ControlD has quietly become one of the most capable filtering DNS resolvers available without requiring a VPN subscription. Built by Windscribe, the Canadian privacy company better known for its VPN service, ControlD has matured significantly and in 2026 stands as a credible alternative to NextDNS, AdGuard DNS, and Cloudflare's 1.1.1.1 for households and IT professionals who need granular control over what their network resolves. This review covers actual performance, filtering logic, privacy posture, platform-by-platform setup, and where ControlD still has rough edges.

What ControlD Actually Is

ControlD is a recursive DNS resolver with a policy engine sitting in front of it. When your device sends a DNS query, ControlD checks it against your configured rules before forwarding to an upstream resolver — or blocking, redirecting, or spoofing the response entirely. That last capability — DNS redirection — is unusual: paid accounts can point a domain to a different IP, useful for split-horizon setups or staging environment overrides without modifying /etc/hosts on every machine.

The free tier gives you access to four preconfigured filter profiles using shared resolvers. Paid plans (approximately $2 USD per month billed annually) unlock per-device unique resolvers, custom rule sets, query analytics, and the ctrld daemon for enforced system-wide DNS. You do not need a Windscribe VPN subscription — ControlD is a completely separate product.

Free Resolver Endpoints

If you want a filtering DNS resolver without creating an account, ControlD's free shared endpoints cover four hardening levels. These are the stable addresses as of mid-2026:

  • Malware only (p0): DoH at https://freedns.controld.com/p0, DoT hostname p0.freedns.controld.com, legacy IPv4 76.76.2.1
  • Ads and malware (p1): DoH at https://freedns.controld.com/p1, DoT hostname p1.freedns.controld.com, legacy IPv4 76.76.2.2
  • Social, ads, and malware (p2): DoH at https://freedns.controld.com/p2, DoT hostname p2.freedns.controld.com, legacy IPv4 76.76.2.3
  • Family and strict (p3): DoH at https://freedns.controld.com/p3, DoT hostname p3.freedns.controld.com

The unfiltered ControlD resolver sits at 76.76.2.0 (IPv4) and 2606:1a40:: (IPv6). This is useful as a performance baseline or when you only want encrypted DNS transport without content filtering.

💡 Before switching your router or OS DNS, verify your new resolver is responding correctly. The DNS Propagation Checker can confirm whether your domain resolves from the right nameservers after a change.

Protocol Support in 2026

ControlD supports all four modern DNS transport protocols, which matters as operating systems increasingly default to encrypted DNS:

  • DNS over HTTPS (DoH) — Port 443, survives firewalls, supported natively in Chrome, Firefox, Windows 11, macOS Ventura and later, iOS 14 and later, Android 9 and later.
  • DNS over TLS (DoT) — Port 853, preferred for router-level configuration and Linux systemd-resolved deployments.
  • DNS over QUIC (DoQ) — UDP-based, lower latency on mobile networks, supported by the ctrld daemon and AdGuard Home 2.x.
  • Legacy plain DNS — UDP and TCP on port 53, available for older devices or environments where encrypted transport cannot be negotiated.

DNSSEC validation is on by default across all ControlD resolvers. If an upstream zone has a misconfigured DNSSEC signature you will see SERVFAIL responses — this is expected behavior and not a ControlD bug. With DNSSEC adoption now exceeding 30 percent of TLD zones, this edge case surfaces more frequently than it did three years ago.

Performance: Latency Benchmarks

Raw DNS latency depends on your ISP and proximity to ControlD's anycast points of presence. ControlD operates PoPs across North America, Europe, Asia-Pacific, and South America. Most Canadian and US users see 5 to 20 ms median latency over DoH — competitive with NextDNS and faster than Quad9 in the majority of North American measurements from 2025 and early 2026.

To benchmark ControlD against your current resolver from the command line:

# DoT latency — Linux or macOS with BIND dig time dig @p1.freedns.controld.com -p 853 +tls example.com # DoH latency via curl time curl -s -H 'accept: application/dns-json' \ 'https://freedns.controld.com/p1?name=example.com&type=A' # Five UDP queries to average latency for i in {1..5}; do time dig @76.76.2.2 example.com A +noall +answer; done

Compare those results against Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8), and your ISP's resolver under identical conditions. Latency differences under 10 ms have no measurable impact on browsing; they matter only for gaming or applications issuing hundreds of DNS lookups per second.

