A DNS-layer filtering service that has grown up in public: born January-April 2021 out of the Windscribe team (same three founders, spun out precisely because Windscribe's no-logging policy collided with the need to identify DNS clients), it spent 2021-2024 as the power users' NextDNS alternative with a unique party trick - redirecting specific domains or services through proxies in 69 countries so you can change your apparent location or skip ads on specific platforms without a VPN - and pivoted hard toward business DNS security in 2025-2026 while keeping $3/$6 personal plans. The evidence posture is genuinely good on one axis and thin on another: its 99.98% malware block rate was independently confirmed by Nexxwave's June 2025 test of 80,762 malicious domains (best of all eight public resolvers tested, zero false positives among Cloudflare's top 1,000), and the Oct 11 2026 incident report is a model postmortem - a 54-minute total outage of paid DNS for every paying customer, own fault, root-caused to an API type-format change, with fixes listed item by item. But the same document admits Control D had no incident status page when its entire paid service went down, a paying customer reports three outages in a year, and there is no independent audit and no transparency report for the logging claims - the trust case rests on unusually specific operator documentation (three-level opt-in analytics, user-selected retention and storage region, source-IP handling spelled out). As privacy scoping: this is DNS filtering with an optional IP-masking proxy, not a VPN - it cannot hide general traffic, and redirected traffic goes through Control D's proxies. For households and self-hosters who want NextDNS-class control with faster resolution and real human support, it is arguably the best tool in class; as an audited no-logs guarantee it is not that.
open source4 red flagsfacts verified - operator pages (homepage, /pricing, /personal, /about-us, /free-dns, /teleport, /network, /features/modern-protocols, /features/traffic-redirection, /privacy, pricing-guide blog, data-collection blog, Oct 11 2026 incident report), docs.controld.com (index, analytics-levels, org-data-retention, activity-log), Privacy Guides DNS recommendations, Nexxwave independent malware-filter test, MakeUseOf review, DNS Benchmark comparison, ghacks 2021 launch coverage, Wikipedia (Windscribe), HN Algolia comment index and arctic-shift r/ControlD archive (comments + posts) all fetched live 2026-11-03. Fetch failures noted: arctic-shift empty-body search returned 429 then 400 (rate limit, then empty-body rejection - body term required, matching the known failure mode documented in the nextdns dossier); arctic-shift body-searches on r/dnscrypt and r/privacy returned 422; reddit.com JSON 403; docs.controld.com/docs/privacy-policy 404; controld.com/plans returned an empty body (client-side render); derekseaman.com 403
October 11, 2026: the entire paid DNS service (Personal and Organization accounts, all protocols, all locations) went down for ~54 minutes because a September API update stored a service override as an integer the DNS software could not read, and an error-handling flaw made every server stop instead of skipping it; automated alerts were wrong, there was no independent status page, and many users learned about it on Reddit/Discord (operator incident report fetched live 2026-11-03) - a single control-plane failure mode that a re-architecture is now addressing
No audit, no transparency report, no warrant canary for a service that sits on the DNS path of paying households and businesses; the honest logging documentation is policy text only
Source-IP retention is structural in places: Legacy DNS requires IP storage for account mapping, and custom-profile resolvers retain the source IP as the policy identifier - the free 'no logging' headline does not describe the paid custom-profile path
+1 more red flags - expand before signing up
Related-party history: the same founders' Windscribe had two VPN servers seized by Ukrainian authorities in June 2021 (self-disclosed, OpenVPN key on disk) and its CEO faced Greek criminal proceedings over a customer's abuse that were dismissed in April 2025 - no Control D-specific legal incident was found, but the lineage is shared
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on Control D (premium encrypted DNS resolver) yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
Control D (premium encrypted DNS resolver) homepage - live capture 2026-09-29
Control D is a configurable encrypted DNS resolver with optional traffic redirection, not a VPN. It filters domain lookups and can proxy specific services through global locations to mask your IP - ideal for ad-blocking, geo-swap, or malware protection. Run by the same team behind Windscribe, it’s based in Canada and built for power users and businesses. Caveat: this tool doesn’t encrypt all traffic, only DNS and selectively proxied services.
