A household, not a list of IP addresses
Devices belong to people or groups; the protections follow the age of each person, and adults are never watched (their detailed reports need their own agreement).
Comparison
A Pi-hole and AdGuard Home alternative: how Warda compares
How Warda compares with the two best-known self-hosted DNS filters, and what it does not do yet. Both are free software with their own licences: Warda (AGPL-3.0) takes ideas from what they show, never their code.
The comparison describes their public versions known in 2026; it will age, and each project keeps its own documentation up to date.
| 44 of 44 features | Warda | Pi-hole | AdGuard Home |
|---|---|---|---|
| Blocklists, own allow and block rulesFree | yes | yes | yes |
| Counter of blocked domainsFree | yes — entries, and the names they cover | yes: distinct domains of the lists added | partial — rules of each list, no total |
| Learns on the box which names to suggest blockingFree | yes, and shows what it watches and why | no | no |
| People of the household, profiles by age, reports per childFree | yes | no | no |
| Sensitive categories (adult, gambling, violence…) by profileFree | yes | partial — through lists | partial — through lists and services |
| Hours of Internet, time a day, school holidays, requests of a childSubscription | yes | no | partial — blocking schedule of services |
| Detection of the ways around the filter (VPN, proxy, encrypted DNS)Subscription | yes, with alerts | no | no |
| "Something is broken" on a device (pause and one-click unblock)Free | yes | no | no |
| Network scan, local names, groups of devices, managed switchesFree | yes | partial — local names | partial — clients and local names |
| DHCP serverFree | yes — IPv4 and IPv6 | yes — IPv4 and IPv6 | yes — IPv4 and IPv6 |
| Encrypted upstream servers (DoH, DoT)Free | yes | partial — through a companion | yes |
| Encrypted DNS for the devices (DoH, DoT, DoQ)Free | yes, with a free certificate renewed by itself | no | partial — yes, certificate to bring |
| SafeSearch, blocking of named servicesFree | yes, by profile, group, person or device | no | yes |
| DNSSEC validationFree | yes, by Warda itself (option) or by the upstream servers | yes | yes |
| Custom local records (A, CNAME…)Free | yes | yes | yes |
| Query log with search, filters and live viewFree | yes, with the person or group of each device | yes | yes |
| Rule from a row of the query logFree | yes | yes | yes |
| Encrypted databaseFree | yes | no | no |
| Automatic updatesFree | yes — signed, with rollback | partial — by hand | yes |
| Rules per device, rate limiting per client, choice of the answer to a blocked nameFree | yes | yes | yes |
| Look-alike names: homographs, typing mistakes, brands in another name or in a subdomainFree | yes, blocked when there is no doubt or the domain is new | no | no |
| Data leaks through DNS (tunnels) detected and blockedFree | yes, for the device, with an alert | no | no |
| Plan of the home network (box, switches, Wi-Fi, devices), placed by the switches (SNMP)Free | yes | partial — list of the machines | partial — list of the clients |
| DNS rebinding (an Internet name that answers an address of the home) blockedFree | yes | partial — by hand, in dnsmasq | partial — with rules to write |
| Spyware (stalkerware) blocked, the person of the device toldFree | yes, with the indicators of Echap | partial — through a list to add | partial — through a list to add |
| Remote control tools and clockwork beacons reportedFree | yes | no | no |
| Quarantine of a device in one click (only its updates get through)Free | yes | partial — through a group, by hand | partial — client blocked entirely |
| Check of the network: a box announcing its own IPv6 DNS, devices that never go through the filterFree | yes, with alerts and a guide per box | no | no |
| Protection of the devices outside the home (mobile data, other Wi-Fi)Subscription | yes (beta), through the online service of Warda, with the rules of each device | partial — through a VPN to set up yourself | partial — through a VPN, or by opening it on the Internet |
| Ports of the home exposed on the Internet, checked from outsideFree | yes (beta): public address, openings of the router (UPnP), Telnet and FTP on the network | no | no |
| E-mail addresses of the household watched in known data breachesSubscription | yes (beta), with k-anonymity, once the breach service of Warda opens | no | no |
| Restricted mode for connected objects (only the names learned)Free | yes (beta), by device or group | partial — by hand, with groups and rules | partial — by hand, with rules per client |
