• Resumed PQDNSCrypt queries now use regular UDP padding, protecting their size and response budget. Oversized tickets are rejected, and oversized queries fall back to TCP.
• Network changes are detected more reliably, ensuring PQDNSCrypt key material rotates when connections change.
• Forwarded queries to local or DHCP resolvers now use UDP by default. Bootstrap resolvers still use TCP when force_tcp is enabled.
• Suffix rules now match only at DNS label boundaries. IP allow/block rules now correctly handle IPv4-mapped IPv6 addresses.
• The monitoring dashboard displays the running version. Its endpoints no longer allow cross-origin browser access.