opdns compared with NextDNS and ControlD
This page compares opdns with two established filtering DNS services. NextDNS and ControlD are trademarks of their owners and are named only to identify their services. No pricing comparison is made.
How to read the opdns column
Section titled “How to read the opdns column”| State | Meaning |
|---|---|
| Yes | built; ships in the 2027 beta |
| Planned, phase N | on the roadmap for that phase, after the beta |
| Decision in phase N | whether to build it is decided in that phase; it may be declined |
| Declined | opdns will not build it; the notes say why |
“Yes” for a competitor means the feature appears in that service. It does not grade quality or completeness.
Parity table last reviewed 2026-09-29. 74 features.
| Feature | opdns | NextDNS | ControlD | Notes |
|---|---|---|---|---|
| DoH, DoT, Do53 IPv6 per-profile addresses | Yes | Yes | Yes | DoQ and DoH3 also in Phase 1 |
| DoQ | Yes | No | Yes | NextDNS lacks it |
| Linked IP and DDNS updater | Yes | Yes | Yes | |
| Anycast network | Yes | Yes | Yes | |
| Legacy Do53 IPv4 per-device ID | Declined | No | Yes | Documented limitation; linked IP only |
| Multiple profiles per account | Yes | Yes | Yes | |
| Devices as first-class objects with own resolver ID | Yes | No | Yes | opdns devices are names within a profile |
| Multiple profiles enforced on one device | Planned, phase 5 | No | Yes | Needs merge semantics in policy engine |
| Threat intelligence feeds | Yesfree feeds; 6 licensed | Yes | Yes | ADR 0015 |
| AI-driven or behavioural threat detection | Planned, phase 5 | Yes | Yes | |
| Google Safe Browsing | Planned, phase 5 | Yes | No | Licence terms to check |
| Cryptojacking protection | Planned, phase 5 | Yes | No | |
| DNS rebinding protection | Planned, phase 5 | Yes | No | Per profile in Go layer |
| IDN homograph protection | Planned, phase 5 | Yes | No | |
| Typosquatting protection | Planned, phase 5 | Yes | No | |
| DGA protection | Planned, phase 5 | Yes | No | |
| Newly registered domains | Yes | Yes | Yes | |
| Dynamic DNS hostnames block | Planned, phase 5 | Yes | No | |
| Parked domains block | Planned, phase 5 | Yes | No | |
| TLD blocking | Planned, phase 5 | Yes | Yes | |
| CSAM blocking | Yespolicy; source per PRD-014 | Yes | No | |
| Blocklists catalogue | Yes | Yes | Yes | |
| Filter strength levels (relaxed, balanced, strict) | Yes | No | Yes | Map to list bundles |
| Custom list import (hosts, ABP) | Planned, phase 5 | No | Yes | |
| Native tracking protection per vendor | Planned, phase 5 | Yes | Yes | |
| CNAME uncloaking | Yes | Yes | No | |
| Allow affiliate and tracking links | Planned, phase 5 | Yes | No | |
| Parental control: services | Planned, phase 5 | Yes | Yes | ControlD has 1000+ services |
| Parental control: categories | Planned, phase 5 | Yes | Yes | Weakest at launch, ADR 0015 |
| SafeSearch enforcement | Planned, phase 5 | Yes | Yes | |
| YouTube restricted mode | Planned, phase 5 | Yes | Yes | |
| Block bypass methods (VPN, proxies, DoH) | Planned, phase 5 | Yes | Yes | |
| Recreation time and schedules | Planned, phase 5 | Yes | Yes | |
| Service rules: block, bypass, redirect | Planned, phase 5 | No | Yes | |
| Custom rules in folders | Planned, phase 5 | No | Yes | Folders group deny, allow, rewrite |
| Default rule (block all, bypass all) | Planned, phase 5 | No | Yes | |
| Denylist and allowlist | Yes | Yes | Yes | |
| Rewrites and spoof to IP or hostname | Yes | Yes | Yes | |
| Redirect or proxy via egress location | Decision in phase 55 conditional | No | Yes | PRD-061 |
| Block response modes (NXDOMAIN, 0.0.0.0, REFUSED, custom IP) | Yes | Yes | Yes | Custom IP in 5 |
| Block page with CA | Decision in phase 55 decision | Yes | No | PRD-060 |
| Branded block page | Decision in phase 55 decision | No | Yes | Depends on PRD-060 |
