How to Use NextDNS with Control D CLI on Windows

NextDNS is one of the most popular encrypted DNS services available, while Control D's ctrld is a powerful DNS forwarding daemon that can run on Windows, Linux, macOS, routers and other platforms.

Normally, if you want to use NextDNS on Windows, you would install the official NextDNS CLI.

But there is another option.

You can use ctrld as the local DNS daemon while continuing to use your existing NextDNS profile as the upstream DNS service.

This is possible because ctrld has a dedicated NextDNS Mode.

In this mode, ctrld runs locally on your computer and forwards DNS queries to your selected NextDNS configuration. Your NextDNS blocklists, allowlists, security settings and other profile settings continue to work normally.

This guide explains how to set it up on Windows, including both the automatic installation method and the manual installation method using the official GitHub release.

What This Setup Does

A normal NextDNS CLI installation looks like this:

Your Windows PC
       ↓
NextDNS CLI
       ↓
NextDNS
       ↓
Internet

When using ctrld with NextDNS, the arrangement becomes:

Your Windows PC
       ↓
ctrld
       ↓
NextDNS Profile
       ↓
Internet

ctrld becomes the local DNS proxy, while NextDNS remains responsible for resolving and filtering your DNS queries.

You therefore do not need to recreate your NextDNS configuration inside Control D.

Important: This guide does not migrate your DNS filtering from NextDNS to Control D. NextDNS remains your DNS provider. You are simply using ctrld as the local DNS daemon.

Why Use ctrld With NextDNS?

The official NextDNS CLI is already a very capable application, so there is no requirement to replace it.

However, ctrld can be useful if you want a more flexible DNS proxy that can later be configured with different upstream DNS services, multiple upstreams, routing rules and other advanced DNS features.

Some reasons you might prefer this setup include:

• You already use ctrld on other devices
• You want to standardize your DNS software across devices
• You want to experiment with advanced DNS routing
• You want an easy way to switch between DNS providers later
• You want to use ctrld's DNS interception features
• You prefer ctrld's service and configuration management

What You Need

Before starting, you will need:

• A NextDNS account
• An existing NextDNS configuration
• Your NextDNS Profile ID
• A Windows PC
• Administrator access to Windows
• The ctrld daemon

You do not need a Control D subscription simply to use ctrld in NextDNS Mode.

Step 1: Find Your NextDNS Profile ID

Log in to your NextDNS account and open the configuration you want to use.

Every NextDNS configuration has a unique Profile ID.

It looks something like:

abcdef

You only need this short Profile ID. You do not need to copy the complete DNS-over-HTTPS URL.

Keep the Profile ID handy because we will use it when configuring ctrld.

Step 2: Open PowerShell as Administrator

Open the Windows Start menu and search for:

PowerShell

Right-click Windows PowerShell and select:

Run as administrator

The PowerShell window should show Administrator: Windows PowerShell in its title bar.

Administrator access is required. ctrld needs elevated privileges to install its Windows service and modify the DNS configuration of your network adapters.

Step 3: Install ctrld Automatically

The easiest way to install ctrld on Windows is to use the official PowerShell installer.

Run this command in Administrator PowerShell:

(Invoke-WebRequest -Uri 'https://api.controld.com/dl/ps1' -UseBasicParsing).Content | Set-Content "$env:TEMP\ctrld_install.ps1"; Invoke-Expression "& '$env:TEMP\ctrld_install.ps1'"

The installer detects your Windows architecture, downloads the appropriate ctrld.exe executable and installs it as a Windows service.

After installation, verify that the command is available:

ctrld --version

If a version number is displayed, the installation was successful.

PowerShell Error: Scripts Are Disabled

There is a common problem you may encounter when running the PowerShell installer.

Windows PowerShell may display an error similar to:

cannot be loaded because running scripts is disabled on this system.

This is caused by PowerShell's Execution Policy.

It does not necessarily mean that the ctrld installer itself is broken. PowerShell is simply refusing to execute the downloaded script because of the current execution-policy configuration.

You may see an error similar to:

File C:\Users\YourName\AppData\Local\Temp\ctrld_install.ps1
cannot be loaded because running scripts is disabled on this system.

For more information, see about_Execution_Policies.

How to Fix It

The recommended approach for this installation is to temporarily bypass the execution policy for the current PowerShell session only.

Run:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

PowerShell will ask you to confirm the change.

