Groups and VLANs
Different rules for different networks
Kids, guests, smart TVs, and your own laptops don't need the same DNS. Give each VLAN, or any set of devices, a group: its own block lists, blocked services, safe search, schedules, and upstream servers. Every chart and log line then shows which group a question came from.
default.Who's in which group
A device finds its group on its own
Give a group the networks it owns and every device on them belongs to it, with no per-device setup. For a single device, a [[client]] entry (or Name this device in the UI) can pick its groups. The first match wins:
Client ID
From an encrypted connection: the DoH path
/dns-query/<id>or a DoT/DoH server name<id>.dns.example.com. Follows a phone off the home network.MAC address
From the kernel's neighbor table, or from a router you trust to pass it along. Survives DHCP changes and IPv6 privacy addresses.
IP address
An exact address named in a
[[client]]entry.Network
The group that owns the most specific matching network, such as a VLAN's
/24.Default
Everything else gets the
defaultgroup.
Not sure what an address is? The Clients page says what it looks like ("Looks like a Roku player"), from its maker, the name it announces, and the domains it talks to. Give a group the kinds of device it's for, such as cameras and plugs, and new ones of that kind get it suggested. Nothing moves until you say so.
What a group decides
One place for a network's rules
Block lists
Which lists apply. A device in several groups gets the lists of all of them; other settings come from its highest-priority group.
Blocked services
A whole service in one click (TikTok, Fortnite, and more), with every domain it uses.
Safe search
Google, Bing, DuckDuckGo, Yandex, and Pixabay show only safe results; YouTube gets Restricted Mode.
Schedules
Bedtime or homework hours: block everything, or add lists and services, on a weekly timetable.
Upstream servers
Where the group's questions go: a family-filtering resolver for the kids, a privacy resolver for your laptops. More below.
Answers
How blocked names are answered, rewrites to your own addresses, DNS rebinding protection, DNS64 for IPv6-only networks, and no IPv6 addresses at all for a network whose IPv6 is broken.
Upstream servers per group
Each network asks its own resolver
Make an upstream group (one or more servers and how to pick between them), then choose it under Groups → Edit → Upstream servers. What wins, most specific first:
- a route for a domain, such as
home.arpato your router, so local names keep working for every group; - a route that names the group;
- the group's upstream servers;
default.
Answers are cached per upstream group, so an answer from the family resolver is never served to a group that uses another. Cached answers cost nothing extra: the choice is made only when a question goes upstream.
[[group]]
name = "Kids"
networks = ["192.168.20.0/24"]
lists = ["hagezi-pro", "family-extra"]
blocked_services = ["tiktok", "fortnite"]
safe_search = true
schedules = ["bedtime"]
upstreams = "family"
priority = 10
[[group]]
name = "Trust"
networks = ["192.168.10.0/24"]
upstreams = "privacy"See the difference
Every question, by group
Dashboard
Traffic by group (in the Advanced view), and the top names and top blocked for any one group.
Groups page
Each group's networks, settings, queries and block rate over 24 hours, and devices this hour.
Query log
A group chip on every row and a Group filter. Why? names the list and line that decided.
One-line analytics
from -24h | where group = Kids | top 10 upstream with vqlog, or the group label on metrics.
In a cluster, groups are shared configuration, so every node puts a device in the same group. Devices must reach TelltaleDNS with their own addresses for their network to count: route the VLANs to it rather than through a forwarder that rewrites them.