How Warda compares with the two best-known self-hosted DNS filters, and what it does not do yet. Pi-hole (EUPL-1.2) and AdGuard Home (GPL-3.0) are free software with their own licences: Warda (AGPL-3.0) takes ideas from what they show, never their code.
The comparison describes their public versions known in 2026; it will age, and each project keeps its own documentation up to date.
At a glance#
| Warda | Pi-hole | AdGuard Home | |
|---|---|---|---|
| Blocklists, own allow and block rules | yes | yes | yes |
| Learns on the box which names to suggest blocking | yes | no | no |
| People of the household, profiles by age, reports per child | yes | no | no |
| Sensitive categories (adult, gambling, violence…) by profile | yes | through lists | through lists and services |
| Hours of Internet, time a day, school holidays, requests of a child | yes | no | blocking schedule of services |
| Detection of the ways around the filter (VPN, proxy, encrypted DNS) | yes, with alerts | no | no |
| "Something is broken" on a device (pause and one-click unblock) | yes | no | no |
| Network scan, local names, groups of devices, managed switches | yes | local names | clients and local names |
| DHCP server | IPv4, and its DNS announced over IPv6 | IPv4 and IPv6 | IPv4 and IPv6 |
| Encrypted upstream servers (DoH, DoT) | yes | through a companion | yes |
| Encrypted DNS for the devices (DoH, DoT, DoQ) | yes, with a free certificate renewed by itself | no | yes, certificate to bring |
| SafeSearch, blocking of named services | yes, by profile, group, person or device | no | yes |
| DNSSEC validation | by the upstream servers, checked | yes | yes |
| Custom local records (A, CNAME…) | yes | yes | yes |
| Query log with search, filters and live view | yes | yes | yes |
| Rule from a row of the query log | yes | yes | yes |
| Encrypted database | yes | no | no |
| Automatic updates | signed, with rollback | by hand (pihole -up) |
yes |
What Warda does differently#
- A household, not a list of IP addresses. Devices belong to people or groups; the protections follow the age of each person, and adults are never watched (their detailed reports need their own agreement).
- Local learning. Warda studies its own journal and suggests names to block, with the reason, instead of relying only on lists.
- For parents. Hours of Internet, time a day per category, school holidays from the official calendars, requests for more time, alerts when a child tries to go around the filter, weekly summary.
- Built to be left alone. Encrypted nightly backups (and a copy to a USB drive), signed automatic updates with rollback, a page of the scheduled tasks, a diagnostic without browsing data.
What Warda does not do yet#
In the order they are planned (none is promised for a given version):
- Validation of DNSSEC by Warda itself (today: by the upstream servers, checked every 6 hours).
- IPv6 DHCP (today: Warda announces itself as DNS server over IPv6).
- Rules per device; rate limiting per client; a choice of the answer to
a blocked name (0.0.0.0, NXDOMAIN, REFUSED). (Personal rules by regular
expression,
/pattern/, are already there.)
Ideas taken from their interfaces#
The charts and the query log of Warda follow ideas both projects made familiar, drawn again in the charter of Warda:
- an activity chart by steps of 10 minutes over 24 hours, whose window shows under the chart and opens the queries of that window;
- small curves under the figures of the dashboard, rings for the types of queries, the reasons of blocking and the upstream servers, tops with the share of each name;
- a query log with one search box, a filter of the result and of the device, a live view, tinted rows and a rule in one click.
See the technical reference for what each part of Warda does.