Control D review: free, purpose-built resolvers you pick in one click

Addresses and flavours

Control D's free resolvers all live on the same infrastructure — you choose behaviour by choosing an address rather than by logging in. Start with the unfiltered address if you want plain, fast resolution, then step up to a filtering flavour if you want blocking. Each pair below resolves the internet identically for anything that isn't on the relevant blocklist.

For encrypted transport, the unfiltered resolver's DNS-over-TLS hostname is p0.freedns.controld.com and its DNS-over-HTTPS endpoint is https://freedns.controld.com/p0. The free flavours are addressed by path on the same freedns.controld.com domain, so you can encrypt whichever level of filtering you settle on rather than being forced back to plain DNS.

The free flavours: one-click filtering

The appeal of Control D's free side is how little there is to it. Rather than making you create an account, tick category boxes, and copy a personalised endpoint, it publishes a small menu of pre-built resolvers and lets you switch behaviour by switching address. Point a device at the unfiltered flavour and it does nothing but resolve names quickly. Point it at the malware flavour and it refuses to resolve domains that threat-intelligence feeds have flagged as malicious. Step up to ads + trackers and it also drops the domains that serve advertising and tracking scripts, network-wide, on every phone, TV, and console that uses it. The family flavour layers adult-content blocking on top of all of that for households that want a safer default.

The trade-off is that these presets are exactly that — fixed. You get to choose which of Control D's levels of filtering applies, but not what each level contains: you can't whitelist a single domain the ads flavour blocks, or add a domain of your own to the malware list. If a flavour breaks a site you care about, your options on the free tier are to accept it, drop down to a lighter flavour, or move to the unfiltered address and lose the blocking entirely.

Paid custom profiles: rules, redirects, and locations

Where Control D goes beyond a typical free resolver is its paid tier. With a subscription you build custom profiles instead of picking presets: per-domain allow and block rules, third-party filter lists you enable individually, and redirect rules that can send a hostname through a chosen proxy location for geo-flexibility. That configurability is genuinely the product Windscribe is selling, and it's a real reason some people choose Control D over a plain resolver — but it's important to be clear that none of it is part of the free flavours. If your interest in Control D is specifically the custom rules and redirects, plan on a paid plan; if you just want good one-click filtering, the free resolvers stand on their own.

Privacy and logging

Offers several free, purpose-built resolvers (unfiltered, malware, ad-blocking, family) with a no-logging free tier. That is the main privacy question with any third-party resolver: whether the operator keeps a queryable history tied to you. Control D is run by Windscribe, a company whose core business is privacy software rather than advertising, which removes the most common incentive to retain and monetise query data — though a stated policy is still a policy you're trusting rather than one you can independently audit. Read Control D's privacy policy if that distinction matters to you, and weigh it against other options on the best DNS for privacy guide.

The resolver also does not send EDNS Client Subnet, so your rough network location isn't passed along to the sites you visit for CDN-routing purposes. That's a privacy win; the small cost is that a content network occasionally can't place you as precisely, which may route you to a marginally less local edge.

Who Control D suits

Control D is a strong fit if you want network-wide ad, tracker, or malware blocking without the setup overhead of an account-based service — you change one address and you're done, and you can dial the filtering up or down just as easily. It also suits anyone comparing filtering resolvers who wants to see honest latency numbers first, since it's one of the few that this site's live browser test can measure directly. It's less of a fit if the custom rules and redirects are the whole point for you, because those sit behind a paid plan; in that case it's worth comparing it against NextDNS, which builds its free tier around a configurable account, or reading the Control D vs NextDNS comparison to see which model fits how you like to work.

Pros and cons

How to set up Control D

Setting a public DNS resolver means entering its addresses in your device's or router's network settings, replacing whatever your ISP assigns automatically. Decide on a flavour first, then use its primary and secondary addresses — for the unfiltered flavour that's 76.76.2.0 and 76.76.10.0, or the IPv6 pair if your network prefers IPv6. Step-by-step instructions for each platform:

• Change DNS on Windows
• Change DNS on macOS
• Change DNS on Android
• Change DNS on iPhone
• Change DNS on Linux
• Change DNS on your router

Setting a filtering flavour on your router applies its blocking to every device that joins your network automatically, which is usually the most effective place to configure it. To change how much is blocked later, you just swap the addresses for a different flavour.