Open source alternative to NextDNS, Control D and AdGuard DNS
Last verified
Run a self-hosted DNS resolver that blocks ads, encrypts lookups, and ties every query to the device that asked it, with an explained log.
TelltaleDNS runs on a Raspberry Pi with Docker Compose and replaces the router's upstream DNS. Per-device rules mean the work laptop can use different blocklists than smart TVs. The web UI shows every query with its explanation, so diagnosing why an app broke after a rule change takes seconds.
You need a managed service with no server to maintain. NextDNS and Control D handle DNS filtering with no hardware beyond a router setting.
TelltaleDNS names Kubernetes pods by their workload identity in the query log, so a misconfigured service making unexpected outbound calls appears with its pod name. The Helm chart deploys into an existing cluster with one persistent IP for DNS and the web UI.
Your cluster DNS is handled by a service mesh or cloud provider DNS with built-in observability, and you do not need per-pod visibility at the query level.
TelltaleDNS recognizes device types (Roku players, cameras, thermostats) from the maker prefix and DNS patterns, and suggests names and groups. Children's devices can get a different upstream with safe search enforced; IoT devices can be isolated to their own group with stricter blocking.
You have only one or two devices and no need for per-device policy. A simple Pi-hole setup covers ad blocking at that scale with less configuration.
Cloud DNS filtering services like NextDNS, Control D, and AdGuard DNS make network-wide ad blocking easy, but they come with a tradeoff: your devices' query logs travel to and are stored on someone else's infrastructure. For households and teams with strict privacy requirements, that sends the very metadata those services promise to protect somewhere outside your control.
Even when privacy is acceptable, the visibility these services offer is limited. They report per-account aggregate stats. If one device on your network is making unusual queries, or if you want different blocking rules for a work laptop, a smart TV, and a child's tablet, cloud DNS services either lack per-device policy at that granularity or charge more for it. Setting up those policies and understanding why a specific query was blocked or allowed requires digging through vendor-specific dashboards, not an open log on your own machine.
Every query in the log is tied to a named device, timed per stage (listener, cache, filter, upstream, response), and annotated with why it was blocked or allowed, down to the specific blocklist and line. The explanation is on every row, not just on blocked entries.
Each device or VLAN gets its own blocklists, service-blocking categories, schedules, safe search setting, and upstream servers. Changes can be previewed against yesterday's real traffic before saving, so you can see the effect without a live rollout.
Supports DoT, DoH, and DoQ to your devices and to your upstreams, plus DNSSEC validation. Full recursion is available for setups that prefer not to forward queries at all. All three encrypted protocols work as both listener types and upstream targets.
A single binary artifact runs on a Raspberry Pi, in Docker, and in Kubernetes. The same config and management plane spans all three. A Helm chart deploys resolver pods with one persistent IP, and a Pi can join as a second server for DNS failover.
The binary image is about 13 MiB; the resolver idles at about 14 MiB of RAM. With 2.7 million blocked names loaded, it uses about 50 MB on a Raspberry Pi 4. Cached and blocked answers arrive within 250 microseconds of the query at load, measured from another machine.
Exposes Prometheus metrics out of the box, with a prebuilt Grafana dashboard included in the repository. No separate instrumentation is required to get query counts, latency, block rates, and device-level stats into Grafana.
NextDNS is a cloud DNS filtering service that blocks ads and trackers across all devices on an account. Both tools provide per-device rules and encrypted DNS, but they diverge on where query logs are stored.
| Feature | TelltaleDNS | NextDNS |
|---|---|---|
| Hosting | Self-hosted | Cloud managed |
| License | Apache-2.0 OR MIT | Proprietary |
| Query log | On your server | NextDNS servers |
| Kubernetes support | Yes (Helm chart) | No |
| Pricing | Free (self-hosted) | Paid service |
TelltaleDNS is the better fit when query logs staying on your network is a requirement, when you want per-entry explanations showing exactly why each query was blocked or allowed, or when you need DNS policy in a Kubernetes cluster. NextDNS is the better fit when you want managed filtering with no server to maintain and prefer a service with years of track record.
Control D is a paid DNS service with per-device filtering, custom redirect rules, and content categories. TelltaleDNS covers the core ad-blocking and per-device rule use case; Control D adds a broader set of redirect and content policies under a managed cloud model.
| Feature | TelltaleDNS | Control D |
|---|---|---|
| Hosting | Self-hosted | Cloud managed |
| License | Apache-2.0 OR MIT | Proprietary |
| Per-device filtering | Yes | Yes |
| Query log | On your server | Control D servers |
| Pricing | Free (self-hosted) | Paid service |
TelltaleDNS is the better fit for teams that want all DNS data on-premises and query-level explanations per device. Control D is the better fit when you want a no-infrastructure managed service with per-device profiles and do not need on-network log retention.
