DNS Intercept Mode

When you use Control D alongside VPN software, there can be unexpected behaviour such as:

Intermittent failures — DNS randomly stops working for a few seconds
Bypassed filtering — Queries sneak through to the VPN's DNS, skipping your Control D profile
Infinite loops — Control D sets DNS, VPN overwrites it, Control D fixes it, VPN overwrites again...

When to Use This

Enable DNS Intercept Mode if you:

Use corporate VPN software (F5, Cisco, Palo Alto, Zscaler)
Run Tailscale, WireGuard, or other overlay networks
Experience random DNS failures when VPN connects/disconnects
See gaps in your Control D analytics when VPN is active
Have endpoint security software that also manages DNS

How to Enable

Add --intercept-mode to your ctrld start command:

ctrld start --intercept-mode dns --cd RESOLVER_ID_HERE

--intercept-mode dns automatically detects VPN internal domains and routes them correctly while Control D handles everything else.

--intercept-mode off will disable this feature and restore the default behavior of Control D.

Platform Support

Platform	Supported	How It Works
Windows	✅	Uses NRPT (Name Resolution Policy Table)
macOS	✅	Uses pf (packet filter) to redirect DNS traffic
Linux	❌	Not currently supported (Linux DNS stacks don't have the same VPN conflicts)

📘
Testing DNS Intercept Mode on Windows
nslookup.exe bypasses the Windows DNS Client and its NRPT rules, so it does not reliably show whether DNS Intercept Mode is working. Use Resolve-DnsName example.com in PowerShell instead. If you must use nslookup, query the local ctrld listener explicitly: nslookup example.com 127.0.0.1.

Additional Features

Captive portal recovery — Wi-Fi login pages (hotels, airports, coffee shops) work automatically
No network adapter changes — Your DNS settings stay untouched, eliminating conflicts entirely

Known VPN Compatibility

DNS Intercept Mode has been tested with:

✅ F5 BIG-IP APM
✅ Cisco AnyConnect
✅ Palo Alto GlobalProtect
✅ Tailscale (including Exit Nodes)
✅ Windscribe
✅ WireGuard