Dnscrypt-proxy2 2.0.44 allows one to configure it to drop privileges after binding port 53. However, doing so causes it to fail on initialization. I got a copy of 2.0.45 from their site, and it is able to drop privileges.
A commit references this bug: Author: egypcio Date: Sat Jan 23 10:00:48 UTC 2021 New revision: 562387 URL: https://svnweb.freebsd.org/changeset/ports/562387 Log: dns/dnscrypt-proxy2: update 2.0.44 to 2.0.45 * https://github.com/DNSCrypt/dnscrypt-proxy/releases/tag/2.0.45 PR: 252574 Reported by: Bill Blake <billblake2018 % gmail.com> Changes: head/dns/dnscrypt-proxy2/Makefile head/dns/dnscrypt-proxy2/distinfo