diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index d0e156ea177..99d4c3e1832 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -80,6 +80,7 @@
   jcumming = "Jack Cummings <jack@mudshark.org>";
   jgeerds = "Jascha Geerds <jg@ekby.de>";
   jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
+  joachifm = "Joachim Fasting <joachifm@fastmail.fm>";
   joamaki = "Jussi Maki <joamaki@gmail.com>";
   joelteon = "Joel Taylor <me@joelt.io>";
   jwiegley = "John Wiegley <johnw@newartisans.com>";
diff --git a/pkgs/tools/networking/dnscrypt-proxy/default.nix b/pkgs/tools/networking/dnscrypt-proxy/default.nix
new file mode 100644
index 00000000000..d0205be35b9
--- /dev/null
+++ b/pkgs/tools/networking/dnscrypt-proxy/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl, libsodium }:
+
+stdenv.mkDerivation rec {
+  name = "dnscrypt-proxy-1.4.1";
+
+  src = fetchurl {
+    url = "http://download.dnscrypt.org/dnscrypt-proxy/${name}.tar.bz2";
+    sha256 = "00cf5c520c8a5a71ad4916b33aa0c8f9f55434039304f4ba10d7fffc620563f8";
+  };
+
+  buildInputs = [ libsodium ];
+
+  meta = {
+    description = "A DNS proxy which encrypts and authenticates requests using the DNSCrypt protocol.";
+    homepage = http://dnscrypt.org/;
+    license = with stdenv.lib.licenses; [ isc ];
+    maintainers = with stdenv.lib.maintainers; [ joachifm ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 97b96e9b26c..29d9fcae821 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -977,6 +977,8 @@ let
 
   dev86 = callPackage ../development/compilers/dev86 { };
 
+  dnscrypt-proxy = callPackage ../tools/networking/dnscrypt-proxy { };
+
   dnsmasq = callPackage ../tools/networking/dnsmasq { };
 
   dnstop = callPackage ../tools/networking/dnstop { };