| Block and redirect TTL settings | Planned, phase 5 | No | Yes | |
| Cache boost (minimum TTL) | Planned, phase 5 | Yes | No | |
| Anonymised ECS | Decision in phase 55 decision | Yes | No | Resolver design open question |
| ECS options | Planned, phase 5 | No | Yes | Same decision |
| CNAME flattening | Planned, phase 5 | Yes | No | |
| Web3 domains (ENS, Unstoppable, HNS) | Planned, phase 5 | Yes | Yes | |
| Logs on or off, client IP, domain logging | Yes | Yes | Yes | |
| Retention 1 hour to 2 years | Yes | Yes | No | Cloud retention capped at 90 days by decision (2026-09-30); plan ceilings below that in Phase 6 |
| Analytics levels (none, some, full) | Yes | No | Yes | Counters without logs |
| Log storage location choice | Planned, phase 6 | Yes | Yes | Needs a second ClickHouse region; self-hosted destination covers it in Phase 4. The setting exists with Canada only (PRD-081); EU in PRD-082 |
| Self-hosted log destination | Yes | No | No | opdns differentiator |
| Live log tail, filters, search | Yes | Yes | Yes | |
| Download logs as CSV | Yes | Yes | No | Via PRD-020 export too |
| Clear logs | Yes | Yes | No | |
| Analytics: GAFAM, destinations, devices, DNSSEC, encrypted share | Yes | Yes | No | |
| Setup guides per platform | Yes | Yes | Yes | PRD-025, PRD-026 |
| Apple mobileconfig | Yes | Yes | Yes | Signed in PRD-027 |
| CLI forwarder (nextdns CLI, ctrld) | Planned, phase 5 | Yes | Yes | PRD-054 |
| Split horizon and LAN client discovery | Planned, phase 5 | Yes | Yes | PRD-054; self-hosted has it in Phase 4 |
| Router packages | Planned, phase 5 | Yes | Yes | PRD-056, PRD-057 |
| iOS and macOS apps | Planned, phase 5 | Yes | Yes | PRD-058 |
| Android app | Planned, phase 5 | Yes | Yes | PRD-059 |
| Windows app | Planned, phase 5 | Yes | Yes | CLI first; GUI later if asked |
| Uninstall protection in apps | Planned, phase 5 | No | Yes | With PRD-058, PRD-059 |
| Free public filtered resolvers without account | Decision in phase 33 decision | No | Yes | PRD-011 covers the unfiltered case; filtered presets optional |
| Public API | Yessame API; tokens 6 | Yes | Yes | PRD-073 to PRD-075 |
| Sharing profile access with other accounts | Planned, phase 6 | Yes | No | Via teams, PRD-071 |
| Organisations and sub-organisations (MSP) | Planned, phase 6 | No | Yes | Sub-orgs after PRD-071 |
| SSO for business | Planned, phase 6 | No | Yes | PRD-078 |
| Billing with free quota then unfiltered | Planned, phase 6 | Yes | No | PRD-064 to PRD-070 |
| Profile export and import | Yes | No | Yes | PRD-020 |
| Self-hosted resolver | Yesenrolled; standalone after | No | No |
What only opdns does
Section titled “What only opdns does”| opdns | NextDNS | ControlD | |
|---|---|---|---|
| Self-hosted node running the same resolver | Yes enrolled; standalone after | No | No |
| Query logs stored on your own hardware | Yes | No | No |
| Resolver and control-plane source published | Yes source-available, SFL 1.1 | No (client CLI is open source) | No (ctrld client is open source) |
| Public, code-checked log model | Yes | privacy policy | privacy policy |
Where opdns is behind
Section titled “Where opdns is behind”Be clear-eyed about these before switching:
- Apps. No iOS, macOS, Android or Windows apps and no CLI forwarder until Phase 5; setup is by the operating system’s own settings.
- Parental controls. Categories and services are the weakest area at launch, from free lists; schedules come in Phase 5.
- Redirects through an egress location (ControlD) are a Phase 5 decision and may be declined: they would make opdns a traffic proxy.
- Log storage region choice needs a second database region (Phase 6). Keeping logs on your own node covers it in the beta.
- Per-device identification on plain IPv4 is declined. Use encrypted DNS or the per-profile IPv6 addresses.