Logging & privacy
Control D claims no logging on its free public resolvers, and for paid accounts, logging is user-controlled via opt-in analytics with retention windows from 1 day to 1 month. Evidence is policy-only - no independent audit or transparency report exists. Secure DNS (DoH/DoT/DoQ) avoids storing source IPs by default; legacy DNS requires it for account mapping. Jurisdiction is Canada, a Five Eyes member, but the operator documents data-handling mechanics clearly: storage regions (North America, Europe, Australia), per-endpoint analytics levels, and user-deletable logs. No warrant canary is published.
Pricing & the renewal trap
There is no renewal trap: the monthly rate is flat at $3 for Some Control (filtering, malware protection) and $6 for Full Control (adds traffic redirection). Annual billing offers a 16.67% discount (pay for 10 of 12 months), but the per-month cost remains $3 or $6. No refund window is documented. Payments are fiat-only (cards assumed, not confirmed), with no crypto option. Anonymous signup requires email, but no ID verification (KYC-free). The 3-year total is not computable due to missing multi-year billing events.
Features & performance
Supports DoH, DoT, DoQ, and DoH3 for encrypted DNS, plus legacy UDP 53. Offers traffic redirection through 100+ proxy locations in 69 countries - per-domain or per-service IP masking without a full tunnel. Open-source client (ctrld) available for routers and OSes, with support for Windows, Mac, Linux, iOS, Android, and browsers. No kill switch, split tunneling, or multihop. Servers and country counts are not publicly verifiable. P2P and streaming capabilities are undocumented. Independent testing shows 99.98% malware block rate (Nexxwave, 2025), but we’ve not run our own performance tests.
Ownership & track record
Founded in 2021 by Windscribe’s core team (Yegor Sak, Alex Paguis, Mark Ulicki), Control D operates as CONTROLD, Inc. in Toronto. No community ownership or external audits. Red flags include a 54-minute global outage in October 2026 due to an API format error and flawed error handling, plus no status page at the time. Users report multiple outages and demand enterprise-grade reliability. While the postmortem was transparent, the lack of audit, logging verification, and prior Windscribe server seizures (2021) raise operational concerns. Data quality is verified, but trust rests on policy, not proven no-logs.
Censorship resistance
Control D is not designed for high-censorship environments like China or Iran. While encrypted DNS (DoH/DoT/DoQ/DoH3) resists local snooping, it lacks obfuscation to evade deep packet inspection. The service does not claim to work under state-level blocking. Traffic redirection proxies specific domains but won’t bypass national firewalls. For censorship resistance, this tool is ineffective - use purpose-built solutions with obfuscated protocols instead.
Verdict
Use Control D if you want granular DNS filtering, per-service IP masking, and fast resolution - especially if migrating from NextDNS for better support and redirection features. Avoid if you need audited no-logs, full traffic encryption, or rock-solid uptime. The money trail is clean: no evidence this provider pays review sites, and Privacy Guides recommends it independently.
++ What holds up
Best-in-class malware blocking, independently verified: 99.98% of 80,762 CERT Poland/URLhaus malicious domains blocked in Nexxwave's June 2025 test - the highest of all public resolvers tested, with zero false positives among Cloudflare's top-1,000 domains
Unique traffic redirection: route specific domains, services or all queries through transparent proxies in 69 countries (100+ locations) - IP masking and geo-swaps without a VPN, with per-service granularity no rival offers
Real support repeatedly praised in 2025-2026 HN threads, including a report of the founder personally troubleshooting by email - the exact gap NextDNS users leave over
Logging is genuinely user-sovereign on the account side: No/Some/Full analytics per endpoint, user-selected retention (1 day to 1 month raw) and storage region (NA/EU/AU), free resolvers retain no data (operator docs + Privacy Guides footnote)
Fast: operator claims 6.65ms resolution; DNSPerf-based comparison cited by MakeUseOf puts Control D at 18.67ms global average vs NextDNS 30.75ms; Nexxwave RIPE Atlas shows good global reachability
Actively developed: a steady stream of 2025-2026 features (AI malware filter, DNS exfiltration blocking, AI-agent security, DDR/SVCB requests open) contrasts with the stagnation complaints aimed at NextDNS
Strong tooling: MIT-licensed ctrld daemon covering 10+ router firmwares, full API, SIEM streaming, MDM/RMM provisioning, migration guides from Umbrella/DNSFilter/NextDNS
Recommended by Privacy Guides (non-profit, affiliate-free) under Cloud-Based DNS Filtering alongside NextDNS
-- What to watch
