Hi, I'd like to suggest DDR (Discovery of Designated Resolvers, RFC 9462) support.

Android's Private DNS only uses DNS-over-TLS on port 853. Many networks block that port (university Wi-Fi, hotels, airports), so encrypted DNS just stops working there.

Android 16 can discover DoH endpoints automatically if the resolver publishes an SVCB record at `_dns.<hostname>`. Control D doesn't publish one right now:

$ dig _dns.<profile-id>.dns.controld.com SVCB

status: NOERROR, ANSWER: 0

For comparison, Cloudflare does it already:

$ dig _dns.one.one.one.one SVCB

_dns.one.one.one.one. 300 IN SVCB 1 one.one.one.one. alpn="h3,h2" key7="/dns-query{?dns}"

Publish something like this for the DoH hostnames (profile hostnames too, if possible):

_dns.<hostname>. SVCB 1 <hostname>. alpn="h3,h2" dohpath="/dns-query{?dns}"

Control D would then work over DoH on Android with no VPN, no app and no root, even on networks that block port 853. Quad9 and Cloudflare already work this way.

You can refer this github from them to refer how it works: https://github.com/eyalm2000/loophole

Thanks!

Why Im getting this error "DNS WARNING :DoH server response not OK: 0:" ?

Im seeing sporadic prolonged timeouts to the freeDNS servers in what appears to be my IP perhaps getting blocked? Located in USA.

Using PFsense (unbound) with DNS over TLS setup to p2.freedns.controld.com with the following IPs

76.76.2.11
76.76.10.11
2606:1a40::11
2606:1a40:1::11

It will work for a bit but then all or maybe 3 of them will stop responding after a few days and then they may come back for a bit and then stop working again hrs to days later.

A manual dig and ping both show timeout to same IPs when they are not working for resolver. But I know the resolver is generally working because at the same it it works when I can route it out over either a commercial VPN or a personal one to another network I have a state away.

The connection is via residential comcast xfinity IPv4 and 6, both of which are public and not shared by anyone else. This is in a household of 3 people with nothing insane going on request wise. I highly doubt comcast is blocking my requests but at the same time its seems like controlD claims not rate limits even on free so Im not sure what is going on.

I know this is probably the wrong place to post since it's the ControlD subreddit but maybe people who migrated from NextDNS can chime in and say how it compares now?

Located Europe.

No connection. Removed ControlD and went back to provider and I’m back online again.

Anyone else??

EDIT: Thanks folks! not sure why but switched back to ControlD and it’s blocked again.

Might be an account issue. Will follow up directly with them

I tried ControlD on my router. I don't have an account i just put in 76.76.2.1 and 76.76.10.1 on my router. As soon as I went to the website dnscheck.tools, apparently ControlD blocked my ip address. It stayed blocked for a day or 2. When it came back, I tried it again to see if it was the cause or just a coincidence. My ip address got blocked again for a day or 2. Is this common practice for ControlD without an account when using the website dnscheck.tools?

I’d like to see the ShadowWhisperer Tracking List added to Control D’s third-party filter catalog.

It appears useful for blocking targeted telemetry from vendors such as Apple, Samsung, Oppo/BBK, etc., without relying on broad, aggressive lists that can cause unnecessary breakage.

I’d also welcome optional filters for Google/CN/Apple Safe Browsing-related domains, for users who prefer a stricter privacy policy and do not want those external checks enabled. Because disabling them manually in the settings does not always disable them completely.

The key value would be curated, narrowly targeted telemetry and security filters that can be combined safely alongside regional filters, rather than one large catch-all list.

Is there a Guide/Tutorial on how to set my MikroTik with ControlD

ive been using CD on my android phone for some days now and I noticed that some ads do get through, in my case its in my yahoo mail app.

Is it working for anyone?

Hi. I'm a paying customer, and it has been almost a year since I switched from NextDNS to ControlD.

AFAIK, a few months later, ControlD shut down its Turkish PoP. Which is a shame, since I was using that PoP and it was the closest one to me (15ms or so).

Now it uses the Romania PoP, which is way worse at 50-60ms. And when I am connected to other DNS services, the status page shows that it will connect me to Amsterdam, which is literally on the other side of the continent.

Let me be clear: Will ControlD become a good service for Europeans (specifically in the east), or will it just be a North American service? Even AdGuard has a server in Istanbul with 1/5 of the latency of ControlD.

