Ad-Blocking DNS for Your Router: Block Ads on Every Device

Quick answer

• Most people: AdGuard DNS. Type 94.140.14.14 and 94.140.15.15 into your router's DNS settings. It's free and needs no account.
• If you want to pick blocklists, see logs or unblock sites: NextDNS. It's free up to 300,000 queries a month, then $1.99 a month.
• If you want everything running at home: Pi-hole or AdGuard Home on a Raspberry Pi or a spare computer.

How ad-blocking DNS works

Before a device can load an ad, it has to look up the ad server's address (something like doubleclick.net). It asks a DNS server, which works like the internet's phone book. An ad-blocking DNS server keeps a list of known ad and tracking domains and gives a blank answer for those lookups, so the ad never loads. Every other site loads normally.

Set it on your router and every device that gets its network settings from the router uses it automatically. That includes the devices where you can't install an ad blocker: smart TVs, streaming sticks, consoles and smart speakers.

It works alongside a browser ad blocker like uBlock Origin, so keep yours. The browser blocker catches the leftovers that DNS can't see.

What it won't block

The 2019 version of this guide said router DNS would block ads on YouTube and Hulu. That was wrong. Here's what DNS can't touch.

• YouTube, Twitch and most streaming-service ads. They come from the same servers as the video. Block the ad server and you block the show.
• Sponsored posts in social apps. Instagram, Facebook, TikTok and X ads are part of the feed itself.
• Ads a site serves from its own domain. To DNS they look like the rest of the page.
• Devices that skip your router's DNS. See the bypass section below.

What it does well: banner and pop-up ads on websites, ads inside many free apps and games, a lot of smart TV tracking, and known malware and phishing domains.

Pick your ad-blocking DNS

AdGuard DNS: best for beginners

AdGuard's public servers are free, need no sign-up and block ads, trackers and phishing sites.

• Primary: 94.140.14.14
• Secondary: 94.140.15.15
• IPv6: 2a10:50c0::ad1:ff and 2a10:50c0::ad2:ff
• Encrypted DNS hostname (for phones): dns.adguard-dns.com

The public servers have no allowlist, so you can't unblock a site that breaks. A free AdGuard DNS account gives you a private server with an allowlist and stats, with a monthly request cap. Or use NextDNS.

For kids' devices, AdGuard's Family Protection servers (94.140.14.15 and 94.140.15.16) also block adult sites and turn on Safe Search.

NextDNS: best if you want control

Sign up at NextDNS and you get your own configuration. Choose your blocklists, allowlist anything that breaks, see which domains each device looks up, and add parental controls.

• Free: 300,000 queries a month. Past that, NextDNS keeps working but stops blocking until the month resets.
• Pro: $1.99 a month or $19.90 a year, with no query limit. A house full of smart TVs and phones can go past 300,000, and the dashboard shows your usage.
• Router setup: the setup page lists DNS addresses to enter in your router and has you link your home IP address so NextDNS knows the traffic is yours. Routers running OpenWrt, UniFi, Firewalla, pfSense or ASUS Merlin can run the NextDNS CLI instead, which encrypts lookups and shows each device by name.

Control D: a free backup option

Control D's free Ads & Tracking servers are 76.76.2.2 and 76.76.10.2. No account needed. Try them if AdGuard DNS feels slow where you live.

Pi-hole: best for tinkerers

Pi-hole is free, open-source software you run on your own hardware, usually a Raspberry Pi. It needs 512 MB of RAM and 2 GB of storage, so any Pi or old PC works. Your blocklists, logs and settings stay in your house.

Pi-hole 6, released in February 2025, has its web server built in and supports HTTPS without extra software, so installing it is simpler than in older guides.

If the Pi goes offline, the whole house loses internet until you fix it or change the router back. Give it a good power supply and a fixed IP address.

AdGuard Home: the Pi-hole alternative

AdGuard Home does the same job on the same hardware. Encrypted DNS, per-device rules and parental controls are built in, where Pi-hole needs add-ons for encrypted lookups. Pi-hole has the bigger community and more tutorials. Either one is a good choice.

What about 1.1.1.1, 8.8.8.8 and Quad9?

They don't block ads. Cloudflare's 1.1.1.1 and Google's 8.8.8.8 block nothing. Cloudflare's 1.1.1.2 and Quad9's 9.9.9.9 block malware only, and 1.1.1.3 adds adult content. They're good DNS servers for a different job.

Skip Mullvad DNS and the old addresses

Mullvad shut down its free public DNS, including its ad-blocking server, on November 2, 2026. The Alternate DNS addresses in the original version of this article are out of date too, so don't copy them.

Set it up on your router

1. Open your router's settings. Most mesh systems use an app (eero, Google Home, TP-Link Deco, Netgear Orbi). Others use a web page at 192.168.1.1, 192.168.0.1 or 10.0.0.1. The login is usually on a sticker on the router.
2. Find the DNS setting. It's usually under Internet, WAN, Advanced or DHCP. In mesh apps it's often in advanced network settings.
3. Take a screenshot of the current settings so you can undo the change.
4. Switch DNS from automatic (or "ISP") to manual and enter your provider's primary and secondary addresses.
5. If you see IPv6 DNS fields and IPv6 is on, fill those in too. Otherwise devices can quietly use your internet provider's IPv6 DNS and skip the blocking.
6. Save, then restart the router or reconnect your devices so they pick up the change.

