Minor Release

This release contains an improvement and a bug fix.

Updated

• macOS Package: The off intercept mode now explicitly disables interception and clears any persisted intercept_mode configuration.

Fixed

• Fixed intercept mode compatibility with DNS-less and IPv6-only networks.
• Prevented state leaks (recoveryBypass/recoveryRunning) caused by operation cancellation during recovery in intercept mode.

Minor Release

This contains new features, security hardening and bug fixes.

Security

• Defaulted the metrics server to loopback, so a listener address with no host no longer serves unauthenticated metrics to the whole network
• Redacted the provisioning token in logs, so a failed provisioning no longer writes a reusable credential into log files and support bundles

Added

• Stable provisioning failure codes for manual and MDM installs. Terminal failures during bootstrap, listener binding, and service install/start now report a support-facing code and a stage-scoped exit code that survive process exit, so a customer can name the failed stage without a rerun with verbose logging
• Group Policy NRPT adoption on Windows. When an administrator already deploys a catch-all rule pointing at ctrld's listener, ctrld serves DNS through it instead of managing NRPT and adapter DNS itself, falls back to its own rule if that policy goes away, and never modifies or deletes the administrator's rule
• Startup verification in ctrld status. The command now confirms that ctrld is actually serving rather than only registered as running, and reports a distinct exit code for a service that never finished starting

Changed

• Made --intercept-mode off actually turn interception off, instead of leaving a previously persisted mode in the config for the next service start to pick up
• Applied the selected intercept mode from the macOS package, and made the launchd argument edits exact so a mode value cannot be left without its flag

Fixed

• Stopped a false pf-wipe loop on macOS DNS intercept, where link-local IPv6 notification storms drove endless stabilization cycles and DNS timeouts with the live pf anchor intact
• Probed interception when pf stabilization finishes on macOS, so a redirect that pf has stopped evaluating - after sleep/wake, for example - recovers immediately instead of waiting for the periodic watchdog
• Retried the macOS OS resolver without its source binding when the bound address is unreachable, so upstream.os can reach a VPN-only resolver under a full tunnel instead of failing with no route to host
• Bounded the API preflight by service lifetime, so a stop request during an unreachable-API retry loop is honoured instead of leaving the process working for a service the OS considers stopped
• Bumped insomniacslk/dhcp to c76316d to fix an nclient4 panic (insomniacslk/dhcp#583)

Minor Release

This contains security hardening and bug fixes.

Security

• Bumped golang.org/x/text to v0.40.0 to address GO-2026-5970
• Discarded upstream answers whose question does not echo the request - defense in depth against cache poisoning. A compromised or misbehaving upstream could return an answer for a different name (e.g. records for attacker.example in response to a query for victim.example), which would be cached under the legitimate request key and served to later queries. The answer is now validated against the request's question (case-insensitive name plus Qtype/Qclass, per RFC 1035 §4.1.2) before it is served or cached; a mismatch is logged at debug level and the upstream is skipped, failing safe to the next upstream or SERVFAIL

Fixed

• Partitioned the DNS cache by EDNS Client Subnet (ECS). With cache_enable = true, one cache entry was shared by every client asking the same name against the same upstream, so a response tailored for subnet A could be served to subnet B (returning the wrong CDN/policy answer, per RFC 7871 §7.3). Both cache paths are now keyed by a canonical ECS tuple so different subnets never share an entry, while same-subnet queries still share one
• Fixed the DoQ resolver corrupting upstream responses by calling SetReply on the already-unpacked answer, which forced the RCODE to NOERROR and overwrote the Question section. This masked upstream failures from the proxy's failover logic (a SERVFAIL looked like a successful empty response) and corrupted the Question served to clients. Only the downstream transaction ID is now restored, preserving the upstream RCODE, Question, and answers - matching the DoH and DoT resolvers
• Treated the 464XLAT CLAT source range as local rather than WAN. On IPv6-only cellular carriers and iPhone hotspots, local DNS queries can arrive with a source in the RFC 7335 IPv4 Service Continuity Prefix (192.0.0.0/29), which was classified as a WAN client and refused when allow_wan_clients was unset (the default), breaking DNS resolution on the affected connection. The 192.0.0.0/29 range is now recognized as local
• Preserved the fallback listener port across config reload in macOS DNS-intercept mode. When mDNSResponder owns *:53, ctrld falls back to 127.0.0.1:5354, but an hourly CD config reload reverted the in-memory port to 53 while the listener stayed on 5354, causing an endless watchdog "force reload" loop and dig timeouts. The actual bound listener IP/port is now restored into the in-memory config after reload
• Skipped internal logging in --silent mode. In cd mode, --silent still created and grew a log file and reset the global log level back to debug, overriding the level --silent had set. ctrld now neither creates the internal log file nor writes debug logs when silent is set
• Restored system DNS during an invalid-device uninstall, so DNS is no longer left pointing at the stopped listener when uninstalling with an invalid device

Minor Release

This contains some bug fixes.