Not a VPN: it filters and can proxy DNS-adjacent traffic, but it does not encrypt general device traffic, cannot hide non-DNS activity, and redirected traffic is merely sent through Control D's proxies - a single-hop proxy, weaker than a real tunnel (operator teleport page itself says 'a VPN is the more secure option' for high-stakes use)
Reliability is the weak flank: Oct 11 2026 brought a 54-minute total outage of paid DNS for every customer at every location (own fault), a paying customer reports three outages in a year versus none on NextDNS, and r/ControlD threads document Firewalla ctrld/dnsmasq permission bugs and IPv6 resolver unreachable reports from France
No independent security audit of the service and no transparency report found in any fetched source; SOC 2/ISO badges cover process compliance, not the resolver's data handling
No public incident status page existed at the time of the October 2026 outage (operator admits it; one is being set up), and configuration changes were not staged, so a single bad record took down every paid DNS server at once
More expensive than NextDNS for the redirect tier: $6/month for Full Control vs NextDNS Pro's $1.99 - MakeUseOf's one stated reason not to recommend it to everyone
Dashboard UI criticized as slow and heavy vs NextDNS (HN, Dec 2025); false positives occasionally require manual allowlisting (HN, June 2026)
Legacy DNS users must have source IPs stored by design, and premium custom-profile resolvers retain the source IP as the account-policy identifier - privacy-conscious users have asked for a no-IP mode
Corporate privacy policy (Feb 2026) is GDPR boilerplate that does not document the resolver query path; the detailed logging docs live in a blog post and dashboard docs
Pricing reality check
Intro price
$3 /mo · renews $3/mo
Renewal price
$3/mo
Notes
Personal (operator pricing-guide blog, 2026-07-03, fetched live 2026-11-03): Some Control $3/month or $30/year (filtering, blocking, custom rules, malware protection, analytics); Full Control $6/month or $60/year (everything in Some Control plus traffic redirection through 100+ proxy locations in 60+ countries). Business: SMB self-serve $2/endpoint/month (live /pricing page); School/Non-profit discounted rate (apply); MSP and Enterprise custom quotes. MakeUseOf (Oct 8 2026, fetched live) confirms the $3/$6 personal rates. Caveat: the live /plans page returned an empty body on this session's fetch (client-side render), so personal pricing is cited from the operator's own pricing guide and a third-party review of the same month.
Check the renewal price above before any multi-year plan - true-cost calculator.
Is Control D legit?
Legal domicile: Canada - CONTROLD, Inc., Toronto, Ontario; operator about-us page states 'Founded in 2021 - Toronto, Canada' and site footer reads '2026 CONTROLD, Inc.'; free-dns FAQ calls it 'based in Toronto, Canada... the sister company of Windscribe'. Logging claim: Free public resolvers: 'No Logging - We don't log or store your DNS queries' (free-dns page). Paid accounts: logging is user-sovereign - Analytics has 3 per-endpoint levels (No / Some / Full); with Analytics off, no query data is stored; when enabled, raw query logs are kept for a user-selected window and data residence is user-selected (North America, Europe, Australia) - evidence class: promise only (no proof). No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator pages (homepage, /pricing, /personal, /about-us, /free-dns, /teleport, /network, /features/modern-protocols, /features/traffic-redirection, /privacy, pricing-guide blog, data-collection blog, Oct 11 2026 incident report), docs.controld.com (index, analytics-levels, org-data-retention, activity-log), Privacy Guides DNS recommendations, Nexxwave independent malware-filter test, MakeUseOf review, DNS Benchmark comparison, ghacks 2021 launch coverage, Wikipedia (Windscribe), HN Algolia comment index and arctic-shift r/ControlD archive (comments + posts) all fetched live 2026-11-03. Fetch failures noted: arctic-shift empty-body search returned 429 then 400 (rate limit, then empty-body rejection - body term required, matching the known failure mode documented in the nextdns dossier); arctic-shift body-searches on r/dnscrypt and r/privacy returned 422; reddit.com JSON 403; docs.controld.com/docs/privacy-policy 404; controld.com/plans returned an empty body (client-side render); derekseaman.com 403 (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Control D (premium encrypted DNS resolver) homepage - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Is Control D (premium encrypted DNS resolver) legit?
Based on our checks as of 2026-11-03: Control D (premium encrypted DNS resolver) scores 4.5/10 in our weighted review. We logged 4 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get for $3/month?
Full DNS filtering (malware, ads, tracking), custom rules, per-device profiles, and encrypted DNS (DoH/DoT/DoQ). Traffic redirection - Control D’s proxy feature - requires the $6/month Full Control plan.
