Let's continue the comparison series with a head-to-head showdown of Control D vs Pi-hole (a popular self-hosted DNS blocking server). Since this is a Control D blog, there may be inherent bias, but I'll try to be as objective as possible. Omissions are not out of malice, so if you spot some, email me at the address posted at the end of the article. Now, let's dive into the first and most obvious topic.

What does Pi-hole have that Control D does not?

Despite Pi-hole being a self-hosted solution, and Control D a cloud-based solution, here I'm gonna talk about specific features that are present in the web interface that you use to manage your configurations.

  1. Ability to use custom blocklists - Pi-hole allows you to use any 3rd party blocklist you can find online, and enforce it on your network. Control D allows you to use our own "native" Filters, as well as most of the popular 3rd party blocklists like OISD, 1Hosts, Hagezi's, Dev Dan, GoodbyeAds, and StevenBlack. You cannot add your own unless you suggest it.
  2. Always on query log - Currently Control D only allows you to enable the Activity Log for 2 hours at a time. This will change in the future to be always on (if you have Analytics enabled).
    UPDATE May 2023: This is no longer the case and always on query log is now available.
  3. Regex rules - Control D only supports wildcards (ie. server-*.domain.com) when making custom block rules. You cannot use regex.

You may be thinking that other "missing" features were brushed under the rug, please read further where I'll dive into the Pi-hole interface and show you how the same features are implemented in the Control D interface. But first, let's talk about major features that Control D has, and Pi-hole does not.

What does Control D have that Pi-hole does not?

  1. IP Blocklists - Control D's Malware filter blocks domains from many threat intelligence feeds that are both domain-based and IP based. This means it will block DNS queries that resolve to malicious IP networks, regardless of the FQDN itself not being present in any blocklist. Pi-hole developers rejected this feature.
  2. Secure DNS Protocols - Control D supports all modern DNS protocols, including UDP 53 (IPv4 and IPv6), DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC and DNS-over-HTTP/3 (QUIC).
  3. Works Everywhere - Control D can be used on any internet-connected device, including mobile phones, without any installed software. To do the same with Pi-hole, you would have to set up a VPN which is a massive overkill for something as simple as DNS.
  4. Curated Filters - Our native Filters are handcrafted and based on five years of feedback from millions of Windscribe (our sister company) users. This means you will find them highly effective in terms of what they block, with far fewer false positives than in most community filters you may be using right now. If you still wish to use 3rd party Filters, Control D supports 12 of the most popular ones out there. If you really need one that we don't support, make a suggestion.
  5. Traffic Redirection - Control D can block any domain you want, or redirect it via servers in over 100 exit locations. This allows you to change your IP without using a VPN. This is one of the biggest features.
  6. Swappable Configurations - Your configurations (known as Profiles) are decoupled from the actual DNS resolvers (known as Devices). This allows you to maintain different Profiles and selectively enforce them on some, all, or none of your Devices. This is very handy if you wish to try a new Profile on an existing resolver that is already configured somewhere, without mutating the original configuration. You can also schedule automatic Profile swaps using the scheduler. Note: You can achieve basic scheduling with Pi-hole.
  7. Powerful Custom Rules - While Pi-hole has basic Allow/Deny lists and "Local DNS Records", Control D allows you to manage them all in one place, with much more functionality. Think of this as your Authoritative DNS server for the entire Internet. You can create custom DNS records that block, redirect (to IP or proxy), or bypass any domain name (or wildcard). You can create PTR records, group your rules into folders, assign default actions to folders (i.e. make your own Allow/Deny folders, and add domains), export folders to share rules, copy rules between Profiles, and a whole lot more.
  8. Expose IP Via DNS - This is a Device setting that allows any Device to become a DDNS endpoint. With the setting enabled, every time you query against your Secure DNS resolver, the source IP is presented in a public DNS record. This eliminates the need to use a 3rd party DDNS service.
  9. End User Support - We provide in-house commercial end user support for everyone. Email us, hit us up on Reddit, Twitter, or Discord, and we'll be happy to help you.

But what about ....?

The following section will go over some "missing" Control D features and where you can find them in the web interface. Just keep the following UI conventions in mind:

  • Anything that BLOCKS domains from resolving will be found in the Filters section.
  • Some Filters have Strict and Relaxed modes which further enhance their capabilities within the relevant scope.
  • The Services section gives you granular control over 400+ web services, apps, and games.
  • Custom Rules give you highly detailed control over individual domain names.
  • Settings not related to specific domains, services, or categories are found in Profile Options. These govern general behaviors.

Now that we've got the basics out of the way (you can dig deeper in this article), let's discuss some specifically named Pi-hole features that are (not) missing from Control D, and where to find them in the web interface.

Dashboard

Pi-hole's dashboard shows you statistics of your DNS server. This feature exists in the Analytics view of the Control D web panel.

Query Log

Control D currently has 2 implementations where you can view your DNS queries. These will be combined into a single interface soon, however, the current system works as follows:

  • Activity Log - You can start an Activity Log session on any device and view DNS queries in real-time to help you make Custom Rules.
  • Analytics - This view shows historical data for your most popular blocklists, services, and redirection locations. It also shows the top domains that were blocked, bypassed, or redirected.

Groups & Clients

Pi-hole allows you to create groups, and assign clients to them. This permits you to deploy different block lists on different devices on your LAN.

You can achieve the exact same thing with Control D by making several Profiles (collections of blocklists, custom rules, and services rules), and enforcing them on different Devices.

The above method would require you to set up individual Device resolvers on all your physical devices. You can avoid the need to do so with the open-source ctrld utility (which is in active development).

Domains & Local DNS

These sections in the Pi-hole interface allow you to create custom block and allow rules, as well as spoof domains to IPs of your choice.

With Control D, you can achieve all of this (and more) from the Custom Rules section. Here are some examples of Custom Rules you can make.

Adlists

This section of the Pi-hole interface allows you to add your own custom blocklists, and assign client groups to use them.

Control D does not allow you to configure custom blocklists, however, you can choose from 18 native Filters maintained in-house by Control D, which are based on Windscribes and were battle-tested by millions of users. These lists will have very few false positives relative to random Github lists you may be using.

If you wish to use your favorite 3rd party block list anyway, Control D also supports the 12 most popular ones out there (OISD, 1Hosts, Hagezi's, Dev Dan, GoodbyeAds, and StevenBlack). Simply toggle a switch, and you're done.

Disable Blocking

You can quickly disable all your settings (blocklists, Services, Custom Rules) by clicking "Disable Profile" in the bottom left corner of the web interface (see the above image). You can then choose how long you want it to be disabled. However, if you use our native Filters, you will find that you almost never have to press this button.

Future Roadmap

In the next while, we're going to be aggressively deploying new features. These features include, but are not limited to:

  • Machine learning-based malware detection - we're in the final stages of building our own ML model that detects malware without any blocklists. This feature will be available in March of 2023. Edit: This is shipped.
  • Analytics improvements - More ways to view your historical and real-time data to draw conclusions and troubleshoot issues. Edit: This is shipped.
  • Control Panel overhaul - The UI will undergo a drastic change as part of the next major release that will address many current UX concerns. Edit: This is shipped.

I hope this was useful. Remember, we are trying to build the best DNS service out there, so if you have questions or suggestions that can help us achieve this goal, email me at yegor@controld.com