Fixed

• Fix macOS pf watchdog exec storms.
• Add Windows NRPT recovery circuit breaker to prevent recovery loop.

Minor Release

This contains new features, significant performance improvements, and bug fixes.

Security

• Upgraded quic-go to v0.59.1 to address CVE-2026-40898

• Rejected oversized upstream DNS responses on the DoH, DoH3, and DoQ paths — these previously used io.ReadAll on attacker-controlled responses before enforcing any protocol-level limit, allowing a malicious or compromised upstream to force unbounded buffering. Bodies are now capped at dns.MaxMsgSize (and non-200 DoH error bodies are bounded as well)

• Validated DNS-over-QUIC response framing (RFC 9250) — the resolver previously assumed at least two bytes were present and could panic on truncated or malicious replies; the length prefix is now validated and framing failures retire the connection from the pool

• Rate-limited PIN attempts on the control socket to provide defense-in-depth against brute-force if an attacker gains socket access

• Switched temp file creation to os.CreateTemp for symlink-safe writes, preventing symlink attacks on systems without fs.protected_symlinks (e.g. embedded routers)

• Switched internal/router/dnsmasq to text/template instead of html/template, since the generated config is plain text

Improved

• Shared a single QUIC transport and UDP socket across DoQ dials so parallel dial and reconnect churn no longer allocate a socket per attempt or leak sockets; the query stream's send side is now closed before reading the response per RFC 9250 §4.2

• Updated the Docker base image to bookworm

Fixed

• Refreshed macOS VPN DNS after pf stabilization

• Allowed intercept fallback for the default listener

• Flushed pf states after a forced DNS intercept reload

Minor Release

This release contains a bug fix for Windows platform.

Fixed

• Fixes Windows DNS-intercept behavior for AD/internal split-rule domains during sleep/wake or VPN adapter settling without relying on a fixed timeout.

Minor Release

This contains bug fixes and a new diagnostic command.

Added

• Added ctrld log tail command for live log streaming — streams runtime debug logs to the terminal in real-time, similar to tail -f. Supports --lines/-n flag to control initial context lines
• Added WFP loopback protect for VPN block-outside-dns in dns intercept mode.

Improved

• Configured QUIC keep-alive for DoQ connections — sends periodic PING frames (KeepAlivePeriod: 15s) on idle pooled connections, keeping them alive across NAT rebinding and proactively detecting dead paths before the next query hits a stale connection

Fixed

• Fixed handle leak in hasLocalDnsServerRunning() on Windows — the process snapshot handle from CreateToolhelp32Snapshot was not being closed, leaking a handle on every call

• Fixed dnsFromResolvConf not filtering loopback IPs — the continue statement only broke out of the inner loop, allowing loopback addresses (e.g. 127.0.0.1) through. This caused ctrld to use itself as bootstrap DNS when already installed as the system resolver, creating a self-referential loop

• Fixed IPv6 VPN DNS server addresses not formatted correctly on macOS — upstreamConfigFor() passed bare IPv6 addresses to net.Dial without brackets or port, causing too many colons in address errors and immediate failure for all IPv6 VPN DNS queries

• Fixed DNS responses failing with sendmsg: invalid argument for IPv6-sourced clients on macOS — the pf nat rule on lo0 inet6 did not match packets arriving via the rdr chain as inet4, so the client's global IPv6 source address was preserved, and the kernel rejected responses from [::1]:53 to non-loopback destinations

• Fixed VPN DNS queries routed over wrong source interface on macOS — when a VPN client (e.g. FortiClient) was active, DNS queries to LAN servers used the VPN tunnel IP as source, making responses unroutable. Combined with the IPv6 bugs, this cascaded into complete VPN DNS failure and VPN disconnection

• Fixed DoQ queries failing with idle timeout errors — pooled QUIC connections that timed out server-side now trigger a transparent retry with a fresh connection instead of propagating the error

• Fixed DoQ queries failing with too many open streams — replaced non-blocking OpenStream with OpenStreamSync, which waits for the server's MAX_STREAMS credit replenishment instead of racing against it. Added StreamLimitReachedError as a retry condition for defense-in-depth when the stream credit wait times outetS

• Fixed a crash in SetSelfIP triggered by network transitions before clientinfo initialization.

