DNS Daddy

Spec sheet

Product

DNS Daddy is a lightweight, self-hosted protective DNS resolver and DNS-security visibility tool.Read 9 Oct 2026 · github.com

Intended users

The project describes itself as aimed at homelabs and smaller organisations, including small offices.Read 9 Oct 2026 · github.com

Deployment

DNS Daddy is a single Go binary and provides Docker-based and systemd installation paths.Read 9 Oct 2026 · github.com

Integrations

Integration guidance includes pfSense, OPNsense, UniFi, FortiGate, Windows Server, Wazuh, Elastic, Splunk and Sentinel.Read 9 Oct 2026 · github.com

Privacy

The maker describes DNS Daddy as self-hosted, with no account, no cloud tenant and no requirement to upload query logs.Read 9 Oct 2026 · github.com

Support

The maker describes DNS Daddy as a solo project maintained by one person in spare time and invites contributions, code review, testing and bug reports.Read 9 Oct 2026 · github.com

Detection

Six experimental behavioural detectors cover DNS tunnelling, beaconing, NXDOMAIN anomalies, DGA-like domains, unusual TXT activity and repeated resolution failures; they alert but do not block.Read 9 Oct 2026 · github.com

Interfaces

The product includes a web dashboard, a documented REST API, Prometheus metrics and versioned SIEM-friendly exports.Read 9 Oct 2026 · github.com

Network policies

Per-network policies can match clients by CIDR, including different sites and VLANs.Read 9 Oct 2026 · github.com

Scale limits

The project says it has no clustering or anycast, and one DNS Daddy instance is one server.Read 9 Oct 2026 · github.com

Security review

The project says it has not undergone an independent professional security review, penetration test, third-party code audit or certification.Read 9 Oct 2026 · github.com

Technical limits

DNS Daddy forwards queries to upstream resolvers and does not locally validate DNSSEC in its standard configuration; it records the upstream validation verdict.Read 9 Oct 2026 · github.com

Threat blocking

It blocks known-malicious domains using public threat-intelligence feeds, with malware, phishing, C2 and cryptomining blocking on by default.Read 9 Oct 2026 · github.com

Visibility

It records DNS queries in plain English and shows which device asked, why a query was blocked and which feed supplied the reason.Read 9 Oct 2026 · github.com

Plans and prices

Every DNS Daddy plan and price →

Where Specifiction places it

• Internet Filtering Software#18 of 658.1