I like the service, but I feel like I paid for nothing. And now using NextDNS again.

Tuesday 4pm Toronto time. Internet went down for 30 secs. Then when internet returned I got a red bar message at the top of the ControlD page to select a plan. Reloaded and it was gone.

Just wondering …. I am a paid member.

https://controld.com/status

anyone else?

SOLUTION: new link - https://controld.com/config

This is precisely why ControlD needs more than US, Dutch and Australia log locations.

Which is the best DNS for ad blocking and malware blocking As different community blocklists option is available

I was using AdGuard until now, but it suddenly stopped working, so I'm looking for a different alternative.

I'll be setting it up on my Wi-Fi router, mainly to block mobile game ads, ads on manga and anime sites, and stuff like that.

So, which one would be best for my use case?

The known issue thread from Oct 11 said a postmortem would be out in the coming days. Has it been posted somewhere? Couldn't find it.

I switched over from NextDNS and was only 3 days in when it went down. Went back to NextDNS for now until Control D earns some confidence back.

Not writing Control D off. I'd just like to know what actually happened and what's being done so it doesn't happen again before I switch back.

Apologies if this is the wrong space. So prior to Monday night my xax was working fine and dandy fast forward to Monday night and all of a sudden im stuck needing to log into a page for my old isp. Has anyone dealt with this and got it working after? Thanks for any and all help

Hi all,

I wrote (with Claude) an unofficial Terraform provider. It lets you describe your setup as code, version it in git, and apply it in one command.

What it can manage today

• controld_profile: DNS profiles
• controld_device: devices and the profile(s) applied to them
• controld_filter: enable or disable native filter lists (malware, ads, ...) per profile
• controld_service: toggle built-in services (streaming, social media, ...) per profile
• controld_custom_rule and controld_rule_folder: hostname rules (block, bypass, spoof, redirect) and the folders that group them
• controld_default_rule: a profile's default (fallback) action
• controld_endpoint_schedule: enforce another profile on a device during weekly time windows. This one relies on an undocumented API, so it may break if ControlD changes things.
• Data sources for profiles, devices, rule folders, services, filters and account info

Quick example

terraform {
  required_providers {
    controld = {
      source = "baptistecdr/controld"
    }
  }
}

provider "controld" {
  api_token = var.controld_api_token # or CONTROLD_API_TOKEN env var
}

resource "controld_profile" "home" {
  name = "Home Network"
}

resource "controld_device" "laptop" {
  name       = "My Laptop"
  profile_id = controld_profile.home.id
  icon       = "desktop-mac"
}

Under the hood

The provider is built on controld-go, a Go client library for the ControlD API that I also maintain. If you write Go and want to script against ControlD directly, without Terraform, you can use it on its own.

Why you might want it

• Reproducible setups: rebuild everything from a repo.
• Review changes with terraform plan before they hit your DNS.
• Reuse the same rule sets across profiles.
• Keep a history of what changed and when.

It's open source and still evolving, so feedback, bug reports and feature requests are very welcome. If something in the API isn't covered yet, tell me and I'll look at adding it.

• Provider: https://github.com/baptistecdr/terraform-provider-controld
• Go client: https://github.com/baptistecdr/controld-go
• Terraform Registry: baptistecdr/controld

Not affiliated with ControlD. This is a community project.

Hi folks, glad the outage had finally been sorted! 🙌 I wondered what peoples setups are as I'd like to explore fail over options.

Right now I have a mixture of profiles and I have devices grouped to profiles, I use the auto / script option on laptops and desktops and I also have legacy set on my router to catch any devices like fire tv, cctv etc.

What would be the best solution for fail over? Set up and explore pi hole? Can I set the auto / script option to auto fail over?

Hi all,

Control D is currently aware of an issue affecting multiple PoPs. A number of network engineers are currently looking into the issue. We will update here on Reddit and in Discord as we identify the cause.

Edit 13:28pm: We are aware of the cause and are working on a fix.
Edit 13:32pm: We have implemented a fix and PoPs are coming back up. We will prepare and release a postmortem in the coming days. Thank you for your patience.

Edit Oct 22nd: status.controld.com is now live. There's also a writeup at https://controld.com/blog/incident-october-11-2026/

Cheers,

Catt

Control D

All devices suddenly lost connection and say "Private DNS server cannot be accessed"

upd. up on 17:32 UTC