Control D review

Control D is DNS filtering software for blocking malicious domains and setting internet access policies across devices. It is aimed at teams that want one place to manage filtering, rather than a basic public DNS resolver. The homepage says administrators can control which internet destinations AI agents can reach and see each lookup.

The service lists native clients for Mac, Windows, Linux, iOS and Android, plus several deployment methods. It supports DNS-over-HTTPS/3, DNS-over-TLS, DNS-over-QUIC and Legacy DNS. The homepage also says more than 1,000 apps and services can be blocked.

Control D is not free: the pricing page lists a 14-day trial and SMB plans from $2 per endpoint per month. That makes the main buying question less about whether it has enough controls and more about whether your team needs them—and is willing to learn the interface.

Control D covers more than domain blocking. The homepage describes policy controls for AI-agent destinations, visibility into agent lookups, multiple deployment methods and clients across five operating systems. More than 1,000 apps and services are listed as blockable, which gives teams options beyond maintaining domain lists themselves.

The pricing page says every listed plan includes 30-day query log retention and analytics retention of up to one year. SMB includes self-serve deployment and four modern DNS protocols. Enterprise adds dedicated infrastructure, a named customer success manager and SIEM log streaming. MSP is built for client fleets, with per-client profiles and billing; the page lists more than 99% uptime for that plan.

The homepage reports a 99.98% malware block rate, verified by Nexxwave in 2025. That is a vendor-published figure, not an independent comparison here. Some Reddit users praise the breadth of service controls and describe using Control D for device visibility, router integration or scheduled blocking. Those reports are individual experiences, but they point to the product’s appeal: policy depth matters more than a minimalist DNS setup.

The main price is only clear for SMB: $2 per endpoint per month, billed monthly or annually. The annual price is not published. School / Non-profit and MSP rates are also not published, while Enterprise is custom-priced. There is no free plan, only a 14-day trial. Custom storage regions cost extra for SMB and Enterprise, but the amount is not published.

Retention has a fixed ceiling in the listed plans: query logs are kept for 30 days, and analytics for up to one year. Teams needing longer query histories should not assume they are included. The pricing page lists three data storage regions for School / Non-profit, MSP and Enterprise; SMB does not list that inclusion.

The interface is a risk for teams that want a quick switch. Reddit users disagree: one described it as confusing and another called it bloated, while a Control D commenter praised its organization and customization. Latency reports are also anecdotal and conflicting, not a reliable basis for choosing a resolver. Budget time to assess the controls and performance in your own setup before moving a fleet.

Control D’s published starting price is $2 per endpoint per month for SMB. That’s not a flat team fee: multiply it by the endpoints you need covered. The published pricing details do not list a higher SMB tier or enough prices to calculate the jump to another plan. School / Non-profit and MSP prices are not published, while Enterprise is custom-priced.

Plans can be billed monthly or annually, but the annual price is not published, so there’s no way to compare the annual discount before contacting sales. The School / Non-profit, MSP and Enterprise plans each list three data storage regions; SMB’s listed features do not. Custom storage regions cost extra for SMB and Enterprise, with no published price.

There’s no free plan. Control D offers a 14-day trial. All listed plans include 30-day query log retention and up to one year of analytics retention, according to the pricing information.

Plan for a policy and endpoint migration, not just a DNS change. Control D lists clients for Mac, Windows, Linux, iOS and Android, plus multiple deployment methods and four modern encrypted DNS protocols on SMB. Check which devices and DNS settings you need to move, then map existing access rules to Control D’s profiles and app controls. The published material does not specify an import tool or migration service, so confirm those before setting a cutover date.

Leaving deserves the same scrutiny. Control D lists 30-day query log retention and up to one year of analytics, but its data-export options are not published. SIEM log streaming is listed for Enterprise; it is not listed among SMB features. If you need to retain logs, ask how to export them before canceling. The published published material contains no Reddit posts, so we can’t responsibly report user complaints or common reasons for leaving.