Filtering Capabilities

Filtering is where ControlD differentiates itself from bare resolvers. On a paid account, the policy engine offers:

  • Curated block lists — dozens of maintained lists covering ads, malware, phishing, telemetry, adult content, and regional trackers. Each list shows domain count and last-updated date in the dashboard.
  • Service-level blocking — block entire platforms (TikTok, Facebook, Netflix, gaming services) as a named toggle rather than chasing every CDN subdomain. ControlD maintains these service definitions as platforms change infrastructure.
  • Custom rules — allow, block, or redirect individual domains and wildcard patterns such as *.tracker.example.com. Redirect rules can point a hostname to any IP including 0.0.0.0 for a null sink or a local server IP for split-horizon DNS without running a second resolver.
  • Multiple profiles — named rule sets assignable per device or per network. A practical setup: strict profile on children's tablets, permissive profile on developer machines, locked-down profile for smart home devices.
  • Scheduled rules — block a service on a recurring time schedule, such as disabling social media domains on weekdays from 9am to 3pm.

Filtering accuracy on mainstream block lists is solid. In testing, ControlD's combined ads and malware profile blocked a higher percentage of known ad-serving domains than Cloudflare's 1.1.1.1 for Families, and performed roughly comparably to NextDNS with equivalent lists enabled. No DNS-based filter catches fast-flux malware domains or freshly registered phishing pages — DNS blocking is one defensive layer, not a complete endpoint security solution.

Privacy Posture

ControlD is operated by Windscribe Inc., incorporated in Ontario, Canada. Their published privacy policy as of 2026 states the following:

  • Free accounts: query logs retained for 24 hours by default for debugging; this can be disabled in account settings.
  • Paid accounts: logging is off by default; you can enable it voluntarily to gain access to the query history and analytics dashboard.
  • No query data is sold to third parties.
  • The free shared resolvers (p0 through p3) require no account and cannot be tied to any identity.

Canada is a Five Eyes member state, which is the legitimate threat-model concern. If your threat model includes DNS-level surveillance from state actors, ControlD does not offer the same assurances as operating your own unlogged recursive resolver. For the practical threat model of most households — ISP traffic profiling, ad targeting, protecting children's devices — ControlD's policy is more than adequate.

For context on why HTTPS browsing still leaks DNS metadata without encrypted DNS, the Cloudflare DNS explainer gives a clear overview of how plaintext DNS queries expose browsing history to your ISP regardless of TLS at the web layer.

Setting Up ControlD by Platform

Windows 11

Windows 11 has native DoH support in TCP/IP settings. Go to Settings → Network and Internet → your adapter → DNS server assignment → Edit → Manual → IPv4, enter 76.76.2.2 as the preferred server, then set the DoH dropdown to On (automatic template). Windows negotiates DoH automatically once it verifies the server supports it.

# Confirm active DNS resolver from PowerShell Get-DnsClientServerAddress -AddressFamily IPv4 # Verify you are hitting ControlD nslookup whoami.controld.com

macOS (Ventura, Sonoma, Sequoia)

Apple's native DoH and DoT enforcement requires a signed configuration profile. In the ControlD dashboard, go to Setup Guide → Apple → macOS, download the generated .mobileconfig file, double-click to install, then approve it under System Settings → Privacy and Security → Profiles. All DNS queries route through your ControlD profile with no app needing to stay running.

