See what your network is asking the internet.
DNS Daddy is a free, open-source, self-hosted protective DNS project that helps you understand and control your network's DNS activity — blocking known malicious domains and recording, in plain English, why.
Simulated DNS activity in your browser. No installation, no account, no real traffic.
Free & Open Source · Self-Hosted · No Account · No Subscription
How it works
One control point, every name your network resolves.
DNS Daddy sits between your devices and the resolver they would otherwise use. Nothing is installed on the endpoint — if a device uses your DNS, it is covered.
- 01
Device
A laptop, phone, server or IoT device asks for a name.
laptop-07 → A? example.com
- 02
DNS Daddy
Your self-hosted resolver receives the query over DNS, DoH or DoT.
listener :53 / :443 / :853
- 03
Policy & feeds
The network's policy is matched, then the name is checked against threat-feed categories.
policy: guest-vlan · feed: phishing
- 04
Upstream resolver
Allowed queries are forwarded over DNS-over-TLS to the upstream resolver you configured.
forward via DoT
- 05
Internet
The answer comes back, is cached, and the outcome is recorded.
cached · logged
Allow
Forwarded upstream, cached and logged.
Block
No usable answer returned, with the matching category recorded.
Log
Every outcome lands in the query log with a plain-English reason.
Allow, block and log are the outcomes DNS Daddy actually produces today. There is no separate alerting or behavioural detection pipeline.
Explore the architecture →Capabilities
What's real, what's partial, what isn't there.
Every capability carries its status. Gaps are listed beside the features rather than buried, because a security tool you misunderstand is worse than one you don't run.
Protective DNS
Malware, phishing, command-and-control and cryptomining domains blocked from public and community threat feeds.
Query visibility
Every query logged with the device that asked and a plain-English reason for any block.
Per-network policy
Separate rules per network, matched by client CIDR or a per-client DoH URL.
Encrypted DNS
Serves DoH and DoT to your clients, and forwards upstream over DNS-over-TLS by default.
Metrics & reports
Prometheus metrics endpoint, an OpenAPI-documented REST API and Markdown activity reports.
Safe search
Accepted by the API and stored in the policy model, but not yet enforced by the resolver.
DNSSEC validation
Signatures pass through unvalidated. Validation must happen upstream or on the client.
Behavioural detection
No tunnelling detection, DGA scoring or anomaly modelling exists in the project today.
Interactive demo
Don't just read about it. Attack it.
A separate, purpose-built playground where you can send synthetic DNS traffic, explore suspicious query behaviour and watch how DNS security detections respond — in a simulation that never executes real malicious traffic.
The demo runs on simulated data only. It does not process your real DNS traffic, nothing you do in it affects a real DNS Daddy installation, and it is a preview of ideas rather than evidence that DNS Daddy has been audited or proven secure.
> simulated query stream BLOCK malware workstation-04 BLOCK phishing laptop-11 ALLOW microsoft.com dc-01 BLOCK c2-domain sensor-02 ALLOW cdn.example guest-wifi # synthetic data · nothing here is real traffic
Built in public
Break it. Question it. Improve it.
Publishing security software doesn't make it secure — it just gives people the chance to check. DNS Daddy is developed in the open specifically so that people who know more than its author can find the things its author missed.
Substantial parts of this project have been built with AI-assisted development. That is stated plainly rather than hidden, because it changes how the code should be treated: generated code is not automatically trusted code.
The working loop
Every commit is scanned by CodeQL, gosec, govulncheck and Trivy, with fuzzing on the parsing that attacker-controlled input reaches first and an SBOM generated in CI. That is not an audit — but it is the difference between writing code and examining it.
See the full project status →The open-source promise
No trial. No subscription. No catch.
DNS Daddy is source code you can inspect and run yourself.
Clone it from GitHub, deploy it on your own infrastructure and make it yours. There are no accounts to create, no licence fees, no feature paywalls and nobody to talk to before you start.
If the project ever develops commercial services in the future, they will be clearly separated from the open-source project. What's here today is DNS Daddy Open Source — free to use, inspect, modify and contribute to under its published licence.
Frequently asked questions.
Is DNS Daddy ready for production?+
No. It's an experimental proof of concept with no independent security audit, penetration test or long-term production validation behind it. It's a good fit for labs, homelabs, learning and security research — be cautious about anything business-critical.
Is it really free? What's the catch?+
No catch. It's open source and self-hosted: no subscriptions, no licence fees, no accounts, no trials and no paywalled features. You clone it from GitHub and run it on your own infrastructure. Buying a coffee is optional and unlocks nothing.
How much of this was written with AI?+
A lot of it. DNS Daddy is built with extensive AI-assisted development, and that's stated openly. Generated code isn't treated as trusted code — it gets tested, scanned in CI, attacked and reviewed. Independent review still matters enormously, which is precisely why the source is public.
Does it detect DNS tunnelling or DGA activity?+
Not today. DNS Daddy blocks on threat-feed matches; there is no behavioural detection engine, entropy scoring or anomaly model in the project. The query logs contain the raw material an analyst would use, but the detection logic isn't there — and this site won't pretend it is.
Does it validate DNSSEC?+
No. Signatures pass through but DNS Daddy does not verify them, so validation has to happen at your upstream resolver or on the client. It's documented as a limitation in the repository.
Can employees bypass it with encrypted DNS in their browser?+
Yes — a browser using its own DNS-over-HTTPS resolver bypasses any network-level DNS control, DNS Daddy included. The integrations documentation covers mitigations for common firewalls, but they are manual configuration you have to maintain.
Where does the threat intelligence come from?+
Public and community-maintained blocklists, documented in docs/threat-intel.md along with how categories map to severity. You can add your own feeds in hosts, domain-list or adblock format, including local files.
I found a security problem. What should I do?+
Report it responsibly via SECURITY.md rather than exploiting it against live deployments, and only test systems you own or have explicit permission to test.
Like DNS Daddy? Buy me a coffee. ☕
DNS Daddy is free, open source and has no paid tiers.
If you enjoy the project and fancy supporting the hosting, testing and caffeine behind it, you're welcome to buy me a coffee. You absolutely don't have to.
Using DNS Daddy, reporting bugs, reviewing the code, improving the documentation and contributing pull requests are just as valuable.
Code, bug reports and coffee all gratefully accepted.
Donations unlock nothing. No extra features, no priority support, no private builds. DNS Daddy is equally available to everyone.
Run it in a lab — then tell me what's wrong with it.
Clone it, spin it up in a homelab or test network, point a few devices at it and see what your network is actually resolving. When something breaks — and it will — open an issue.