What is the renewal price and total cost over three years?
The renewal rate is the same as the intro: $3 or $6 per month. The 3-year cash total could not be computed due to lack of multi-year billing data, but with annual billing, you’d pay $30 or $60 per year.
Is the no-logs claim proven?
No. The claim is policy-only: free resolvers state no logging; paid accounts have opt-in analytics with user-controlled retention. No audit, court test, or transparency report verifies this.
Can I use Control D in a censored country like China or Iran?
No. It lacks obfuscation to bypass deep packet inspection and isn’t designed for high-censorship networks. Use a proven obfuscated VPN instead.
Can I pay anonymously?
Partially. No ID check (KYC-free), but email signup is required and only fiat payments (assumed cards) are accepted - no crypto. True anonymity isn’t possible.
What happens if Control D shuts down?
You lose dashboard control and analytics, but free public resolvers (76.76.2.0/76.76.2.1 etc.) may stay up. Your local setup (e.g., router DNS) would need reconfiguration to another service.
What’s an honest free or cheap alternative?
Use Control D’s own free resolvers (76.76.2.0-76.76.2.3) for no-logging malware/ads blocking. Alternatives: NextDNS (free tier, audited), AdGuard DNS (free, no logs), or Cloudflare for Families (free, fast, but logs briefly).
The meta-review: what the internet says about Control D (premium encrypted DNS resolver)
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates Control D (premium encrypted DNS resolver). Every claim links to its source so you can verify it yourself.
What other reviewers say (3)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched live 2026-11-03 (HTTP 200): mainstream editorial hands-on after ~1 year on NextDNS. Cites a MUO benchmark and DNSPerf (Control D 18.67ms global average vs NextDNS 30.75ms). Praises traffic redirection (route one app through a specific region instead of a full VPN; route Reddit/YouTube through ad-free regions), 400+ blockable services vs NextDNS's 43, the rule builder, profile/device decoupling with scheduled profile swaps, and geo conditional rules. The stated catch: price - Control D's cheapest is $3/month and the redirect feature needs the $6 plan vs NextDNS Pro $1.99, so 'I can't recommend it for everyone'. Site carries affiliate disclosure.
Fetched live 2026-11-03 (HTTP 200): independent methodology-driven test of 8 public resolvers against 80,762 unique malicious domains (CERT Poland 76,956 + URLhaus 3,824). ControlD Malware (76.76.2.1) blocked 99.98% - 39,153 of 39,160 testable malicious hosts, only 7 slipped through - the best result in the test (Quad9 96.66%, Cloudflare for Families 95.82%, dns0.eu 99.23%). False-positive check against Cloudflare Radar top-1,000 domains: ControlD blocked zero. RIPE Atlas reachability measured from 1,000 probes. This is the independent source behind the operator's headline claim.
Fetched live 2026-11-03 (HTTP 200): vendor-adjacent comparison (DNS Benchmark is a test app; treat claims with care). Positions Control D as the power-user pick: 'fast Anycast resolution paired with per-domain proxy traffic redirection', account-free public endpoints 76.76.2.0/76.76.2.2, jurisdiction Canada ('backed by Windscribe's global network'), and asserts a 'strict no-logging baseline by default' with analytics active only when explicitly enabled. No PQC on Control D (AdGuard leads there); no Swiss log-storage option (NextDNS leads there).
What users say (4)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched live 2026-11-03 (HTTP 200): 2025-2026 HN comment corpus. Consistent pattern: Control D is the named destination for NextDNS refugees (support complaints, stagnation complaints), praised for founder-level support, Hagezi TIF integration and proxy redirection; recurring criticisms are the slow/heavy dashboard, occasional false positives, and skepticism about the ECS-based 'switch countries without a VPN' claim. Note: the instructed generic query 'control d' with tags=comment matches noise ('control', 'd' separately); the quoted term "controld" was required. Individual comments cited in the voices array.
Fetched live 2026-11-03 (HTTP 200): 25 recent r/ControlD comments (Oct-Nov 2026). Dominant topic is the Oct 11 2026 outage and postmortem: gratitude for transparency, demands for an external status page and a built-in failover option, one paying customer reporting three outages in a year, one user switching back to NextDNS. Also: NextDNS-vs-ControlD stability-vs-development trade, the UK age-gating redirect workaround, a formal feature request for a no-source-IP privacy mode on premium resolvers, the Firewalla ctrld dnsmasq permission bug and fix, and an iOS battery-drain question resolved as a non-issue. NOTE: the instructed empty-body search returned 429 then 400 (empty body rejected); a body term was required; body-searches on r/dnscrypt and r/privacy returned 422 - noted in data_quality.
