Back to catalog
Blocky
Apache-2.0Blocky is a self-hosted DNS proxy replacing cloud resolvers like NextDNS with local ad-blocking, YAML-based configuration, and native Prometheus metrics.
Open-source alternative to — compare it against:
Overview
NextDNS centralizes resolver logs on third-party servers and enforces monthly query quotas once traffic scales beyond personal allowances. Blocky relocates that entire resolution pipeline to a self-hosted proxy inside the local network perimeter. It enforces client-specific blocklists and conditional upstreams directly from static YAML configuration without transmitting network telemetry outward.
Why Blocky instead of NextDNS
NextDNS delivers managed cloud filtering with zero infrastructure overhead, but that model requires trusting an external provider with every internal device lookup. Home devices, automation controllers, and personal workstations continuously dispatch DNS queries that map daily habits and online activity. When using cloud resolvers, those query streams leave the local subnet, and features like custom retention or extended logs require recurring subscription fees.
Blocky reverses that dynamic by treating DNS as local infrastructure defined in code. Running as a single Go binary or lightweight container, it intercepts network queries, validates upstream signatures over DNS-over-HTTPS or DNS-over-QUIC, and strips unwanted domains before requests reach external networks. You surrender NextDNS's turnkey setup and managed web dashboard in exchange for complete data sovereignty, unmetered query volume, and the ability to declare client groups, IP blocking rules, and upstream routes in revision-controlled configuration files.
What it does well
- Declarative configuration files: Homelab admins can version-control DNS rules, custom overrides, and upstreams in Git repositories rather than managing state through an ephemeral web interface.
- Client-specific group filtering: Assigns IP addresses, subnets, or CIDR blocks to discrete blocklist groups, enabling different filtering policies for smart home devices, guest networks, and workstations.
- Modern encrypted DNS transports: Native client and server support for DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC, and DNS-over-HTTP/3 shields upstream lookups without requiring extra forwarder daemons.
- Response caching and prefetching: Caches DNS answers with configurable time-to-live values and prefetches popular domains before expiration to minimize local lookup latency.
- Redundant clustering with Redis: Supports shared distributed caching across multiple instances via Redis, enabling high-availability resolvers without manual list synchronization.