Alternatives to ctrld

A configurable, multi-protocol DNS forwarding proxy from Control D with policy-based upstream routing. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as ctrld.

  • dnscrypt-proxy

    Encrypts your DNS lookups so your internet provider cannot read or tamper with them, and blocks domains while it is there.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    dnscrypt-proxy is an ISC-licensed encrypted DNS proxy with DoH, DNSCrypt, Anonymized DNS and built-in filtering, not centred on one provider's service.

  • dnsproxy

    A simple DNS proxy server supporting DNS-over-TLS, DNS-over-HTTPS, DNSCrypt and DNS-over-QUIC.

    FreeOpen sourceSelf-hostedCommand line

    dnsproxy from the AdGuard team forwards to DoH, DoT, DoQ and DNSCrypt upstreams with a YAML config, but lacks policy-based routing features.

  • RouteDNS

    A DNS stub resolver, proxy and router with blocklists and DoT, DoH, DoQ and DTLS support.

    FreeProprietaryLinuxSelf-hostedCommand line

    RouteDNS offers flexible routing between resolvers with DoT, DoH, DoQ and DTLS plus built-in blocklists, but it is not open source.

  • mosdns

    A plugin-based DNS forwarder with rule-based routing, domain blocking and encrypted DNS support.

    FreeOpen sourceSelf-hostedCommand line

    mosdns provides rule-based routing of domains to different upstreams with DoT, DoH and DoQ, though its documentation is in Chinese.

  • YogaDNS

    A Windows DNS client that intercepts system DNS requests and sends them over encrypted protocols by rule.

    FreemiumProprietaryWindows

    YogaDNS gives Windows users per-hostname and per-interface routing over encrypted protocols with a graphical client, but it is closed source and freemium.

  • Blocky

    Lightweight DNS proxy with blocklists, written for container deployments.

    FreeOpen sourceWindowsmacOSLinuxSelf-hostedCommand line

    Blocky is an Apache-2.0 DNS proxy with encrypted upstreams and per-client blocking groups, configured in YAML and aimed at container deployments.

  • Stubby

    Local DNS stub resolver that encrypts queries with DNS-over-TLS.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Stubby encrypts system DNS with DNS-over-TLS only and a strict no-fallback profile, without routing rules or split-horizon support.

  • AdGuard DNS CLI

    A lightweight cross-platform DNS client that forwards a machine's DNS requests to AdGuard DNS.

    FreeOpen sourceWindowsCommand line

    AdGuard DNS CLI is a lightweight local forwarder built around the AdGuard DNS service instead of Control D, with YAML configuration and a Windows MSI.

Similar software

Related functionality, not a direct replacement.