DNS is the phone book of the internet — every domain your device visits is looked up before the connection happens. Most people use their ISP’s DNS resolver by default, which means their ISP logs every domain they visit. Control D is a configurable DNS resolver that blocks ads and trackers, enforces content policies, and supports DNS-over-HTTPS and DNS-over-TLS with no account required for basic use.

What Control D Offers

Control D sits in the same category as NextDNS, Pi-hole, and AdGuard Home, but with a cloud-first approach. You configure a profile via a web dashboard, and any device pointed at your assigned resolver endpoint automatically gets those rules applied. There is no self-hosted infrastructure to maintain.

Key features:

Custom block and redirect rules per profile
Traffic analytics with query logging (optional)
Pre-built filter lists for ads, malware, adult content, social media
Per-device profiles — your phone can have stricter rules than your desktop
DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC
Geo-unblocking via DNS-level redirects (routes certain domains through servers in other countries)

Creating a Free Account

Control D has a free tier with basic blocking using a default resolver endpoint. The paid tier (around $2/month) unlocks custom rules, analytics, and per-device profiles.

Click Profiles > Add Profile.
Name the profile (e.g., “Home Network”).
Enable filter lists under the Filters tab.

Your profile is assigned a resolver endpoint in this format:

https://dns.controld.com/YOURENDPOINT

Recommended Filter Lists

Under your profile’s Filters tab, enable:

Filter	Purpose
Control D Ads & Trackers	Comprehensive ad blocking
Malware	Blocks known malicious domains
Phishing	Blocks credential phishing sites
IoT Telemetry	Blocks phone-home traffic from smart devices
Affiliate & Tracking Links	Strips tracking redirects

For stricter setups, also enable:

Social Media (if you want to restrict social platforms on the network)
Dating or Gambling (household filtering)

Custom Rules

Control D allows per-profile custom block and redirect rules. These are DNS-level rules — they affect any device using that profile.

Block a specific domain: Add block: ads.example.com in the Rules section.

Redirect a domain to a different IP:

redirect: ads.example.com → 0.0.0.0

Force SafeSearch on Google and YouTube: Enable the SafeSearch toggle in the profile — Control D handles the DNS redirects automatically.

Bypass a blocked domain for a specific service: You can add an allow rule that overrides the blocklist for a specific domain.

Custom rules are processed in order: allow rules take precedence over block rules.

Analytics Mode vs Privacy Mode

This is one of the most important settings in Control D.

Analytics Mode (default): DNS queries are logged per device, per domain, with timestamps. This gives you a full picture of what your devices are doing on the network — useful for diagnosing issues or monitoring children’s devices.

Privacy Mode: No query logs are stored. You get aggregate statistics (total queries, blocked percentage) but no per-domain or per-device records.

Change this under Profile > Settings > Log Level. Set to Disabled for maximum privacy.

Even with logging enabled, Control D states that logs are retained for a limited period and are not sold. But if you do not need the analytics, disable logging entirely.

Router-Level Setup

Configuring Control D at the router level means every device on your network is protected without individual device configuration.

For routers running stock firmware (e.g., ASUS, TP-Link):

Log into your router admin panel (typically 192.168.1.1).
Navigate to WAN > DNS or Advanced > DNS.
Set the primary DNS to Control D’s DNS-over-TLS address:
- Server: dns.controld.com
- Port: 853
- Your endpoint identifier: provided in the Control D dashboard
Disable your ISP’s automatic DNS assignment.

For OpenWrt routers:

Install stubby or unbound and point it at Control D’s DoT endpoint:

# /etc/stubby/stubby.yml
upstream_recursive_servers:
  - address_data: 76.76.2.0
    tls_auth_name: "dns.controld.com"
    tls_port: 853

For pfSense/OPNsense:

Use the DNS Resolver (Unbound) with DNS-over-TLS forwarding to Control D’s endpoint.

Per-Device Configuration

If you cannot configure your router, set Control D on individual devices:

Windows:

# Set DNS-over-HTTPS in Windows 11
# Settings > Network > Properties > DNS > Manual > Enable DoH
# Enter: https://dns.controld.com/YOURENDPOINT

macOS: Download the Control D configuration profile from your dashboard. It installs a DoH setting via macOS’s built-in profile system.

Android: Settings > Connections > More Connection Settings > Private DNS Enter: YOURENDPOINT.dns.controld.com

iOS: Install the Control D configuration profile from Safari after logging in to the dashboard.

Control D vs NextDNS

Feature	Control D	NextDNS
Custom rules	Yes	Yes
Per-device profiles	Yes	Yes
DNS-over-HTTPS	Yes	Yes
DNS-over-QUIC	Yes	No
Geo-unblocking / redirects	Yes	No
Free tier query limit	Unlimited (basic)	300,000/month
Analytics	Yes (optional)	Yes (optional)
Price	~$2/month	~$1.99/month
Native apps	Yes	Yes

Control D has an edge in geo-unblocking features and DNS-over-QUIC support. NextDNS has a slightly larger community and more extensive filter list options. Both are solid choices; Control D wins on flexibility, NextDNS wins on community documentation.

Verifying Your Setup

After configuration, verify DNS resolution is going through Control D:

# Check what resolver you are using
nslookup whoami.controld.com

Or visit the Control D status page while logged into your dashboard — it will show whether your current connection is using your profile.

Check for DNS leaks with dnsleaktest.com. You should see only Control D’s resolver IPs, not your ISP’s DNS servers.

Control D is one of the most capable cloud DNS solutions available, particularly for users who want granular per-device control without running their own Pi-hole or AdGuard Home infrastructure.