• Fixed a recovery race condition, reduce worst-case recovery from ~30s to <3s.

Major Release

This contains new features, significant performance improvements, and bug fixes.

Added

• Added DNS intercept mode (--intercept-mode=dns|hard|off) — a major new feature that intercepts all DNS traffic on the system and routes it through ctrld

  • macOS: pf-based interception with route-to lo0 + rdr rules, _ctrld group exemption, watchdog auto-heal for Parallels VM pf corruption, and IPv6 DNS blocking
  • Windows: dual-mode support — NRPT for standard DNS interception, WFP sublayer with callout filters for hard interception
  • VPN DNS split routing — discovers DNS servers from F5 BIG-IP, Tailscale, Network Extension VPNs, and traditional VPN adapters; handles split vs full tunnel detection; cleans up stale exemptions on VPN disconnect
  • Recovery bypass for captive portals and probe-based interception verification

• Added robust platform-specific username detection for Control D metadata (macOS: directory services/console user, Linux: loginctl/utmp/passwd, Windows: WTS/registry/token)

• Added hostname hints in provisioning metadata for API-side fallback, allowing the server to repair generic hostnames

Improved

• Implemented connection pooling for DoQ (QUIC) — eliminates per-query handshake overhead by reusing connections, matching DoH3 performance

• Implemented connection pooling for DoT (TLS) — eliminates per-query TLS handshake overhead by reusing connections

• Improved DNS server discovery for domain-joined Windows machines — non-physical adapters with matching DNS suffix are now considered valid for remote VPN scenarios

• Consolidated network change monitoring into a single goroutine for simpler, more reliable handling

Fixed

• Fixed macOS hostname detection — uses scutil ComputerName instead of os.Hostname(), which returns generic names like "Mac.lan" when Private Wi-Fi Address is enabled

• Fixed DoT connection validation — connections are now checked before reuse to prevent io.EOF errors from server-side idle timeouts

• Fixed handling of empty and invalid IP addresses to prevent panics when processing client info

• Fixed a data race in transport rebootstrap using a three-state atomic instead of a boolean flag

Minor Release

This contains new features, improvements and bug fixes.

Added

• We’ve updated ctrld to send system metadata when calling the Control D API, allowing for a more seamless and personalized UX.
• Added new documentation for internal runtime logging to clarify how it works and how it interacts with other logging configurations.

Improvements

• Upgrade the quic-go library to v0.57.1 to resolve a critical bug in parsing HTTP3 frame header.

Fixes

• Fixed a bug where DoH3 connections were closed incorrectly, preventing ctrld from recovering during network outages.

Minor Release

This contains improvements and bug fixes.

Improvements

• Upgrade the quic-go library to v0.56.0 to improve API usability and resolve several critical bugs.

Fixes

• Fixed a bug that allowed the root domain to be passed to systemd-resolved, which subsequently caused DNS resolution failure on Linux.
• Fixed a bug where log flags were not processed during a reloading operation, causing internal runtime logging to fail after the reload completed.

Minor Release

This contains new features and improvements.

Added

• Make RFC1918 listener spawning opt-in via --rfc1918 flag instead of automatic behavior.
• Add the Darwin 15.5 upgrade issue to the known issues documentation.
• The mobile library can now be initiated with a provision ID and custom hostname.

Improvements

• Upgrade the quic-go library to v0.54.0 to improve API usability and resolve several bugs.

Fixes

• A bug was fixed where ctrld would incorrectly listen on RFC1918 addresses associated with virtual interfaces. This behavior caused unnecessary delays in resolving DNS queries, especially when those virtual interfaces were not active.

Minor Release

This contains improvements and bug fixes.

Added

• Support for OPNsense 25.1.7 was added via a new lease file (@jquick).

Improvements

• Moved network monitoring creation to a dedicated goroutine for better performance and to ensure only a single instance is started.

Fixed

• Corrected an issue where Windows domain join status was not being detected properly.
• Addressed a bug where the upstream process check failed when attempting to process large DNS responses.