diff --git a/profiles/dnscrypt/cloaking_rules b/profiles/dnscrypt/cloaking_rules
new file mode 100644
index 0000000..6cbe72f
--- /dev/null
+++ b/profiles/dnscrypt/cloaking_rules
@@ -0,0 +1 @@
+*.localhost    localhost
diff --git a/profiles/dnscrypt/default.nix b/profiles/dnscrypt/default.nix
index a02989b..5a26879 100644
--- a/profiles/dnscrypt/default.nix
+++ b/profiles/dnscrypt/default.nix
@@ -12,6 +12,7 @@
     settings = {
       ipv6_servers = false;
       require_dnssec = true;
+      cloaking_rules = ./cloaking_rules;
 
       sources.public-resolvers = {
         urls = [