Enter:

Y

Then run the ctrld installer again:

(Invoke-WebRequest -Uri 'https://api.controld.com/dl/ps1' -UseBasicParsing).Content | Set-Content "$env:TEMP\ctrld_install.ps1"; Invoke-Expression "& '$env:TEMP\ctrld_install.ps1'"

The important part of the command is:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

-Scope Process means the change applies only to the current PowerShell process.

It does not permanently change the execution policy for your computer or user account.

Once you close the PowerShell window, the temporary policy change disappears.

Do not use -Scope LocalMachine just to install ctrld. There is normally no reason to permanently weaken the system-wide PowerShell execution policy for this purpose.

Why Does the PowerShell Error Happen?

Windows PowerShell uses execution policies to control when scripts can run.

On some Windows installations, the configured policy prevents scripts downloaded from the internet from being executed automatically.

When the ctrld installer downloads a PowerShell script and attempts to execute it, PowerShell can therefore stop it before the installation begins.

The temporary Process-level bypass allows the installer to run without permanently changing the security policy of Windows.

Step 4: Configure ctrld for NextDNS

Once ctrld is installed, configure it to use your NextDNS Profile ID.

Run:

ctrld start --nextdns YOUR_NEXTDNS_PROFILE_ID

Replace YOUR_NEXTDNS_PROFILE_ID with your actual NextDNS Profile ID.

For example:

ctrld start --nextdns abcdef

Do not use the example ID above. Use the ID belonging to your own NextDNS configuration.

What Happens When You Run ctrld start?

This command does considerably more than simply launch a program.

ctrld creates the required configuration, installs the Windows service and starts the local DNS listener.

The service is designed to continue running in the background and start automatically with Windows.

The resulting DNS path is:

Windows applications
        ↓
Windows DNS
        ↓
ctrld local listener
        ↓
NextDNS
        ↓
NextDNS filtering
        ↓
Internet

There is one additional configuration change that is important for a normal Windows desktop installation.

Step 5: Change the DNS Listener to 127.0.0.1

After the initial ctrld configuration, open the configuration file:

C:\ControlD\ctrld.toml

Look for the listener section. Depending on the version and configuration, it may look similar to:

[listener]

  [listener.0]
    ip = '0.0.0.0'
    port = 53

Change:

ip = '0.0.0.0'

to:

ip = '127.0.0.1'

The listener should then look like:

[listener]

  [listener.0]
    ip = '127.0.0.1'
    port = 53

Why Change 0.0.0.0 to 127.0.0.1?

0.0.0.0 means that the DNS listener can bind to all available IPv4 network interfaces.

That is useful when ctrld is intended to act as a DNS server for other devices on a network.

However, that is not normally necessary on a Windows desktop where ctrld is being used only to handle DNS queries generated by that computer.

For this type of setup, it is better to bind the DNS listener to the local loopback address:

127.0.0.1

127.0.0.1 is the IPv4 loopback address, meaning that the listener is accessible only from the same computer.

This changes the setup from:

All network interfaces
        ↓
0.0.0.0:53
        ↓
ctrld
        ↓
NextDNS

to:

This Windows PC
        ↓
127.0.0.1:53
        ↓
ctrld
        ↓
NextDNS

This prevents the DNS listener from unnecessarily accepting DNS requests arriving through your LAN, Wi-Fi or other network interfaces.

It is therefore a sensible security and exposure reduction for a single-PC installation.

Do not make this change if other devices need to use this computer as their DNS server. If you intentionally use the Windows PC as a DNS server for your LAN, the listener needs to be reachable through the appropriate network interface.

Restart ctrld

After saving the configuration file, restart the service:

ctrld restart

Then verify that it is running:

ctrld status

Note: If your installed version already generates 127.0.0.1 for the local listener, you do not need to change anything. The purpose of this step is to correct configurations that are listening on 0.0.0.0.

Step 6: Verify That DNS Is Working

Now open your NextDNS dashboard.

Visit a few websites or use applications that generate DNS queries.

Then open the Analytics section of your NextDNS configuration.

Your DNS queries should begin appearing there.

This confirms that:

• Windows is sending DNS queries to ctrld
• ctrld is forwarding them to NextDNS
• Your correct NextDNS Profile ID is being used
• Your NextDNS filtering configuration is active

Manual Installation From GitHub

If you do not want to use the PowerShell installer, you can install ctrld manually from its official GitHub releases.

This is useful if you prefer downloading the executable yourself, want to avoid running an installation script, or simply want more control over where the program is installed.

Download ctrld from GitHub Releases →

Choose the Correct Windows Build

Open the latest release and look through the available files.