Fetched live 2026-11-03 (HTTP 200): the subreddit's live issue mix (Oct 22 - Nov 2, 2026): 'Another hiccup?!?', 'Rate limit on Free DNS? I keep getting sporadic prolonged timeouts', 'IPv6 resolver unreachable from France', 'Need DDR (SVCB) records so Android Private DNS can use DoH', Firewalla/MikroTik/Windows setup threads, blocklist requests (ShadowWhisperer), and an AdGuard Home cache saving ~50% of upstream queries - a technically engaged user base working directly with the operator.
Fetched live 2026-11-03 (HTTP 200): the public open-source client daemon - 912 stars, 47 forks, 42 open issues, 813 commits, MIT license, Go. Multi-protocol (UDP 53, DoH, DoT, DoH3, DoQ) forwarding proxy with network-policy query steering, split-horizon DNS, LAN client discovery, Prometheus metrics, router integrations (ASUS Merlin, OpenWrt, pfSense/OPNsense, GL.iNet, MikroTik, Ubiquiti, Firewalla, Synology, DD-WRT, FreshTomato). In CD (Control D) mode it relays LAN topology (LAN IPs, MACs, hostnames) to Control D for per-device visibility. The DNS service itself is proprietary; only the client and tooling are open source.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: Control D is a DNS filtering tool with optional proxy-based IP masking, not a VPN. It offers strong malware blocking (99.98% in independent tests), fast resolution, and granular per-device controls, but suffered a 54-minute total outage for all paying users in October 2026 due to a single-point failure. Free resolvers stayed up; paid service did not.
The logging truth: The provider claims no logging for free resolvers and user-controlled logging for paid accounts via opt-in Analytics (No/Some/Full), with raw logs stored in user-selected regions (North America, Europe, Australia) and retention up to 30 days. However, source IPs are retained for account mapping on Legacy DNS and custom-profile resolvers, and evidence is policy-only - no audit, no transparency report, no warrant canary.
Pricing reality: $3/month for Some Control (filtering, blocking, custom rules), $6/month for Full Control (adds traffic redirection); annual billing saves 16.67%. No intro discount, no renewal trap - pricing is flat and cancelable anytime. No free personal plan, but a 14-day trial exists with no credit card.
What reviewers say vs what users say: Affiliate reviewers (MakeUseOf, DNS Benchmark) praise speed, filtering depth, and proxy redirection, calling it a NextDNS upgrade. Users confirm power and support but report stability issues: multiple outages in a year, slow dashboard, and demands for an external status page. The October 2026 outage postmortem was praised for transparency but criticized for revealing enterprise-grade flaws.
Who runs it: Control D, Inc., Toronto, Canada - founded in 2021 by Windscribe’s founders (Yegor Sak, Alex Paguis, Mark Ulicki). It is a sister company to Windscribe, sharing technical lineage but operating independently. No ownership conflict is documented, but Windscribe’s history includes server seizures and legal scrutiny, though none involving Control D.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 17[B] B: 6[C] C: 4[D] D: 0(D stays empty until our own test phase)
A censorship-unblocking tool that now wears nonprofit clothes: Lantern's parent became the 501(c)(3) Brave New Software Project and the site now reads like a…
Hysteria 2 is not a VPN provider - it is free, MIT-licensed proxy software you deploy on your own server, and this dossier treats it that way: there is no…
open source
intro $5 /mo
none - Hysteria is not a company; it is MIT-licensed open-source software (Go) developed by a volunteer community around lead developer 'Toby' (GitHub: tobyxdd), with the repo on GitHub and docs at hysteria.networkprivacy tool 9 d ago
The mainstream default of DNS-level filtering, with a genuinely honest scoping the operator itself states plainly: AdGuard DNS sits at the resolver - it…
open source
intro $2.49 /mo
Cyprus - operator is Adguard Software Limited, registered in Limassol, Cyprus (privacy policy and about page, both fetched live); the parent AdGuard company was founded in Moscow, Russia in 2009 and later moved its headquarters to Cyprus (Wikipedia)privacy tool 9 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.