Description
Your Pi-hole log is full of blocked domains, but which device asked — the TV, the camera, the kid's tablet? And why was this one allowed and that one blocked? Most DNS blockers just hand you the verdict. TelltaleDNS is a self-hosted DNS resolver and ad blocker written in Rust that ties every query to a device and states why it answered that way, timing each stage down to the microsecond.
Device names come from your router, from mDNS announcements or from names you set, and it recognizes what a device is — a Roku, a camera, a thermostat — from its maker and the names it looks up. Rules can be set per device and per group, and before you save one you can replay it against yesterday's real traffic to see who it would hit.
Explained answers: Every log entry is attributed to a device, timed per stage and annotated with the reason for the answer.
Per-device rules: Blocklists, groups per network or VLAN, schedules, safe search, blocked services, rewrites and quick rules, down to a single device.
Preview changes: See what a rule would have done to yesterday's traffic before you save it.
Encrypted both ways: DoT, DoH and DoQ for clients and upstreams, DNSSEC validation, or full recursion with no forwarder.
Dashboard: For the whole cluster, one node or one site, with a query heatmap, group-to-answer flows, answer-time heatmaps, changes marked on every chart and a wall display mode.
Alerts and integrations: Device anomalies and alerts, Prometheus metrics, OpenTelemetry, dnstap and event sinks.
Keeps answering: If the control plane fails, DNS keeps serving from its last good config. Runs on a Raspberry Pi, in Kubernetes, or both as one cluster.
License: Apache-2.0 or MIT.
Device names come from your router, from mDNS announcements or from names you set, and it recognizes what a device is — a Roku, a camera, a thermostat — from its maker and the names it looks up. Rules can be set per device and per group, and before you save one you can replay it against yesterday's real traffic to see who it would hit.
Features
Explained answers: Every log entry is attributed to a device, timed per stage and annotated with the reason for the answer.
Per-device rules: Blocklists, groups per network or VLAN, schedules, safe search, blocked services, rewrites and quick rules, down to a single device.
Preview changes: See what a rule would have done to yesterday's traffic before you save it.
Encrypted both ways: DoT, DoH and DoQ for clients and upstreams, DNSSEC validation, or full recursion with no forwarder.
Dashboard: For the whole cluster, one node or one site, with a query heatmap, group-to-answer flows, answer-time heatmaps, changes marked on every chart and a wall display mode.
Alerts and integrations: Device anomalies and alerts, Prometheus metrics, OpenTelemetry, dnstap and event sinks.
Keeps answering: If the control plane fails, DNS keeps serving from its last good config. Runs on a Raspberry Pi, in Kubernetes, or both as one cluster.
License: Apache-2.0 or MIT.
