DNS Proxy that is simple and fast with not so simple features. Focused on routed DNS forwarding, filtering and parental control.
A DNS proxy that gives you real control over your home network.
I spent years as a consultant in the "big boy" networking and security "arena". DNS security was/is my daily work, but also a favorite hobby to tinker with. Because I have kids now, and need to be a responsible parent, I took it on myself to filter the big bad internet for them. So I built sdproxy (Simple DNS Proxy). It brings enterprise/big-boy protections/methods/precision to the home network level (kind of).
The proxy is written in Go and compiles to a lean binary for cheap routers. There are NO cloud subscriptions or monthly fees. It speaks every flavor of DNS and includes adaptive admission control to stay stable. It is just lean (kind of), mean, Dutch-engineered precision for the living room. Just you, one executable and a yaml file.
And remember... It's always DNS!
Note: The full_reference_config.yaml in this repository (also embedded in the binary via sdproxy --example-config) is always more up to date than this README. When in doubt, check there.
DNS is the phonebook of the internet - every device on your network looks up a name before it connects anywhere.
sdproxy sits in the middle of that, on your router, and lets you decide what happens next: cache it, block it, route it to a different resolver, apply advanced ML security models, or enforce time limits per child. No cloud subscription, no monthly fee, no external service that goes down.
It's written in Go, compiles to a single binary, and is lean enough to run on cheap home routers (OpenWrt on a TP-Link, GL.iNet or NetGear, pfSense, OPNsense or just a plain Linux box).
See KEY_ADVANTAGES.md for key advantages vs alternatives.
Plain old UDP/TCP (port 53), encrypted DNS-over-TLS (DoT), DNS-over-HTTPS (DoH), and DNS-over-QUIC (DoQ).
sdproxy natively parses Alt-Svc headers and SVCB/HTTPS ALPN parameters to seamlessly upgrade standard DoH streams to high-performance HTTP/3 (QUIC) connections on the fly.Protects your browsing from ISP deep-packet inspection by encrypting the TLS Server Name Indication (SNI).
sdproxy acts as a full ECH server, decrypting client hellos and natively broadcasting its own keys to your local network via DDR (_dns.resolver.arpa SVCB/HTTPS) and /.well-known/origin-svcb / /.well-known/ech HTTPS endpoints.sdproxy actively interrogates their HTTPS/SVCB records (and L7 .well-known fallbacks), extracts their ECH keys, and secures the TLS handshake completely autonomously.A native, zero-allocation Logistic Regression ML inference engine runs on the hot path. It extracts Shannon entropy, vowel/consonant skew, trailing digit patterns, and consonant chains to instantly detect and block Algorithmically Generated Domains (DGA) used by botnets, malware, and C2 infrastructure.
_for-sale. & Parked Domain Detection_for-sale. Detection (server.for_sale): Probes _for-sale.<qname> and _for-sale.<apex> for valid RFC 10023 TXT records (v=FORSALE1;) using a 64-shard verdict cache, full parent-chain cache walks, and SingleFlight coalescing. Supports disabled, BLOCK, DROP, LOG, or any standard DNS RCODE.server.parked): Detects parked domains, intermediate parent domains, and eTLD+1 apexes by actively probing and passively inspecting authoritative NS, SOA, TXT, CNAME, and A/AAAA records for common domain-parking and aftermarket monetization providers (Sedo, Bodis, ParkingCrew, Above.com, Dan.com, Afternic, CashParking, HugeDomains, Squadhelp/Atom, Uniregistry, ParkLogic, RookMedia, etc.).(client/subnet, apex domain) within a configurable time window (with optional exempt_shared_hosting) to intercept slow-and-low DNS tunneling and info-stealer exfiltration without allowing cross-client denial of service.rrs:) with Regex Supportrtype_policy), domain suffixes, IPs/CIDRs, or regular expressions (/pattern/) via inline config, local files, or remote URLs.rrs:): Override global or per-group domains (exact or /pattern/ regex) with static IPv4/IPv6 addresses or transparent recursive CNAME aliases (e.g., enforcing SafeSearch).sdproxy does not just forward queries blindly; it evaluates upstreams dynamically.
max_secure_upstreams (default 5) healthy servers in a group simultaneously. Deep-inspects canonical RRset fingerprints (CNAME chains, final IP endpoints, SVCB/HTTPS, DNSSEC state) with support for fastest, ordered, and consolidate (merged answer set) preferences. In strict mode, 100% participation and answer equivalence are enforced; in loose mode, a majority of healthy responders is used. Drops or blocks the response if upstreams disagree or return a poisoned NULL-IP.Answered something recently? Serve it from cache. sdproxy utilizes 32 cryptographically seeded memory shards with optional crash-safe disk persistence across reboots (including route configuration fingerprinting). If a record expires while still popular, sdproxy triggers a background prefetch so your devices never notice a cache miss. It fully supports RFC 8767 Stale-Serving, strict DNSSEC RRSIG expiration bounds, and serve_stale_infinite outage fallbacks.
Point it at your DHCP lease files and /etc/hosts and it will answer local name lookups (your NAS, your printer, your Pi) without bothering an upstream resolver or leaking LAN queries upstream. Works with dnsmasq, ISC DHCP, Kea, and odhcpd.
Map a device's identity to a different upstream resolver group or parental profile.
mac:<mac> and mac:<glob>), IP / CIDR, EDNS0 Client Subnet (ecs:<ip> and ecs:<cidr>), ASN (ASxxxx), Country Code (CC:XX via IPinfo), Client-name, TLS SNI (sni:), HTTP DoH Paths (path:), and Listener Ports (port:).server.trusted_proxies): Restricts client-supplied EDNS0 Option 65001 (mac:) and EDNS0 Client Subnet (ecs:) identity assertions to authorized local forwarders (such as dnsmasq --add-mac / --add-subnet, defaulting to loopback 127.0.0.0/8 and ::1/128).force-and: true (e.g., Subnet AND Listener Port).rcode: REFUSED, NXDOMAIN, BLOCK, DROP) or bypass_local / bypass_global flags directly to a routing rule.