DNS Daddy
DNS Daddy is a lightweight, self-hosted DNS resolver focused on blocking known threats and making DNS activity easier to inspect.
What DNS Daddy is
DNS Daddy is a lightweight, self-hosted DNS resolver focused on blocking known threats and making DNS activity easier to inspect. It uses public threat-intelligence feeds, with blocking for malware, phishing, command-and-control, and cryptomining enabled by default. Its records present queries in plain English, including the device that made each request, the reason for a block, and the feed that identified it. Network policies can match clients by CIDR across sites and VLANs. Six experimental behavioral detectors flag patterns such as DNS tunneling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity, and repeated resolution failures; these detectors alert but do not block. The package includes a web dashboard, documented REST API, Prometheus metrics, and versioned SIEM-friendly exports. It is distributed as one Go binary, with Docker and systemd installation options. The maker describes it as requiring no account or cloud tenant and no query-log uploads. DNS Daddy is free, with no subscription or paid tiers. It is aimed at homelabs and smaller organizations, but has no clustering or anycast, and one instance runs as one server. It has not received an independent professional security review, penetration test, third-party code audit, or certification.
Good
- Free, with no account or subscription.
- Threat blocking is enabled for several categories by default.
- Query records identify devices and block reasons.
- Per-network policies can match clients by CIDR.
- Includes a dashboard, API, and Prometheus metrics.
Watch out
- Behavioral detectors alert but do not block.
- No clustering or anycast is available.
- The project has not had an independent security review.
- One instance runs on one server.
Who it suits
DNS Daddy is aimed at homelabs, small offices, and smaller organizations that want a self-hosted DNS resolver with query visibility. It may also suit users who want to inspect threat-feed blocks through a dashboard or API.
Verdict
DNS Daddy pairs threat blocking with detailed query visibility in a self-hosted package aimed at smaller setups. Its detectors are experimental alerts rather than blockers, and the project has not received an independent professional security review.
Plans and prices
From DNS Daddy's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free & Open Source | Free | No account · No trial · No subscription · No paid tiers |
The facts
Each one read from DNS Daddy's own pages, with the date it was checked.
What it does
- Deployment
- DNS Daddy is a single Go binary and provides Docker-based and systemd installation paths.checked 9 Oct 2026
- Detection
- Six experimental behavioural detectors cover DNS tunnelling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity and repeated resolution failures; they alert but do not block.checked 9 Oct 2026
- Integrations
- Integration guidance includes pfSense, OPNsense, UniFi, FortiGate, Windows Server, Wazuh, Elastic, Splunk and Sentinel.checked 9 Oct 2026
- Intended users
- The project describes itself as aimed at homelabs and smaller organisations, including small offices.checked 9 Oct 2026
- Interfaces
- The product includes a web dashboard, a documented REST API, Prometheus metrics and versioned SIEM-friendly exports.checked 9 Oct 2026
- Network policies
- Per-network policies can match clients by CIDR, including different sites and VLANs.checked 9 Oct 2026
- Privacy
- The maker describes DNS Daddy as self-hosted, with no account, no cloud tenant and no requirement to upload query logs.checked 9 Oct 2026
- Product
- DNS Daddy is a lightweight, self-hosted protective DNS resolver and DNS-security visibility tool.checked 9 Oct 2026
- Scale limits
- The project says it has no clustering or anycast, and one DNS Daddy instance is one server.checked 9 Oct 2026
- Security review
- The project says it has not undergone an independent professional security review, penetration test, third-party code audit or certification.checked 9 Oct 2026
- Support
- The maker describes DNS Daddy as a solo project maintained by one person in spare time and invites contributions, code review, testing and bug reports.checked 9 Oct 2026
- Technical limits
- DNS Daddy forwards queries to upstream resolvers and does not locally validate DNSSEC in its standard configuration; it records the upstream validation verdict.checked 9 Oct 2026
- Threat blocking
- It blocks known-malicious domains using public threat-intelligence feeds, with malware, phishing, C2 and cryptomining blocking on by default.checked 9 Oct 2026
- Visibility
- It records DNS queries in plain English and shows which device asked, why a query was blocked and which feed supplied the reason.checked 9 Oct 2026
Alternatives to DNS Daddy
- 1
AdGuard DNS
Free planOpen sourceAndroidiOSWebAPI8.6From $29.88 a year - 2
NextDNS
Free planOpen sourceAndroidiOSWebAPI8.6From £1.79 a month - 3
Cloudflare Gateway
Free planAndroidiOSWebAPI8.3$7 usage-based - 4
Control D
Open sourceAndroidiOSWebAPI8.1From $2 a month - 5
OpenBLD
Free planAndroidiOSWebAPI7.9From $15 a month - 6
DNSFilter
AndroidiOSWebAPI7.8From $1 a month