For a normal 64-bit Intel or AMD Windows PC, download the Windows AMD64 build.

The filename will look similar to:

ctrld_1.x.x_windows_amd64.zip

Most modern Windows 10 and Windows 11 PCs use the AMD64 build, even if the processor itself is made by Intel.

Other Windows builds are available for 32-bit x86 and ARM systems.

Extract ctrld.exe

Extract the downloaded ZIP file to a permanent folder.

For example:

C:\Program Files\ControlD\

You should end up with:

C:\Program Files\ControlD\ctrld.exe

You can use another folder if you prefer. Just make sure you remember where the executable is located.

Test the Manually Downloaded Binary

Open Administrator PowerShell and navigate to the folder containing ctrld.exe:

cd "C:\Program Files\ControlD"

Then run:

.\ctrld.exe --version

If the version number is displayed, the binary is working correctly.

Start ctrld Manually

Now start ctrld using your NextDNS Profile ID:

.\ctrld.exe start --nextdns YOUR_NEXTDNS_PROFILE_ID

For example:

.\ctrld.exe start --nextdns abcdef

Because the executable was manually downloaded and its folder may not be in the Windows PATH, you may need to use .\ctrld.exe instead of simply typing ctrld.

Once the service is installed, ctrld runs in the background and can start automatically with Windows.

What Happens During Manual Installation?

Manual installation does not mean that you have to manually create every Windows service entry yourself.

You are simply downloading the ctrld.exe binary yourself instead of allowing the PowerShell installer to download it for you.

When you run:

.\ctrld.exe start --nextdns YOUR_NEXTDNS_PROFILE_ID

ctrld handles the service setup.

It creates the necessary configuration, installs and starts the Windows service, creates the local DNS listener and configures Windows to use it.

The configuration file is normally created at:

C:\ControlD\ctrld.toml

You can subsequently manage the service with:

ctrld status
ctrld restart
ctrld stop
ctrld uninstall

Automatic vs Manual Installation

Feature	PowerShell Installer	Manual GitHub Install
Easy installation	Yes	Moderate
Downloads binary automatically	Yes	No
Requires PowerShell script	Yes	No
Official GitHub binary	Downloaded by installer	Downloaded manually
Installs Windows service	Yes	Yes
Good for beginners	Yes	Yes, with a few extra steps
Maximum control	Moderate	Higher

Do Not Run NextDNS CLI and ctrld Together

If you are replacing the NextDNS CLI with ctrld, do not leave both applications actively managing the system DNS configuration.

Both applications are local DNS proxies and can compete for DNS configuration or ports.

If you currently have the NextDNS CLI installed, stop it before starting ctrld.

You can stop the NextDNS CLI with:

nextdns stop

And deactivate its DNS configuration with:

nextdns deactivate

You do not have to uninstall NextDNS immediately.

Keeping it installed but inactive gives you an easy way to switch back if you decide that you prefer the NextDNS CLI.

Recommended: Keep the existing NextDNS CLI installed until you have tested ctrld successfully. Once everything works, you can decide whether you want to remove the old client.

Your Existing NextDNS Settings Continue to Work

One of the biggest advantages of NextDNS Mode is that your existing NextDNS configuration remains unchanged.

You do not need to recreate your:

• Blocklists
• Allowlist
• Denylist
• Security settings
• Privacy settings
• Parental controls
• Rewrites
• Logging settings

ctrld simply sends the DNS queries to your selected NextDNS profile.

NextDNS Analytics Still Work

Because the DNS queries are still being processed by NextDNS, your normal NextDNS analytics continue to be available.

You can still see information such as:

• Total DNS queries
• Blocked queries
• Allowed queries
• Top queried domains
• Blocked domains
• Security-related blocks

The exact information displayed depends on your NextDNS configuration and privacy settings.

Using ctrld With a VPN

VPN applications can complicate DNS configurations because many VPN clients replace the system DNS servers when they connect.

This can potentially result in DNS queries bypassing ctrld.

The basic problem can look like this:

Windows
   ↓
ctrld
   ↓
NextDNS

VPN connects
   ↓
VPN changes DNS
   ↓
DNS may bypass ctrld

If your VPN changes DNS settings, test NextDNS again after connecting the VPN.

If NextDNS stops seeing queries or your filtering appears to stop working, the VPN is a likely cause.

Recent versions of ctrld also include DNS Intercept Mode, which is designed to handle applications and VPNs that attempt to take control of DNS.