AdGuard DNS is a commercial cloud DNS service that blocks ads and trackers across all network devices. Like NextDNS, it handles filtering without any infrastructure on your side, while TelltaleDNS requires a self-hosted server.
| Feature | TelltaleDNS | AdGuard DNS |
|---|---|---|
| Hosting | Self-hosted | Cloud managed |
| License | Apache-2.0 OR MIT | Proprietary |
| Per-device rules | Yes | Yes (paid tier) |
| Query log | On your server | AdGuard DNS servers |
| Pricing | Free (self-hosted) | Paid service |
TelltaleDNS is the better fit when data privacy requires that query logs never leave your network, or when your infrastructure spans Kubernetes alongside home hardware. AdGuard DNS is the better fit when you want a managed service with no server maintenance and an established, widely deployed user base.
Deploy on any Linux host or Raspberry Pi using Docker Compose.
```bash
mkdir telltale && cd telltale
curl -fsSLO https://raw.githubusercontent.com/paimonsoror/telltaledns/main/deploy/compose/compose.yaml
curl -fsSLO https://raw.githubusercontent.com/paimonsoror/telltaledns/main/deploy/compose/telltale.toml
docker compose up -d
docker compose exec telltale telltale auth setup-token
```Pre-1.0 tagged releases are marked stable in the README and the latest tag tracks them. The edge builds track every commit to main. Blocking, the web UI, and clustering all function in the current release. Configuration keys and APIs may still change before 1.0, but release notes document every such change.
Yes. TelltaleDNS reads Pi-hole's blocklist formats, regex rules, and Teleporter exports as-is. It also reads the Technitium DNS Server API to import an existing configuration. The project site links to migration guides for both paths.
TelltaleDNS is licensed under Apache-2.0 OR MIT at the user's option, both OSI-approved permissive licenses. You can run it internally for a business, modify it, and redistribute it without restriction. Neither license requires you to open-source modifications unless you choose to distribute them.
The binary image is about 13 MiB and runs on amd64, arm64, and 32-bit Pi OS. On a Raspberry Pi 4 with 2.7 million blocked names loaded, the resolver uses about 50 MB of RAM and idles at about 14 MiB. It runs on any Linux host with Docker, as a systemd service, or in a Kubernetes cluster via Helm chart.
Yes. TelltaleDNS accepts queries over DoT, DoH, and DoQ from devices that support encrypted DNS, so no agent or proxy is required on the device. For devices that only support plain UDP DNS, it answers plain queries as well. Outgoing queries from TelltaleDNS to your chosen upstream resolvers also use encrypted protocols where the upstream supports them.
Alternative to
NextDNS
DNS sinkhole blocking ads for every device on your network.
Alternative toNextDNS
Pi-hole-style DNS ad-blocker on a $2 ESP32-C3 board
Alternative to
Datadog
Self-hosted enterprise monitoring with agent and agentless collection.
Alternative toDatadog
Uptime, on-call, incidents, logs, and traces; one open source product.
Alternative toDatadog
Self-hosted monitoring server for infrastructure and network checks.
Alternative toDatadog
Hybrid IT monitoring with auto-discovery and 2,000+ integrations.
Self-host Telltaledns on a Hostinger VPS
Keep it running 24/7, even when your laptop is off. A Hostinger VPS gives it a server of its own.
Choose a plan
Starts from $6.49/mo
Apply
Extra 10% off yearly plans
Install Telltaledns
On a server that stays on
Start building
Focus on the app, not the server
Sponsors
Alternative to
Superhuman
AI email assistant that drafts replies and clears your inbox
Alternative to
Grok Bot
AI teammates you own: your keys, your model, your machine.
Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.
The projects we add and every new guide. Free, unsubscribe any time.
Claude Code to 
OpenCode
Jira to 
Windshift
Notion to 
AppFlowy
Slack to 
Mattermost
Linear to 
GitLab
Wispr Flow to 
Handy
Arc to 
Zen Browser
CapCut to 
Concat
Grok Bot to 
rakazo
Superhuman to 
Inbox Zero
Discord to 
Stoat
Airtable to 
AITable
Datadog to 
SigNoz
Muse to 
OpenClaw
Railway to 
Coolify
GitHub Copilot to 
ClineConfluence to 
Wiki.js
Microsoft Teams to 
Rocket.Chat
1Password to 
KeePassXC
Firebase to 
Supabase
Pinecone to 
Qdrant
Zapier to 
n8n
Devin AI to 
OpenHands
Asana to 
Leantime
