Control D vs NextDNS: two configurable cloud resolvers

Quick identity check

Control D 76.76.2.0 is a free resolver from Windscribe (the team behind the Windscribe VPN), built around interchangeable profiles you switch between by changing the address you point at. NextDNS 45.90.28.0 is run by NextDNS Inc. and takes the opposite tack: one profile per account, configured through a dashboard where you assemble blocklists and rules and watch queries arrive in real time. Both are free to start, both support encrypted transport, and both go well beyond simply translating names to IP addresses.

Two approaches to customisation

This is the real fault line between them. Control D's free offering is a set of purpose-built resolvers you choose from: an unfiltered profile, a malware-blocking one, an ads-and-trackers one, and a family profile — each on its own address, so switching flavours is just switching servers with no login. Its own summary puts it plainly: Highly customizable free resolvers — pick unfiltered, malware-blocking, ad-blocking, or family in one click. If you want deeper control — per-service redirects, custom allow/deny rules, or location and geo options — those live in Control D's paid tiers, layered on top of the free flavours.

NextDNS inverts the model. Instead of picking a pre-baked flavour, you create one profile and compose it: toggle security categories, subscribe to blocklists, add your own allow and deny entries, and enable parental-control settings, all from a single dashboard. Its summary: A configurable cloud resolver — the generic addresses give no-setup resolution, while custom ad, malware, and family filtering use a free account. The trade-off is that this power is tied to your account and its profile-specific endpoint rather than a handful of memorable public addresses.

Free tiers, compared

Both are genuinely usable for free, but the free deals differ in shape. Control D's free profiles carry no query cap and need no sign-up — you point a device or router at the address for the flavour you want and you're done. NextDNS's free plan is account-based and metered: it covers around 300,000 queries per month, after which it keeps resolving (so nothing breaks) but pauses your custom filtering and logging until the cycle resets. For one device that ceiling is usually invisible; an entire household behind a single router can reach it sooner than expected.

Privacy: logging and EDNS Client Subnet

Control D's stance: Offers several free, purpose-built resolvers (unfiltered, malware, ad-blocking, family) with a no-logging free tier.

NextDNS's stance: Privacy-oriented with configurable or zero log retention; states it does not sell data.

The two diverge on EDNS Client Subnet (ECS) — a DNS extension that shares part of your network location with a site's authoritative servers to improve CDN routing. Control D does not send it; NextDNS does. That's a familiar trade-off: a small locality benefit against a slightly larger footprint. NextDNS also makes logging a choice you control, all the way down to keeping nothing, which is unusual and worth knowing if you like the analytics but not the retention. For a broader look at how the privacy-first resolvers line up, see our best DNS for privacy guide.

Speed — and what we can actually measure here

Neither service is faster everywhere. Both run on distributed anycast networks, so your query normally lands on a nearby node for either one, and the real difference comes down to distance, peering, and congestion on your specific path. That's why we don't publish a "fastest" verdict — the only number worth trusting is one measured from your own connection.

There's a practical wrinkle worth being honest about. Control D's free unfiltered profile exposes a public endpoint with permissive CORS, so our test can time it directly in your browser alongside Cloudflare, Google, and the rest. NextDNS is different: its meaningful endpoint is tied to your personal profile, so there's no account-free public URL for us to time in the browser — we treat it as reference-only rather than fabricate a number for it. If head-to-head timing matters, run the speed test with Control D in the mix and judge it against the resolvers you're considering.

Side-by-side comparison

Addresses, hosts, and feature flags above come straight from our provider registry. Control D's free profile addresses vary by flavour — the ones shown are the default unfiltered profile.

Setup: how to switch

For Control D, decide which free flavour you want and set that profile's primary and secondary addresses on your router or device — no account needed to start. For NextDNS, create a free account, build your profile, then use the addresses (or the profile-specific DoH/DoT endpoint) it gives you. Either way it's a settings change, not an install. Full walkthroughs cover Windows, macOS, Android, iPhone, Linux, and your router.

The verdict

Both are strong, flexible choices, and the decision is really about how much you want to fiddle. Pick the model that matches how you like to work:

• Choose Control D if you want zero-setup, ready-made profiles you can switch by changing an address, no account or query cap on the free flavours, and — later — the option to add custom rules, redirects, and geo controls on a paid plan.
• Choose NextDNS if you want one profile you fully compose yourself, a real-time query log and analytics, and log retention you can dial down to zero — and you're comfortable with a free-tier query cap and a profile-scoped endpoint.

Still weighing it up? Run the DNS speed test — it measures Control D and the other browser-testable resolvers from your exact connection, which beats any general claim about who's fastest.