DNS Level Blocking with Control D

As you probably know I'm quite interested and active in testing different security approaches like sandboxing, firewalls and VPNs. Compartmentalizing with virtual machines is also a good strategy. Part of a good multi-layered defence is also a well curated hosts file like this one kept by Dan Pollock and secure, encrypted DNS services. Better even if you can combine features of the last two and keep the nasties out with DNS level blocking. This will give us a much cleaner internet and might even negate the need for a browser level blocker like uBlock Origin.

Windscribe VPN includes a DNS blocker where we can opt to block certain areas like malware, trackers, gambling, fake news, becoming victim to crypto miners and others. These are quite broad and can be customized with your own rule set. Pro subscribers get a thousand rules to define for themselves which includes black listing, white listing and spoofing capabilities but adding all these entries is a lot of work. Unfortunately all similar services I've come across don't allow us to import our own hosts file. No, you have to add them one at a time.

Now there's a new service out. ControlD is a more fine grained type of DNS blocker that makes it easy to filter whole areas as before like malware, telemetry, ads and trackers, social, click bait and so on but also most known web services with sliding a button. It's just come out of beta. We can schedule filters to only be active at certain times, we can still add our own custom rules too and select a global proxy which, although this is not a full VPN service as it doesn't encrypt the connection, would be enough if one just wants to get around geo-blocking and have secure DNS requests so our ISP doesn't know everything about our surfing habits. Or preventing them from injecting ads into our session that are usually not filtered out by browser extension ad-blockers.

 

 

"And finally, drum roll please, we're very excited to announce that our DNS service is finally ready, and we call it ControlD (p.s. It’s Control-space-D, not contro-ID). After 1.5 years of development, bruised fingers from excessive coding, enough Redbulls to power a space shuttle, and 5 months of closed beta testing, we're ready to show it to the world. You can get a free 30-day trial, which is just enough time to fall in love with it, and then miss it and wonder what could have been - except you don’t have to wonder you can always just use it! There is no other service like it out there, and we know with 344% certainty you will enjoy using it, a lot. Just trust us on this one."

This is not a free service and actually I have no idea how much it will be as I'm currently still on the free beta trial but I guess it will be something around the cost of a VPN. A more basic service is available from four free DNS servers at the bottom of the page.

We can change our current DNS in the legacy format which means good old fashioned IPv4 address, DNS-over-HTTPS and DNS-over-TLS to be preferred if you want your requests to be encrypted. If you choose automatic global proxy it will connect to which ever one is nearest so this is the most flexible on your phone if travelling a lot.

The set up tutorial is straight to the point and easy to follow. Give it a go, you might like it. It's not a full VPN but allows for more fine grained filtering and can be combined with running a VPN.

UPDATE 30/07/23: Well, as it turns out after trying this a few times I'ld much rather use a full-blown VPN with integrated DNS blocker which does all this and more. Even for SmartDNS there are better, as in easier to manage, services.