For example:

ctrld start --intercept-mode=dns --nextdns YOUR_NEXTDNS_PROFILE_ID

Do not enable interception unless you actually need it. A simple configuration is preferable when normal DNS routing already works correctly.

Troubleshooting

ctrld is not recognized

If Windows says:

'ctrld' is not recognized as the name of a cmdlet,
function, script file, or operable program.

you probably installed the binary manually and its directory is not in your PATH.

Navigate to the folder containing ctrld.exe and run:

.\ctrld.exe --version

Alternatively, use the complete path to the executable.

PowerShell says scripts are disabled

Run:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Confirm with Y and then run the installer again.

Remember that -Scope Process makes the change temporary. Closing the PowerShell window restores the previous execution-policy behavior.

ctrld installed but DNS is not working

Check the service:

ctrld status

Then try restarting it:

ctrld restart

Also check that the listener is configured correctly in:

C:\ControlD\ctrld.toml

For a normal single-PC installation, the listener should use:

ip = '127.0.0.1'
port = 53

If it is still using:

ip = '0.0.0.0'

change it to 127.0.0.1 and restart ctrld.

NextDNS shows no queries

Check that you entered the correct NextDNS Profile ID.

Then check:

ctrld status

Also check whether another application, particularly a VPN, security product or another DNS client, is overriding the system DNS configuration.

The wrong NextDNS profile is being used

Stop ctrld and start it again using the correct Profile ID:

ctrld stop

ctrld start --nextdns YOUR_NEXTDNS_PROFILE_ID

DNS listener is exposed on the network

If you want ctrld to serve DNS only to the local Windows computer, check the listener section in:

C:\ControlD\ctrld.toml

Make sure it uses:

ip = '127.0.0.1'
port = 53

and not:

ip = '0.0.0.0'
port = 53

Then restart:

ctrld restart

VPN breaks NextDNS

If NextDNS works normally until your VPN connects, check the VPN's DNS settings.

If necessary, test ctrld's DNS interception mode:

ctrld start --intercept-mode=dns --nextdns YOUR_NEXTDNS_PROFILE_ID

Need detailed logs?

ctrld provides built-in logging and diagnostic commands.

To see the available logging options:

ctrld log --help

Detailed logging can be particularly useful if DNS stops working after enabling a VPN, changing the listener configuration or switching between DNS clients.

How to Switch Back to NextDNS CLI

If you decide that you prefer the official NextDNS CLI, you can switch back.

First stop ctrld:

ctrld stop

If you no longer need the service, remove it:

ctrld uninstall

Then start the NextDNS CLI again:

nextdns start

And activate its DNS configuration:

nextdns activate

This gives you a straightforward way to test both approaches without permanently committing to either one.

Useful ctrld Commands

Command	Purpose
ctrld --version	Show the installed version
ctrld start --nextdns PROFILE_ID	Start ctrld using a NextDNS profile
ctrld status	Check the service status
ctrld restart	Restart the service
ctrld stop	Stop the service temporarily
ctrld uninstall	Stop and remove the service
ctrld log --help	Show logging options

Final Thoughts

Using NextDNS with ctrld is a useful setup if you like NextDNS but want to use ctrld as your local DNS daemon.

The important thing to understand is that NextDNS and ctrld are doing different jobs.

NextDNS provides the DNS service and filtering.

ctrld provides the local DNS proxy that receives queries from Windows and forwards them to NextDNS.

The final setup looks like this:

Windows PC
    ↓
127.0.0.1:53
    ↓
ctrld
    ↓
NextDNS Profile
    ↓
NextDNS filtering
    ↓
Internet

The easiest installation method is the PowerShell installer, but manually downloading ctrld.exe from GitHub is also straightforward and gives you more control over the installation.

If PowerShell refuses to run the installer because scripts are disabled, the temporary:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

command is usually all that is required. It changes the execution policy only for that PowerShell session and does not permanently change the system-wide policy.

After installation, check C:\ControlD\ctrld.toml. If the DNS listener is configured as 0.0.0.0, change it to 127.0.0.1 for a normal single-PC installation and restart the service.

Once ctrld is running correctly, your existing NextDNS configuration continues to handle DNS filtering without requiring you to recreate your blocklists, allowlists or other settings.

Useful links:

Download ctrld from GitHub Releases →

ctrld GitHub Repository →

ctrld Documentation →

NextDNS Mode Documentation →

NextDNS: https://nextdns.io/

Control D: https://controld.com/