u/DNSDaddyDev

Hey r/pihole,

I’m the author of DNS Daddy, an open-source project you run yourself (self-hosted only — there is no public resolver to point at).

It is a forwarding DNS resolver that:

Blocks known-malicious domains using public threat feeds (malware, phishing, C2, cryptomining by default)
Logs every query with the client and a plain-English reason for any block
Supports different policies per network (CIDR or per-client DoH URL)
Serves plain DNS / DoH / DoT and forwards upstream over DoT by default
Includes experimental behavioural detectors that only alert (they never block)

How it differs from a typical Pi-hole setup
Pi-hole is excellent for ads/trackers. DNS Daddy is more focused on security-oriented blocking plus clear visibility into which device asked for what and why it was stopped. Instant allow-listing is also built in (cache is purged immediately).

Important notes

Experimental proof-of-concept, not audited, single maintainer
Large parts written with AI assistance (stated openly)
Not recursive, no local DNSSEC validation, no clustering
You run it yourself — there is no public DNS service associated with the project

Try the isolated lab (doesn’t touch your existing Pi-hole)

Bash

git clone https://github.com/jameshoulder/dnsdaddy.git
cd dnsdaddy
docker compose --profile lab up --build
# dashboard → http://127.0.0.1:8081

Links:

Looking for feedback on real-world usefulness, false positives, and how the visibility features compare with Pi-hole workflows. Happy to answer questions.

Thanks for reading.

Self-hosted protective DNS project focused on threat blocking + visibility (malware/phishing/C2) – feedback welcome