alternative solution for allowing dnscrypt-proxy to bind to port 53 without root
reference: https://wiki.artixlinux.org/Main/Dnscrypt-proxy
the following command allows dnscrypt-proxy to bind to port 53 without running as root:
sudo setcap cap_net_bind_service=+ep $(which dnscrypt-proxy)
this approach is also recommended for allowing caddy to bind to e.g. port 443:
https://github.com/caddyserver/caddy
with this approach, no further modifications are necessary to the default configuration, i.e. it is not necessary to run dnscrypt-proxy as root.