| Cryptocurrency mining pools blocked, the device reportedFree | yes, for everyone (beta) | partial — through a list to add | partial — through a list to add |
| Export to a SIEM: alerts, administration log and names, syslog in JSON or CEFBusiness | yes (beta) | no | no |
| Rules of a company given in one click (adult, piracy, bypasses, mining)Business | yes | partial — lists to add | partial — lists and services to choose |
| Roles and permissions (RBAC), groups of accountsBusiness | yes: administrator or member; with Business, groups with roles from a catalogue, every change logged | no, a single admin password | no, every account has every right |
| Second opinion from a cloud analysis service (collective base)Subscription | yes, off by default, domain names only (beta) | no | no |
| Data loss prevention (DLP): file transfers, webmail, AI assistants…Business | yes, at the DNS level: allow, alert or block (beta) | no | no |
| Unblock requests from the users: duration, justification, approval and historyBusiness | yes (beta) | no | no |
| High availability: two boxes, one shared address, automatic takeoverBusiness | yes (beta): VRRP with keepalived, IPv4 and IPv6, a read-only secondary that can replace the primary, alerts, protection outside the home taken over | no (setups made by the community) | no |
| Several sites followed from one boxBusiness | yes (beta): one signed policy, updates and a company report from the head office | no | no |
| Users of a directory (Active Directory, LDAP, Entra ID, Google Workspace) and sign-in with itBusiness | yes (beta): imported every hour; sign-in with the directory password, Microsoft or Google | no | no |
| Security score out of 100, with the actions to take by priorityBusiness | yes (beta), with its trend | no | no |
| AI assistants: who uses which; allowed, reported or blocked one by oneBusiness | yes (beta) | partial — blocking through lists | partial — blocking through rules |
What Warda does differently
Local learning
Warda studies its own journal and suggests names to block, with the reason, instead of relying only on lists.
For parents
Hours of Internet, time a day per category, school holidays from the official calendars, requests for more time, alerts when a child tries to go around the filter, weekly summary.
Built to be left alone
Encrypted nightly backups (and a copy to a USB drive), signed automatic updates with rollback (on the Raspberry Pi image, the system updates too, shown and installed from the System page), a page of the scheduled tasks, a diagnostic without browsing data.
What Warda does not do yet
In the order they are planned (none is promised for a given version).
- 1Actions on the sites BusinessFrom the manager box: the rules and policies of the company given to every site, every site updated at once, their reports gathered. Planned with Warda Business.
Ideas taken from their interfaces
The charts and the query log of Warda follow ideas both projects made familiar, drawn again in the charter of Warda.
- an activity chart by steps of 10 minutes over 24 hours, whose window shows under the chart and opens the queries of that window;
- small curves under the figures of the dashboard, rings for the types of queries, the reasons of blocking and the upstream servers, tops with the share of each name;
- a query log with one search box, a filter of the result and of the device, a live view, tinted rows and a rule in one click.
Looking for a NextDNS alternative at home?
Services such as NextDNS filter from their own servers: nothing to install at home, and the same protection on every network. Warda makes the other choice: a box at home, which answers itself and keeps the history of the queries.
From the public site of NextDNS in 2026; its own pages are the reference.
- NextDNS describes a service for all devices and all networks, set up in a few seconds; its parental control blocks categories, named apps and games, forces safe search and allows some sites only at set times of the day.
- Its logs are kept on its servers, from one hour to two years or not at all, in the United States, the European Union, the United Kingdom or Switzerland, as the customer chooses.
- Its free plan filters 300,000 queries a month; beyond, it answers without filtering until the next month, unless a paid plan is taken.
- Warda runs on a box that stays switched on at home (Raspberry Pi, Docker, Debian): the history of the queries stays on it; with the subscription (beta), the devices you choose stay protected away from home through the online service of Warda, which passes their queries to the box.
Coming from another DNS filter?
Warda is in open beta: the subscription is offered to every tester during the beta test period.