- Home
- Internet Filtering Software
- DNS Daddy
DNS Daddy
What it is
DNS Daddy is a free, self-hosted DNS resolver and DNS-security visibility tool aimed at homelabs and smaller organizations. It blocks known-malicious domains using public threat-intelligence feeds, with malware, phishing, command-and-control, and cryptomining blocking enabled by default. Its records show DNS queries in plain English, including the device that asked, why a query was blocked, and which feed supplied the reason. Per-network policies can match clients by CIDR across sites and VLANs. Six experimental behavioral detectors alert on DNS tunneling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity, and repeated resolution failures; these detectors do not block. Interfaces include a web dashboard, documented REST API, Prometheus metrics, and versioned SIEM-friendly exports. The product is distributed as a single Go binary, with Docker and systemd installation paths. The maker describes it as self-hosted, without an account, cloud tenant, or need to upload query logs. It has no clustering or anycast, and each instance is one server. DNS Daddy forwards queries to upstream resolvers and does not locally validate DNSSEC in its standard configuration; it records the upstream validation verdict. The project says it has not undergone an independent professional security review, penetration test, third-party code audit, or certification.
For and against
For
- Blocks malware, phishing, C2, and cryptomining by default.
- Shows the requesting device and block reason.
- Supports per-network policies matched by CIDR.
- Provides a REST API and Prometheus metrics.
- No account or cloud tenant is required.
Against
- Behavioral detectors alert but do not block.
- No clustering or anycast; one instance is one server.
- Standard configuration does not locally validate DNSSEC.
- No independent professional security review or audit.
The verdict
DNS Daddy provides self-hosted threat blocking and detailed DNS visibility for smaller environments. Its detectors are alerts only, and its standard DNSSEC handling relies on upstream resolvers.
Who it suits
DNS Daddy suits homelabs and smaller organizations, including small offices, that want self-hosted DNS filtering and query visibility. Its single-server design and lack of independent security review are relevant considerations for deployment.
Plans and prices
Free & Open Source
No account · No trial · No subscription · No paid tiers
Read 9 Oct 2026 · github.com
On the record
- Deployment
- DNS Daddy is a single Go binary and provides Docker-based and systemd installation paths.github.com · read 9 Oct 2026
- Detection
- Six experimental behavioural detectors cover DNS tunnelling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity and repeated resolution failures; they alert but do not block.github.com · read 9 Oct 2026
- Integrations
- Integration guidance includes pfSense, OPNsense, UniFi, FortiGate, Windows Server, Wazuh, Elastic, Splunk and Sentinel.github.com · read 9 Oct 2026
- Intended users
- The project describes itself as aimed at homelabs and smaller organisations, including small offices.github.com · read 9 Oct 2026
- Interfaces
- The product includes a web dashboard, a documented REST API, Prometheus metrics and versioned SIEM-friendly exports.github.com · read 9 Oct 2026
- Network policies
- Per-network policies can match clients by CIDR, including different sites and VLANs.github.com · read 9 Oct 2026
- Privacy
- The maker describes DNS Daddy as self-hosted, with no account, no cloud tenant and no requirement to upload query logs.github.com · read 9 Oct 2026
- Product
- DNS Daddy is a lightweight, self-hosted protective DNS resolver and DNS-security visibility tool.github.com · read 9 Oct 2026
- Scale limits
- The project says it has no clustering or anycast, and one DNS Daddy instance is one server.github.com · read 9 Oct 2026
- Security review
- The project says it has not undergone an independent professional security review, penetration test, third-party code audit or certification.github.com · read 9 Oct 2026
- Support
- The maker describes DNS Daddy as a solo project maintained by one person in spare time and invites contributions, code review, testing and bug reports.github.com · read 9 Oct 2026
- Technical limits
- DNS Daddy forwards queries to upstream resolvers and does not locally validate DNSSEC in its standard configuration; it records the upstream validation verdict.github.com · read 9 Oct 2026
- Threat blocking
- It blocks known-malicious domains using public threat-intelligence feeds, with malware, phishing, C2 and cryptomining blocking on by default.github.com · read 9 Oct 2026
- Visibility
- It records DNS queries in plain English and shows which device asked, why a query was blocked and which feed supplied the reason.github.com · read 9 Oct 2026
