76.76.2.0: Control D free resolver

76.76.2.0 is the unfiltered free resolver from Control D, a DNS service run by the Canadian VPN company Windscribe. Its sibling addresses in 76.76.2.0/24 each apply a different blocklist, so the last octet selects the filtering profile rather than a server.

An address that looks wrong

Most people learn that an address ending in .0 is the network address of a /24 and cannot belong to a host. That rule applies inside a subnet with a /24 mask. Control D assigns these addresses out of a block it routes with longer prefixes, so 76.76.2.0 is a perfectly ordinary destination on the internet.

The practical problem is software. Router firmware, corporate provisioning forms, and older validation libraries reject .0 in a DNS field on principle. When that happens, Control D publishes a mirror set on 76.76.10.x with the same profile mapping, and IPv6 addresses under 2606:1a40::.

The profile map

Address	Blocks
76.76.2.0	Nothing. Plain recursive resolution.
76.76.2.1	Malware
76.76.2.2	Malware, ads, trackers
76.76.2.3	Malware, ads, trackers, social networks
76.76.2.4	The above plus adult and gambling categories

Because the filter lives in the address, you change policy by changing the DNS server, with no account and no dashboard. That makes it easy to test: point a single device at 76.76.2.2 for an afternoon and see what breaks before rolling it out to a household.

When you see it

The address turns up in router DNS fields set by people who wanted network-wide ad blocking without running Pi-hole, in Android Private DNS configuration, and in AdGuard Home or Unbound upstream lists. It also appears in comparison threads where someone recommends a resolver that is neither Google nor Cloudflare.

How to set it up

1. Router: put 76.76.2.0 and 76.76.10.0 in the LAN DHCP DNS fields.
2. Windows or macOS: enter the pair in the adapter’s IPv4 DNS settings.
3. Android 9 and later: Private DNS supports a hostname only, so use the freedns.controld.com/p0 style resolver hostname from Control D’s docs rather than the raw address.
4. DNS over HTTPS: Control D publishes a per-profile DoH endpoint, which is the better choice on a laptop that moves between networks.
5. Testing one device: set it on a phone before the router, so a broken profile does not take the house offline.

Privacy and policy

Windscribe is registered in Ontario, Canada. The Control D privacy policy states that the free resolvers do not log queries, and that logging on paid profiles is opt-in and controlled by the account holder for their own analytics. Because the same company sells a VPN, it is worth reading the policy for the resolver rather than assuming the VPN’s terms apply.

What it is not

76.76.2.0 is not a Windscribe VPN endpoint, and using it does not tunnel your traffic or change the public IP that sites record. It is not a network address either, whatever your router’s form validation says. And the free profiles are fixed lists, so it is not a place to add your own custom blocking rules; that needs a paid profile or a local resolver such as Pi-hole with Control D as its upstream.

Verify which resolver your device is really using in /dns-leak-test.