OPEN SOURCE DNS FILTERING
A free, open source DNS filter that blocks unwanted domains across your network. Self-host it, understand your DNS traffic, and set rules for each device.
Free to deploy, use, and extend. AGPL-3.0 licensed.
YOUR NETWORK, AT A GLANCE
| Domain | Type | Status |
|---|---|---|
| metrics.example | A | Blocked |
| docs.rust-lang.org | A | Allowed |
| ads.example | AAAA | Blocked |
| nas.home.arpa | A | Allowed |
01 / A SMALL CHANGE AT THE SOURCE
Point your router or individual devices at DNS Deny. It checks requested domains against your rules before asking an upstream resolver for an answer.
Laptop. Phone. TV.
Devices using your DNS.
Your blocklists.
Your device policies.
Resolved by your chosen upstream.
The unwanted lookup stops here.
DNS filtering works at the domain level. It cannot remove every ad or control devices that bypass your DNS.
02 / CONTROL YOU CAN ACTUALLY USE
See the requests. Adjust the rules.
Keep your network working the way you want.
Import DNS-compatible Adblock rules, hosts files, or plain domain lists. Contextual browser and cosmetic rules are skipped. Organize subscriptions into categories with automatic 6-field cron refreshes, write custom domain and regex rules, and let explicit allow rules handle essential exceptions.
Stream real-time lookups with the live query feed. Inspect query verdicts, response times, client IPs, and upstream activity. Queries are logged asynchronously to local SQLite with configurable retention days and one-click CSV export.
Assign friendly aliases to devices by IP and MAC address. Configure time-of-day and day-of-week schedules for bedtimes or focus hours, set per-device policies, or pause network-wide protection temporarily with a single tap.
Toggle one-click blocks for popular streaming, social media, and gaming platforms, or group custom wildcards. Enforce strict SafeSearch rewrites on Google, Bing, YouTube, and DuckDuckGo, and catch threats with automated sinkhole discovery.
Forward outbound lookups over DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH) with strict TLS SNI verification. DoT and DoH encrypt traffic between DNS Deny and your upstream resolver. Optional local DNSSEC validation checks signed DNS data for authenticity and integrity; it does not encrypt queries or authenticate unsigned zones.
Map internal infrastructure with custom local A, AAAA, and CNAME records so your home lab, NAS, and smart devices have clean names like nas.home.arpa. Configured local names are answered locally and excluded from threat discovery. External CNAME targets are resolved separately.
An in-memory L1 cache and weighted L2 cache reuse answers until their DNS TTL expires. Negative answers are cached too. Required policy and threat checks still apply to repeat queries.
Manage your resolver through the responsive, server-rendered dark dashboard or automate everything with the authenticated /api/v1/* JSON REST API. Modular Cargo build flags let you compile full, UI-only, API-only, or resolver-only binaries.
COMPLETE APP FUNCTIONALITY
Every feature runs locally on your machine with zero external accounts, third-party trackers, or cloud subscriptions.
nas.home.arpa)/api/v1/* endpoints authenticated with Bearer tokens03 / FREE SOFTWARE, REAL OWNERSHIP
DNS Deny is free to deploy, use, and extend under the GNU Affero General Public License v3. Run it for your home, your lab, or your own project.
Read the full license$0license fee
You provide the hardware and hosting. Read the AGPL terms when modifying or sharing the software.
04 / PUT IT ON YOUR NETWORK
Choose AMD64, ARM64, or the original Pi Zero. Install a Debian package, build an executable, or use Docker Compose. Set a unique admin password. Local HTTP works by default; HTTPS enforcement is configurable.
Choose your installationAMD64 · ARM64 · Pi Zero
Debian packages · Single binary · Docker
You manage the server, updates, and network configuration.
git clone https://github.com/dre-zouhair/dns-deny.git
cd dns-deny
# Set your admin password in deploy/config.toml first.
docker compose -f deploy/docker-compose.yml up -d --buildConfigure first, then start. The guide covers ports, credentials, local HTTP, and HTTPS enforcement.
No DNS Deny account or software subscription is required. You run the service on your infrastructure and sign in to your own dashboard. Hardware, hosting, and network access are yours to arrange.
No. DNS Deny blocks matching domains. Ads served from the same domain as content can be difficult to separate, and devices using another DNS service can bypass your rules. Your blocklists and network configuration determine coverage.
Yes. You can assign friendly aliases to devices by IP or MAC address, configure automated time-of-day/day-of-week schedules (such as bedtimes or study hours), or pause protection network-wide or per-device with a single click (from 5 minutes up to 48 hours).
Yes. Forwarded queries can use DNS-over-TLS (DoT on port 853) or DNS-over-HTTPS (DoH on port 443) with strict TLS SNI verification. Optional local DNSSEC validation verifies signed DNS data and rejects invalid signatures. DNSSEC does not encrypt traffic or authenticate unsigned zones.
Yes. DNS Deny includes a local DNS engine for custom A, AAAA, and CNAME records. Configured local names (such as nas.home.arpa or router.lan) are answered locally and excluded from public threat discovery. If you configure a CNAME to an external name, only that target is resolved externally. Local answers still obey your filtering rules.
DNS Deny runs on your server. Forwarded queries go to the upstream resolvers you configure. Query logging, when enabled, is stored in SQLite on your server; you control retention. Encrypted upstream protocols are available through configuration.
Yes, under the GNU AGPL v3. Review the full license for the conditions that apply to modification, distribution, and modified versions made available over a network.
A machine you manage, a supported deployment setup, and the ability to change your devices’ or router’s DNS settings. Use the installation guides to choose your architecture and package, binary, or Docker setup. Configure a unique admin password and HTTPS access before exposing the dashboard.