Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AdGuard DNS is the best all-around choice for most people: its public filtering resolvers are easy to enter on a router or computer, and its Android Private DNS hostname is straightforward. NextDNS is better when you want profiles, custom rules and logs; Control D Free is useful for a no-account preset; Mullvad DNS offers several narrowly defined filter levels; and LibreDNS, RethinkDNS and BlahDNS suit readers who prioritize open, configurable or regional services.
All seven work at the DNS layer. They can stop a browser or app from resolving many advertising, tracking and malware domains, but they cannot generally remove empty ad boxes, rewrite a page, or block an advert served from the same domain as the content you are reading.
What does an ad-blocking DNS server actually do?
When an app requests ads.example.com, a DNS resolver translates that name into an IP address. A filtering resolver checks the name against blocklists and returns a blocked response instead of the address. The request then fails before the ad, tracker or malware host can connect.
Free tools Windows power users keep installed
One-click scans. No signup required.
That approach covers many browsers, games and other apps without installing a browser extension. It is not the same as cosmetic filtering: DNS cannot inspect a page after it loads, hide an element with CSS, or reliably stop first-party advertising delivered from the same hostname as legitimate content. AdGuard describes this distinction in its DNS-protection documentation (AdGuard DNS filtering limits).
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Encrypted DNS protects the DNS lookup while it travels to the resolver. DoH (DNS over HTTPS), DoT (DNS over TLS) and DoQ (DNS over QUIC) are the current encrypted choices. AdGuard’s protocol overview calls DNSCrypt obsolete with restricted support and identifies DoH and DoT as the modern recommendations (AdGuard protocol overview).
Which seven DNS services are best for blocking ads?
| Service | Best fit | Filtering connection | Important limitation |
|---|---|---|---|
| AdGuard DNS | Simple, general-purpose blocking | IPv4, IPv6, DoH, DoT, DoQ and DNSCrypt | Public filtering is less customizable than a personal profile |
| NextDNS | Custom blocklists, profiles and analytics | Profile-specific endpoint; public DoH/DoT endpoints are non-filtering | Filtering configuration is required; DNS cannot remove page elements |
| Control D Free | No-account preset choices | IPv4, IPv6, DoH, DoT and DoQ | No dashboard, custom rules, per-device profiles or history on the free tier |
| Mullvad DNS | Clear filter levels and encrypted browser setup | IPv4, IPv6, DoH and DoT hostnames | Some operating-system and browser bypass edge cases |
| RethinkDNS | Android firewall plus configurable cloud DNS | DoH or DoT through a configured service | No universal public IP pair is published on its homepage |
| LibreDNS | Simple encrypted DNS with a separate no-ads endpoint | DoH and DoT | Crowdsourced domain blocking, not cosmetic filtering |
| BlahDNS | Open protocols and regional servers | DoH, DoT, DoQ, DNSCrypt v2 and DNS-over-DTLS | Current server regions are limited to Singapore and Germany |
Is AdGuard DNS the best all-around ad-blocking resolver?
For a conventional “enter two addresses and block common ads and trackers” setup, yes. The public filtering IPv4 addresses are 94.140.14.14 and 94.140.15.15; the matching IPv6 addresses are 2a10:50c0::ad1:ff and 2a10:50c0::ad2:ff. AdGuard lists these addresses and device instructions on its public DNS page.
What other AdGuard modes are available?
- Non-filtering: hostname
unfiltered.adguard-dns.com; IPv494.140.14.140and94.140.14.141. - Family: hostname
family.adguard-dns.com; IPv494.140.14.15and94.140.15.16.
The family mode adds adult-content filtering to ad and tracker blocking. Use the non-filtering mode when a legitimate domain is blocked and you cannot change an upstream allowlist.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How do I set AdGuard DNS on Android?
- Open Settings → Network & Internet (or Wi‑Fi & Internet).
- Open Advanced → Private DNS.
- Select Private DNS provider hostname, enter
dns.adguard-dns.com, and tap Save.
Android Private DNS accepts a hostname, not an IPv4 address. The exact menu wording varies by phone manufacturer.
How do I set AdGuard DNS on Windows?
AdGuard’s current instructions still use the legacy Control Panel labels, so follow them rather than assuming a different Windows 11 path:
- Open Start menu → Control Panel → Network and Internet → Network and Sharing Center → Change Adapter Settings.
- Select the Wi‑Fi connection, choose Properties, then open Internet Protocol Version 4 (TCP/IPv4) → Properties.
- Select Use the following DNS server addresses and enter
94.140.14.14and94.140.15.15. - Repeat under Internet Protocol Version 6 (TCP/IPv6) with
2a10:50c0::ad1:ffand2a10:50c0::ad2:ff.
