Move over to kudurru
Coming from Pi-hole, AdGuard Home or Technitium? Compare what carries over, check the differences, then rebuild your configuration alongside the server you already run.
Coming from
Keep the lists and local names you trust. Add authoritative zones, encrypted DNS listeners and Kubernetes CRDs.
Groups become client groups and policies. Adlists become block lists; local DNS records become zone records.
Before you switch. Move DHCP to your router first if Pi-hole serves it. Translate regex extensions and reserve device addresses.
Move from Pi-holeComing from
Bring your DNS filters, client rules and encrypted upstreams into a server with explicit object ownership and shared Kubernetes configuration.
Filters become block and allow lists. Persistent clients become client groups; per-client settings become policies.
Before you switch. Review rule modifiers, global exceptions and DNS rewrites. AdGuard's full filtering syntax is not supported in v0.1.0.
Move from AdGuard HomeComing from
Move primary zones, conditional forwarding and blocking to a Go binary with a dashboard, CLI and Kubernetes API objects.
Export primary zones as standard zone files. Recreate conditional forwarders, access controls and blocking policies explicitly.
Before you switch. Inventory DNS Apps, recursive resolution, DNSSEC and secondary zones. These need a separate service or a later kudurru release.
Move from TechnitiumFeature comparison
kudurru v0.1.0 combines authoritative DNS, forwarding, filtering and a dashboard. Check the features you depend on before moving a working network.
| Feature | Pi-hole | AdGuard Home | Technitium | kudurru v0.1.0 |
|---|---|---|---|---|
| DNS filtering | Hosts, domains and regex; group assignments | Adblock DNS rules, allowlists and client settings | Allowed/blocked zones and lists; Advanced Blocking app | Hosts, domains, adblock subset and RE2; client-group policies |
| Local names and zones | Local DNS and CNAME records | DNS rewrites | Primary, secondary, stub, forwarder and catalog zones | Primary and forward zones; BIND import/export; AXFR/IXFR out |
| Resolution | Forwards to upstreams; recursion with a separate resolver | Forwards to upstreams | Full recursive resolver or forwarding | Forwards to named upstream groups; conditional forwarding |
| DNSSEC | Optional validation | Requests DNSSEC data from upstreams | Validation and authoritative signing | No validation or signing in v0.1.0 |
| DHCP | Built in | Built in | Built in | Use your router or a separate DHCP server |
| Encrypted DNS listeners | Use a separate proxy | DoT, DoH and DoQ | DoT, DoH and DoQ | DoT, DoH, DoQ and DoH3 |
| Multiple servers | Separate instances; external sync tools | Separate instances; external sync tools | Built-in clustering | Shared Kubernetes store; Compose HA uses shared object files |
| Kubernetes configuration | Container configuration; no native CRDs | Container configuration; no native CRDs | Container configuration; no native CRDs | Native CRDs, Helm and external-dns webhook |
| Identity and access | Local dashboard login | Local users | Roles, OIDC and LDAP | Local users; OIDC and scoped roles with a key |
| Migration input | Teleporter backup | Configuration and working directory | Configuration backup and zone export | Manual configuration; standard BIND zone import only |
| License | Open source; component licenses apply | GPL-3.0 | GPL-3.0 | Source available; eligible community use free, commercial production by agreement |
Sources: Pi-hole · AdGuard Home · Technitium · kudurru changelog. Detailed mappings and limitations in the docs.
Without a key, kudurru supports one node, the default policy and the built-in administrator. A free key for eligible community use unlocks additional policies and up to three nodes. Business and government production use needs a commercial agreement. Review licensing and request a key
The migration path
Back up the source configuration. Give kudurru a separate address, copy lists and local names, and recreate client rules using your product's guide above. Product backup archives cannot be imported directly.
Check allowed and blocked names, local records, reverse lookups and each client group. Use real DNS queries as well as the dashboard's policy explanations.
Try one device first. Update DHCP and IPv6 DNS advertisements after it passes. Keep the original server and backup ready until leases and caches have expired.