Looking for a Pi-hole alternative?
kudurru combines network DNS blocking with authoritative zones, encrypted DNS transports and a dashboard for multiple nodes. It may fit if you want to keep familiar lists and client groups while managing DNS in Docker or Kubernetes.
Familiar blocking, typed configuration
Use URL blocklists, exact domains, wildcard and regex rules, client groups, and one-click allow and deny from the query log. Each answer records why it was given, so you can trace an unexpected block to its list and rule.
Configuration is stored as BlockList, ClientGroup and Policy objects. The same object YAML works with Docker and Kubernetes. Local names become records in an authoritative DNSZone; conditional forwarding sends selected domains to another resolver.
Map Pi-hole concepts to kudurruWhen kudurru is a useful fit
Consider kudurru when you want DNS zones and network filtering in one server, encrypted DNS listeners for DoT, DoH, DoQ and DoH3, or Kubernetes custom resources managed through Helm and GitOps. The dashboard can show queries and health across multiple nodes.
kudurru uses the Kudurru Community License. Eligible personal and nonprofit use is free; business and government production needs a commercial agreement. Additional policies, multiple nodes and features such as OIDC require a key. Check the license guide against the setup you plan to run.
Check licensing and key requirementsPlan a gradual migration
There is no automatic Pi-hole importer or Teleporter archive import in the current release. Recreate your lists, groups and local records using the migration guide. kudurru does not provide DHCP; keep that on your router or another DHCP server.
Run kudurru on a separate address beside Pi-hole. Compare answers for representative clients, move a test device, then change the DNS address advertised by DHCP. Keep Pi-hole available until its query log is quiet. DNSSEC validation is planned for v0.2, and Pi-hole API compatibility is planned for v1.0.
Follow the migration checklistCommon questions
Can I import my Pi-hole backup directly?
No. Migration is currently manual. The guide maps Pi-hole groups, adlists, domain rules, local records and upstreams to kudurru objects. Keep your existing Pi-hole installation while you test the new configuration.
Can I also move from AdGuard Home?
There is a separate AdGuard Home migration guide in the documentation. It explains how to recreate filtering, client policies, DNS rewrites and upstream settings; migration is manual there too.