A DNS server for the house — and why Technitium
What a resolver of your own actually buys you: blocking for devices that can't be fixed, names that work everywhere, queries that stay home. And why I run Technitium rather than the usual stack.
The TV in my living room talks to a dozen telemetry endpoints and there’s no extension I can install on it. Same for the vacuum, the fridge, the plugs. That’s the argument for running DNS at home in one sentence: it’s the only place you get to answer for every device on the network, including the ones that will never let you install anything.
What it buys you
Blocking that covers everything. Not just the laptop where an extension already works — the appliances, the TV, the phone of anyone who joins the WiFi. A handful of lists refreshed daily, and the devices that can’t run an adblocker are exactly the ones that need one.
Your own names. home.example.com answers with a LAN address inside the house and the public one outside. Same URL everywhere, no /etc/hosts, no port numbers to remember. Once you hold your own zone you stop thinking in IPs.
Queries that stay yours. A recursive resolver asks the root servers and works down from there. No upstream provider gets a log of every domain the house looks up. Slower on a cold cache, invisible after.
Why Technitium
The usual stack is Pi-hole or AdGuard Home for the blocking, Unbound behind it for the recursion, and a third tool to keep a second copy in sync. Technitium does all of it in one binary — recursion, authoritative zones, blocklists, DHCP, DoH, DoT, DNSSEC — clustering included, so a second node is a join rather than a cron job.
Mine is two: a Proxmox LXC holding the primary zones, and a Raspberry Pi 4 wired into the cabinet. Config is edited on one and lands on both, and if the primary is down the other keeps resolving — a house whose DNS is down is a house where nothing works.
The UI is dense, everything being a zone or a setting rather than a friendly toggle. But every screen in it is an HTTP API call behind a token, so I mostly describe the change I want and let Claude drive the API instead.
What it costs
An evening to set up, and then you’re the support desk: when a list over-blocks something, someone in the house hits it before you do and the fix is yours. Both nodes run the same software, so a bad list lands on both — keep a config backup outside the cluster.
The takeaway
A resolver is the cheapest thing in the rack and the one everything else leans on. Run software that does the whole job in one process, run two of them, then forget it’s there. Mine rides the tailnet as well, so the blocking and the names follow me abroad 🧭.