Cloudflare’s DNS is easy to recommend for most people. It’s fast, their malware-blocking variants provide a decent safety net right out of the box, and they’re easily memorized.
However convenient those options are, they also remove a lot of control and flexibility. When you rely on a third-party DNS filter for your security, you are essentially trusting a black box. You’re accepting Cloudflare’s blocklists and Cloudflare’s policies. You have no way of knowing exactly why a site is blocked or what is being allowed through.
DNS filtering stops threats before they reach you
Why fight to remove a virus when you can avoid infection?
If you want to manage your security rather than trusting it to a third party, you can use a self-hosted service like a Pi-hole. Any time you try to connect to a domain on the internet, a DNS server translates the familiar name you type into your address bar into an IP address. Normally, that request goes directly to a DNS service like Cloudflare.
When you add a Pi-hole to your network, it acts as a local DNS filter for your entire home network. Instead of your devices asking Cloudflare directly for the IP address of a domain to form a connection, they ask your Pi-hole first. If the domain is on a blocklist on your Pi, the connection is prevented before it even starts.
That is a very effective way to approach network-scale protection. Rather than block malware as it is trying to infect your PC, your PC never connects to the malicious domain at all. Instead of your browser detecting that a site might be untrustworthy, the Pi-hole prevents you from reaching the phishing site in the first place.
- Brand
-
Raspberry Pi
- CPU
-
Quad-core 64-bit ARM Cortex-A53
- Memory
-
512MB of SDRAM
The Raspberry Pi Zero 2 W is super tiny and super affordable, but it packs enough computing power for a variety of DIY projects. You can use it to create a handheld retro gaming console, for Klipper/Mainsail, a super compact home or media server, and more.
Because you’re self-hosting it, you can curate your own lists focused on phishing, command-and-control servers, cryptojacking, scam domains, or anything else you choose. You can add, remove, and audit these lists to suit your specific needs.
Watch for errors
You will have to deal with false positives occasionally. Sometimes a security-focused blocklist will accidentally break a regular app or a login page. When that happens, you’ll have to diagnose it yourself. As annoying as it can be when it does happen, at least you have the option—many DNS filters you can use are all-or-nothing. If you get a false positive, you’re out of luck.
7 things I wish I knew before running a Pi-hole
Don’t be like me, make sure to prepare for these things before deploying Pi-hole the first time.
Information can improve your security
What you don’t know might hurt you
Another big advantage of the Pi-hole is the amount of information you’re given. When you host your own DNS filter, you can periodically check a dashboard and logs that let you know how your filters are working and what your devices are doing.
You’ll be able to spot your TV phoning home when you didn’t expect it, or unexplained traffic to IoT devices that shouldn’t be there. If something is trying to communicate with a domain known to serve or control malware, you know that the device is infected.
Information is key to choosing your digital defenses. Cloudflare can block any number of threats for you, but it doesn’t provide you with granular information; local DNS filtering gives you the information you need to actually fix the problem.
Self-hosting a filter is inexpensive
You can spend less than $30
Cloudflare is free, but a Pi-hole doesn’t need to break the bank either. I’ve been running a Pi-hole on a Raspberry Pi Zero 2 W for a long time now with no issues. The entire thing cost about $26 at the time, including the board, the case, and a new micro USB cable.
The Pi Zero 2 W is so small enough that I can just tuck it next to my router, and the power draw is low enough that I don’t have to worry about it driving up my electricity bill.
You don’t have to host it on a low-power device though. You can easily install Pi-hole in a container on a more powerful device like a Pi 5, or even on a Proxmox server alongside your other services.
- Brand
-
PNY
- Capacity
-
32GB
- Speed (Read/Write)
-
100MB/s
This 5-pack of PNY 32GB Elite microSD cards are perfect for your Raspberry Pi or other homelab projects. With read speeds up to 100MB/s with Class 10 U3 classifications, these cards are ideal for boot drives, storage, and much more.
Whatever you do, just make sure that you have a backup ready in case something goes wrong. MicroSD cards wear out, hard drives or capacitors can fail, and power supplies die. You don’t want your entire network to experience an outage unnecessarily.
Cloudflare’s DNS is a fine safety net if you want a completely hands-off solution, but if you want more control over your home network security, you need to be able to see and control the traffic filters yourself. Moving to a self-hosted filter is a great way to do that at little to no cost.
It’s also important to remember that DNS filtering is only one layer of defense. While it can stop you from hitting known malicious domains, it can’t inspect encrypted traffic, replace actual malware protection on your devices, and enforce safe browsing habits. It is one extra layer of security, not a silver bullet.