Don't use 8.8.8.8 or 1.1.1.1 as the secondary. A lot of guides tell you to. Devices don't wait for the primary to fail before using the secondary. They use whichever one answers, so ads leak through. Use both addresses from the same provider.

For Pi-hole or AdGuard Home: enter the Pi's IP address as the DNS server in the router's DHCP or LAN settings, not the WAN or Internet DNS field. If you set it on the WAN side, every lookup looks like it came from the router and you lose per-device stats. If your router only has a WAN DNS field, turn off the router's DHCP and let Pi-hole or AdGuard Home handle it.

If your internet provider's router won't let you change DNS

Many ISP gateways, including Xfinity's and AT&T's, don't let you change DNS. You have three options.

• Put the gateway in bridge mode (Xfinity) or IP Passthrough (AT&T) and connect your own router. Your router then handles DNS.
• Set DNS on each device instead. On Android, use Private DNS with dns.adguard-dns.com. On iPhone, Mac and Windows, install your provider's configuration profile or app.
• Run Pi-hole or AdGuard Home as your network's DHCP server, if the gateway lets you turn its own DHCP off.

Stop devices from bypassing it

Some browsers and devices skip your router's DNS. These are the common ones.

• Firefox can turn on its own encrypted DNS. Pi-hole and AdGuard Home tell Firefox to use your network's DNS by default. With a hosted service, check Firefox's DNS over HTTPS setting and set it to off or to your provider.
• iCloud Private Relay sends Safari's lookups through Apple. For your home Wi-Fi, open that network's details on iPhone or Mac and turn off Limit IP Address Tracking (labeled iCloud Private Relay on newer iPhones).
• Android Private DNS set to another provider overrides your router. Set it to Automatic, or to your ad-blocking provider's hostname so blocking follows the phone everywhere.
• Some streaming devices and smart TVs try Google's DNS directly. Routers with firewall rules (OpenWrt, UniFi, pfSense, Firewalla) can redirect those lookups to your DNS. Most consumer routers can't.
• VPNs use their own DNS while they're connected.

Test that it's working

1. On a computer connected to your Wi-Fi, open Terminal or Command Prompt and run nslookup doubleclick.net. If you get 0.0.0.0, blocking works. A normal IP address means it doesn't.
2. Run the standard test at DNS Leak Test. The servers listed should belong to your provider, not your internet company.
3. On NextDNS, open test.nextdns.io. It shows "ok" when you're using your configuration.

Online "ad block test" scores are made for browser extensions and score DNS setups unevenly. On the original article, one reader got a "partial" result and another got "enabled" without changing anything.

If something breaks

Breakage usually shows up in links from marketing emails, coupon and cashback sites, and app logins that go through a tracking domain.

• NextDNS, Pi-hole or AdGuard Home: open the query log, find the blocked domain from the moment it failed, and allowlist it.
• AdGuard DNS public servers: there's no allowlist, so switch that device to mobile data for a minute, or move to an AdGuard DNS account or NextDNS.
• Whole house offline after the change? Put your old DNS settings back from the screenshot.

Which one should you use?

Start with AdGuard DNS. It takes five minutes and costs nothing. If you find yourself wanting to unblock a site or see what your TV is phoning home to, move to NextDNS. If you have a Raspberry Pi in a drawer and like tinkering, Pi-hole or AdGuard Home gives you the most control for free.

Frequently asked questions

Does 1.1.1.1 block ads?

No. Cloudflare's 1.1.1.1 is a fast, privacy-focused DNS server that doesn't filter anything. Its 1.1.1.2 and 1.1.1.3 versions block malware and adult content, not ads.

Does 94.140.14.14 block ads?

Yes. 94.140.14.14 and 94.140.15.15 are AdGuard DNS's default servers, which block ads, trackers and phishing domains.

Is ad-blocking DNS safe?

From a well-known provider, yes. Your DNS provider can see which sites your devices look up, so pick one with a clear privacy policy, or self-host Pi-hole or AdGuard Home so the logs stay at home. Expect a site or app to break now and then.

Will it slow down my internet?

Usually not. A DNS lookup takes milliseconds, and pages without ads have less to download. If a provider's servers are far from you, try a different one.

Does it work on my phone away from home?

Router settings only apply on your Wi-Fi. To keep blocking on mobile data, set Android's Private DNS to your provider's hostname, or install your provider's profile or app on iPhone.

Sources and scope

• AdGuard DNS public servers
• NextDNS pricing
• Control D free DNS
• Pi-hole prerequisites
• Introducing Pi-hole v6
• Mullvad DNS shutdown notice
• Apple: manage iCloud Private Relay per network

Checked against provider documentation on November 3, 2026. No new hands-on testing.