Capabilities
What DNS Daddy does today — and what it doesn't.
Every row below is traceable to the repository README or the documentation in docs/. Nothing here is aspirational. Where a capability is missing, absent or half-finished, it says so in the same list, at the same size, as the things that work.
Resolution
How queries reach DNS Daddy and how they leave it.
Forwarding DNS resolver
AvailableDNS Daddy answers queries for your network and forwards what it allows to an upstream resolver. It is a forwarder, not a full recursive resolver.
docs/architecture.md →DoH and DoT serving (RFC 8484)
AvailableClients can query DNS Daddy over DNS-over-HTTPS or DNS-over-TLS as well as plain DNS.
docs/architecture.md →Encrypted upstream by default
AvailableQueries leaving DNS Daddy use DNS-over-TLS to the upstream resolver by default, so your resolution path is not sent in the clear.
Recursive resolution
Not supportedDNS Daddy does not walk the DNS hierarchy itself. It always depends on an upstream resolver you configure.
DNSSEC validation
Not supportedSignatures are passed through but are not validated by DNS Daddy. If you need validation today, it must happen upstream or on the client.
Protection and policy
What gets blocked, and how you control it.
Threat-feed blocking
AvailableMalware, phishing, command-and-control and cryptomining categories are enabled by default, using public and community-maintained blocklists.
docs/threat-intel.md →Optional categories
AvailableNewly registered domains, advertising, adult and gambling categories can be enabled on top of the security categories.
docs/threat-intel.md →Per-network policy
AvailableDifferent policies for different networks, matched by client CIDR or by a per-client DoH URL — so a guest VLAN and a server VLAN need not share rules.
Instant allow-listing
AvailableAllow-listing a domain purges it from the cache immediately. You do not wait out a TTL to unblock a false positive.
Custom feeds
AvailableBring your own lists in hosts, domain-list or adblock format, including local file:// sources, alongside the built-in feed catalogue.
Safe search enforcement
PartialA safeSearch field is accepted by the API and stored in the policy model, but the resolver does not act on it yet. Treat it as not implemented.
README.md →Behavioural detection (tunnelling, DGA, anomalies)
Not supportedDNS Daddy blocks on threat-feed matches. There is no behavioural detection engine, entropy scoring or anomaly model in the project today.
Visibility
What you can see and export after the fact.
Query logging with block reasons
AvailableEach blocked query records a plain-English reason and the category that matched, so a log line explains itself without cross-referencing a feed.
docs/privacy.md →Dashboard and REST API
AvailableA web dashboard for day-to-day use, backed by a REST API documented with an OpenAPI 3.1 specification served by the application.
Markdown reports
AvailableDNS Daddy can generate Markdown activity reports you can read, commit or forward. There is no scheduled email delivery built in.
Prometheus metrics
AvailableA /metrics endpoint exposes operational metrics for scraping into your existing monitoring stack.
docs/integrations.md →SIEM integration
Not supportedThere is no purpose-built SIEM connector. Metrics and logs are available, but shipping them onwards is currently your integration work.
Operations
Running it, and what running it will not give you.
Docker Compose and systemd deployment
AvailableDeploy with the provided Compose file, a systemd installer script, or by building from source with the Makefile.
docs/deploy.md →API tokens and admin password
AvailableAccess is protected by a single admin password plus API tokens for programmatic use.
SSO, RBAC and multi-tenancy
Not supportedThere are no user roles, no directory integration and no tenancy separation. One admin credential governs the instance.
Clustering, anycast and high availability
Not supportedOne server is one server. There is no clustering or anycast support, so plan resilience at the network level.
Browser DoH bypass
Known limitationA browser configured to use its own DNS-over-HTTPS resolver bypasses DNS Daddy entirely. Mitigations exist for common firewalls but require manual configuration.
docs/integrations.md →Check this list yourself.
This page is a reading of the repository, and the repository moves faster than the website. If something here is out of date or wrong, the README is the authority — and an issue correcting the site is a genuinely welcome contribution.