, but no emails appear in Roundcube. Since I have no prior experience with this, I might be overlooking something important, yet I’m not sure what.

I have firewall disabled for my ports, so that’s not the issue here.

Awesome, you were right! Thank you!

systemd.services.nginx.serviceConfig.ProtectHome = false;
users.groups.searx.members = [ "nginx" ];

For anyone looking to test it out, it’s https://search.teatastic.org/

Yeah, good point about the localhost. The ports are fine however. The actual error that I’m getting is coming from nginx: *1 connect() to unix:/run/searx/searx.sock failed (13: Permission denied) while connecting to upstream. I have added the searx and nginx groups to my main user (which I have to find a workout for anyway, since it might prove to be a security problem), yet it still does not work.