Documentation
Everything you need to run it — and nothing invented.
DNS Daddy's documentation lives in the repository, next to the code it describes, so it can never drift out of sync with the software. This page is a guided way in rather than a second copy that slowly goes stale.
Quick start with Docker Compose
The fastest way to try DNS Daddy is a container on a machine you control. Do this on a lab box or a spare VM first — not on the resolver your business depends on.
git clone https://github.com/jameshoulder/dnsdaddy.git cd dnsdaddy docker compose up -d
dig @127.0.0.1 example.com +short
Note
These commands are a summary for orientation. Ports, volumes, the admin password and upstream resolver settings are all covered properly in the deployment guide — read it before exposing anything beyond localhost.
Read docs/deploy.md →Start here
Getting started
What DNS Daddy is, what it gives you out of the box, and the honest limitations to read before you deploy anything.
README.md →Installation & deployment
Docker Compose, systemd via the installer script, or building from source. Ports, volumes and upstream configuration.
docs/deploy.md →Configuration reference
A fully commented example configuration file covering listeners, upstreams, categories, feeds and policies.
dnsdaddy.example.yaml →Understand it
Architecture
How a query travels through the resolver: listeners, cache, policy evaluation, feed matching and upstream forwarding.
docs/architecture.md →Threat intelligence
Which blocklist feeds are used, how categories map to severity, and how to add or override sources with your own.
docs/threat-intel.md →Privacy & telemetry
What gets logged, where it stays, and what DNS Daddy deliberately does not collect or send anywhere.
docs/privacy.md →Integrations
Wiring DNS Daddy into firewalls and monitoring — including Prometheus metrics and handling browser DoH bypass.
docs/integrations.md →Security & contributing
Security policy & disclosure
The supported reporting route for vulnerabilities, and what to expect after you report one.
SECURITY.md →Static analysis triage
A real worked example: Semgrep findings triaged one by one, including a Markdown-injection issue that was fixed.
docs/security/semgrep-triage-2026-07-29.md →Contributing
Development setup, coding expectations, tests, and how to open a pull request that stands a chance of being merged.
CONTRIBUTING.md →Security tooling in CI
The workflow definitions behind CodeQL, gosec, govulncheck, Trivy, fuzzing and SBOM generation.
.github/workflows/ →Documentation gaps are bugs.
If a step didn't work, an assumption wasn't stated, or a page assumed you already knew DNS, that is worth reporting. Documentation fixes are among the most useful pull requests this project can receive.