# Confirm resolver from Terminal scutil --dns | grep nameserver # Test a query directly against ControlD dig @76.76.2.2 example.com

Linux (systemd-resolved)

Edit /etc/systemd/resolved.conf and add the following block:

[Resolve] DNS=p1.freedns.controld.com DNSOverTLS=yes DNSSEC=yes

Apply changes and verify:

sudo systemctl restart systemd-resolved resolvectl status resolvectl query example.com

On Ubuntu 24.04 and later, systemd-resolved is the default stub resolver and this method works cleanly. On systems using NetworkManager directly, set DNS per connection with nmcli con mod "My Connection" ipv4.dns "76.76.2.2" then bring the connection up again.

iOS and Android

  • iOS: For system-wide enforcement across both Wi-Fi and cellular, install a ControlD-generated .mobileconfig profile from the ControlD dashboard. Per-network Private DNS settings in iOS do not apply to LTE or 5G without a profile installed — this is a common oversight.
  • Android 9 and later: Settings → Network and Internet → Private DNS → Private DNS provider hostname. Enter a ControlD DoT hostname such as p1.freedns.controld.com. This applies globally including mobile data connections.

Router-Level Setup

Setting DNS at the router protects every device on the network without per-device configuration. Exact firmware paths by brand:

  • Asus (AsusWRT, 192.168.1.1): Advanced Settings → WAN → WAN DNS Setting → set Automatically connect to DNS server to No, enter 76.76.2.2 as DNS Server 1. For DoT: Advanced Settings → WAN → DNS Privacy Protocol → DNS over TLS, Server 1 hostname: p1.freedns.controld.com.
  • TP-Link (tplinkwifi.net): Advanced → Network → Internet → DNS → enter custom IPs. DoT is available on Deco mesh and newer Archer models under Advanced → Security → DNS over TLS.
  • Netgear (routerlogin.net): Internet → Domain Name Server Address → Use These DNS Servers → enter preferred and alternate IPs.
  • Linksys (linksyssmartwifi.com): Connectivity → Local Network → DHCP Server → Static DNS 1 and Static DNS 2.
  • OpenWrt: Install the https-dns-proxy package with opkg install https-dns-proxy, configure /etc/config/https-dns-proxy with your ControlD DoH URL, then set the DHCP DNS override to 127.0.0.1 on port 5053 so clients receive the proxy address.
  • DD-WRT: Services → DNSMasq → Additional Options, add server=76.76.2.2. For DoT, install stubby via the Entware package layer and configure it to forward to ControlD's DoT hostname.

After a router DNS change, DHCP clients inherit the new resolver only after their lease renews. Force it immediately: Windows — ipconfig /renew; macOS — sudo ipconfig set en0 DHCP; Linux — sudo dhclient -r followed by sudo dhclient.

The ctrld Daemon

Paid subscribers can install the lightweight ctrld daemon, which handles DNS enforcement at the OS level, supports DoQ for reduced latency, and automatically reconfigures when you switch between Wi-Fi, VPN, or cellular connections. It is the recommended approach for laptops that move between networks. Install on Linux or macOS:

sh -c "$(curl -fsSL https://api.controld.com/dl)" # Follow the interactive setup — your resolver ID is in the ControlD dashboard sudo ctrld start sudo ctrld status

GUI installers for Windows and macOS are available in the ControlD dashboard under Setup Guide → Apps. The daemon also adds split-DNS capability, letting you route specific domains through a VPN resolver while sending everything else to ControlD.

How ControlD Compares in 2026

The filtering DNS space has several mature options. An honest comparison:

  • NextDNS — similar feature set with a richer query analytics dashboard and a larger community configuration library. Free up to 300,000 queries per month, then $1.99/month. NextDNS edges ControlD on debugging depth and third-party block list availability. ControlD edges NextDNS on DNS redirection, service-level blocking toggles, and native DoQ support.
  • Cloudflare 1.1.1.1 for Families — the fastest resolver globally due to deep anycast infrastructure, but offers zero per-query control. No custom rules and no analytics. Best when you only need basic malware blocking with maximum speed and zero configuration overhead.
  • Quad9 (9.9.9.9) — Swiss non-profit, strong malware block list built from threat intelligence feeds, no ad blocking, no custom rules. Best for organizations that want a neutral third party with a purely threat-focused posture.
  • AdGuard DNS — strong ad blocking focus, free and paid tiers. Comparable to ControlD's ads filtering profile but with fewer advanced routing and redirection features.

For power users managing multiple devices across different use profiles, ControlD's paid tier at approximately $24 per year is one of the strongest value propositions in the filtering DNS market in 2026.

