Freedom251 › Internet Filtering Software
DNS Daddy
What DNS Daddy is
DNS Daddy is a free, self-hosted DNS resolver and security-visibility tool aimed at homelabs and smaller organisations. It blocks domains identified as malicious by public threat-intelligence feeds, with malware, phishing, C2 and cryptomining blocking enabled by default. Its records show which device made a DNS request, why a request was blocked and which feed supplied the reason. Network policies can match clients by CIDR, including across different sites and VLANs.
Six experimental behavioural detectors alert on DNS tunnelling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity and repeated resolution failures; they do not block traffic. Users can work through a web dashboard, REST API, Prometheus metrics or versioned SIEM-friendly exports. Deployment options include a single Go binary, Docker and systemd. DNS Daddy forwards queries to upstream resolvers and records their DNSSEC validation verdict rather than validating DNSSEC locally in its standard configuration. It has no clustering or anycast, and the project has not had an independent professional security review, penetration test, third-party code audit or certification.
Who it suits
DNS Daddy suits homelabs and smaller organisations, including small offices, that want self-hosted DNS filtering and query visibility. It may also suit administrators who need per-network policies and integrations with tools such as pfSense, Wazuh or Splunk.
What it does well
- Free plan with no account or subscription.
- Blocks malware, phishing, C2 and cryptomining by default.
- Plain-English query records identify devices and block reasons.
- CIDR-based policies can differ across sites and VLANs.
- Includes dashboard, REST API, metrics and SIEM-friendly exports.
What to know first
- Experimental detectors alert but do not block.
- Standard configuration does not locally validate DNSSEC.
- No clustering or anycast; one instance is one server.
- No independent professional security review or audit.
Limits
The free plan costs nothing, with no subscription or paid tiers. One instance is one server, with no clustering or anycast; the six experimental behavioural detectors alert but do not block.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free & Open Source | No account · No trial · No subscription · No paid tiers | Free |
As dnsdaddy.dev lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://dnsdaddy.dev/ for DNS Daddy.
- Choose the Docker-based or systemd installation path, or run the single Go binary.
- Deploy it in your self-hosted DNS environment.
- Use the web dashboard or documented REST API to view DNS activity.
- Configure per-network policies to match clients by CIDR, including sites or VLANs.
Verdict
DNS Daddy combines threat-feed blocking with detailed DNS visibility in a self-hosted package for smaller environments. Its single-server scale, upstream DNSSEC handling and lack of independent security review are important considerations.
Questions
How much does DNS Daddy cost?
Its Free & Open Source plan costs nothing, with no subscription or paid tiers.
Does DNS Daddy require an account or trial?
No account is required, and there is no trial.
Which platforms does DNS Daddy support?
Listed support includes Windows, macOS, Linux, iOS, a web dashboard, API, and self-hosted DNS environments.
Is DNS Daddy open source?
The listed plan is Free & Open Source.
What integrations are covered?
Integration guidance includes pfSense, OPNsense, UniFi, FortiGate, Windows Server, Wazuh, Elastic, Splunk, and Sentinel.
Does DNS Daddy validate DNSSEC locally?
In its standard configuration, DNS Daddy forwards queries to upstream resolvers and records the upstream validation verdict rather than validating DNSSEC locally.
Facts from DNS Daddy's own pages
- Deployment
- DNS Daddy is a single Go binary and provides Docker-based and systemd installation paths. · github.com, 9 Oct 2026
- Detection
- Six experimental behavioural detectors cover DNS tunnelling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity and repeated resolution failures; they alert but do not block. · github.com, 9 Oct 2026
- Integrations
- Integration guidance includes pfSense, OPNsense, UniFi, FortiGate, Windows Server, Wazuh, Elastic, Splunk and Sentinel. · github.com, 9 Oct 2026
- Intended users
- The project describes itself as aimed at homelabs and smaller organisations, including small offices. · github.com, 9 Oct 2026
- Interfaces
- The product includes a web dashboard, a documented REST API, Prometheus metrics and versioned SIEM-friendly exports. · github.com, 9 Oct 2026
- Network policies
- Per-network policies can match clients by CIDR, including different sites and VLANs. · github.com, 9 Oct 2026
- Privacy
- The maker describes DNS Daddy as self-hosted, with no account, no cloud tenant and no requirement to upload query logs. · github.com, 9 Oct 2026
- Product
- DNS Daddy is a lightweight, self-hosted protective DNS resolver and DNS-security visibility tool. · github.com, 9 Oct 2026
- Scale limits
- The project says it has no clustering or anycast, and one DNS Daddy instance is one server. · github.com, 9 Oct 2026
- Security review
- The project says it has not undergone an independent professional security review, penetration test, third-party code audit or certification. · github.com, 9 Oct 2026
- Support
- The maker describes DNS Daddy as a solo project maintained by one person in spare time and invites contributions, code review, testing and bug reports. · github.com, 9 Oct 2026
- Technical limits
- DNS Daddy forwards queries to upstream resolvers and does not locally validate DNSSEC in its standard configuration; it records the upstream validation verdict. · github.com, 9 Oct 2026
- Threat blocking
- It blocks known-malicious domains using public threat-intelligence feeds, with malware, phishing, C2 and cryptomining blocking on by default. · github.com, 9 Oct 2026
- Visibility
- It records DNS queries in plain English and shows which device asked, why a query was blocked and which feed supplied the reason. · github.com, 9 Oct 2026
Where DNS Daddy stands on Freedom251
- Internet Filtering Software#9 of 65