💡 Use the DNS Lookup tool to confirm that blocked domains return 0.0.0.0 or NXDOMAIN after enabling a ControlD filter profile — a quick sanity check before relying on the filtering for real security coverage.

Common Misdiagnoses

  • ControlD broke my site: Almost always DNSSEC validation rejecting a misconfigured zone, not ControlD blocking it. Run dig +cd domain.com to disable DNSSEC checking locally. If that resolves, the zone has a bad or expired DNSSEC signature that needs fixing at the registrar — not a ControlD configuration issue.
  • Ads are not being blocked: Browsers can override OS and router DNS with built-in DoH. Chrome and Firefox both default to Cloudflare or Google DoH in many regions, bypassing your OS resolver entirely. Disable in-browser DoH: Firefox → about:config → set network.trr.mode to 5; Chrome → Settings → Privacy and Security → Use Secure DNS → off.
  • ControlD is slower than ISP DNS on my router: DoT handshakes are CPU-intensive on budget router hardware with weak TLS stacks. Plain UDP to a ControlD IPv4 address is significantly faster in that scenario. Use plain DNS at the router and rely on device-level DoH if transport encryption matters.
  • Filtering does not work on iPhone over cellular: iOS Private DNS settings apply per Wi-Fi network and do not cover LTE or 5G without an installed .mobileconfig profile. The profile from the ControlD dashboard is the only solution for full-device coverage on iOS.

CLI Verification After Setup

After any DNS configuration change, these commands confirm the resolver is active and filtering is behaving as expected:

# Which resolver profile is actually answering your queries dig whoami.controld.com TXT # Verify a known ad domain is blocked (expect 0.0.0.0 or NXDOMAIN with p1+) dig doubleclick.net A # Test DNSSEC enforcement (expect SERVFAIL on a validating resolver) dig dnssec-failed.org A # Measure resolver latency dig @76.76.2.2 example.com A +stats | grep "Query time"

The whoami.controld.com TXT record returns your resolver profile name. It is the fastest way to confirm your configuration is actually routing through ControlD rather than silently falling back to a cached ISP resolver — check it first before deeper troubleshooting.

2026 Notes: IPv6, Default DoH, and DNSSEC Growth

Three infrastructure shifts in 2026 directly affect ControlD deployments:

  • IPv6 is now majority traffic on many residential ISPs. Configure both an IPv4 resolver (76.76.2.x range) and an IPv6 resolver (2606:1a40::) at the router and OS level. Configuring only IPv4 DNS means IPv6-capable hosts fall back to the ISP resolver for AAAA lookups, bypassing all filtering on dual-stack connections — a gap that was minor in 2023 but is significant today.
  • Browsers default to DoH in 2026. Chrome 119 and later and Firefox 124 and later default to DoH in regions where it is available, often routing through Cloudflare or Google regardless of OS DNS settings. For network-wide ControlD enforcement, configure the browser DNS settings explicitly or deploy the ctrld daemon, which intercepts DoH at a lower level than browser preferences.
  • DNSSEC failures are more visible than ever. As more registrars enable DNSSEC by default, zones with expired or misconfigured key material produce intermittent SERVFAIL responses. These are zone configuration issues — not ControlD faults — but they surface more on validating resolvers than on ISP resolvers that silently ignore DNSSEC errors.

The authoritative technical specification for DNS over HTTPS is RFC 8484 from the IETF, which defines the wire format and discovery mechanisms that all compliant DoH implementations, including ControlD's, are required to follow.

Verdict

ControlD earns its place in the filtering DNS tier. The free shared resolvers at p0 through p3 are a genuine upgrade over your ISP's default DNS — zero cost, zero account required, meaningful security improvement on day one. The paid tier at roughly $24 per year is worth it if you manage multiple devices across different use profiles, want per-query analytics, or need DNS redirection for network engineering work. The main gap compared to NextDNS remains the query analytics dashboard, which is functional but not as detailed for debugging unusual resolution failures. For most households and small offices that need ad blocking, malware filtering, and per-device profiles without running a self-hosted resolver like Pi-hole, ControlD in 2026 is a reliable, actively maintained choice.