AdGuard supports plain DNS, DNSCrypt, DoH, DoT and DoQ. For new encrypted deployments, prefer DoH or DoT.
Is NextDNS the best choice for custom rules and profiles?
NextDNS is the strongest option when “block ads” means maintaining your own policy rather than using one fixed list. Its service offers selectable blocklists, custom denylist and allowlist entries, rewrites, analytics, configurable log retention and an option to disable logging (NextDNS).
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How does NextDNS addressing work?
NextDNS is profile-based, so a filtering configuration normally uses a profile-specific endpoint rather than one universal filtering IP pair. The public endpoints https://dns.nextdns.io and tls://dns.nextdns.io are non-filtering endpoints. Use the configuration service opened by the site’s Try it now control to create or select a profile before installing its endpoint.
What should I know about NextDNS logs?
The current service allows retention from one hour to two years, or no retention at all. Signing up preserves settings; NextDNS also says initial use can begin without an account. DNS filtering still cannot remove cosmetic page elements once a page has loaded.
Is Control D Free the best no-account preset?
Control D Free is convenient when you want a published preset and do not need a dashboard. Its selectable website preset is called Ads & Tracking and is described as blocking malware, ads and trackers (Control D Free DNS).
What are the Control D Ads & Tracking addresses?
- IPv4:
76.76.2.2and76.76.10.2 - IPv6:
2606:1a40::2and2606:1a40:1::2 - DoH:
https://freedns.controld.com/p2 - DoT:
p2.freedns.controld.com - DoQ:
quic://p2.freedns.controld.com
Can I choose another Control D Free filter?
Yes. The Family Friendly preset uses IPv4 76.76.2.4 and 76.76.10.4, DoH https://freedns.controld.com/family, and DoT hostname family.freedns.controld.com. It adds adult-content and drug-site blocking. Published third-party endpoints include OISD Full (https://freedns.controld.com/x-oisd), Hagezi Normal (https://freedns.controld.com/x-hagezi-normal), Hagezi Pro (https://freedns.controld.com/x-hagezi-pro) and AdGuard Filter (https://freedns.controld.com/x-adguard).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Control D says free filters are rebuilt and deployed every 30 minutes. Free resolvers do not provide profile management, custom rules, per-device profiles, analytics or historical query data, and filters cannot be mixed and matched. Third-party lists can produce false positives.
Is Mullvad DNS best for several clearly defined filter levels?
Mullvad publishes separate hostnames for progressively broader categories, making it easy to choose blocking without building a list. The ad-blocking hostname is adblock.dns.mullvad.net; its IPv4 address is 194.242.2.3, IPv6 address is 2a07:e340::3, DoH endpoint is https://adblock.dns.mullvad.net/dns-query, and DoT hostname is the same ad-blocking hostname (Mullvad DNS over HTTPS and DNS over TLS).
Which Mullvad hostname should I use?
base.dns.mullvad.net: ads, trackers and malware.extended.dns.mullvad.net: ads, trackers, malware and social media.family.dns.mullvad.net: ads, trackers, malware, adult content and gambling.all.dns.mullvad.net: all listed categories, including social media.
How do I configure Mullvad DNS?
On Android 9 or later, use Settings → Network & internet → Private DNS → Private DNS provider hostname, enter adblock.dns.mullvad.net, and tap Save.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
In Chrome or Brave, open Settings → Privacy and security → Security, enable Use secure DNS, choose With: Custom, and enter https://adblock.dns.mullvad.net/dns-query. In Edge, open Settings → Privacy, search, and services, enable secure DNS, choose Choose a service provider, and enter the same URL. In Firefox, go to Settings → Privacy & Security → Enable secure DNS using → Max Protection → Choose provider → Custom, then enter the URL.
Recommended Free Tools
Windows 11 supports an encrypted setup under Settings → Network & internet → Wi‑Fi or Ethernet → Hardware properties → Edit beside DNS server assignment → Manual. Enable IPv4, enter 194.242.2.3, set DNS over HTTPS to On (manual template), enter https://adblock.dns.mullvad.net/dns-query, and save. Configure IPv6 separately if your connection uses it. Mullvad states this encrypted-DNS procedure is not available in Windows 10, and some virtual machines may not support it.
What can bypass Mullvad DNS?
When Mullvad VPN is connected, Mullvad says its VPN resolver is faster and that separate encrypted DNS adds negligible security. On iOS and iPadOS, iCloud Private Relay can send queries to Apple DNS even when a Mullvad profile is installed. On macOS, Chromium-based browsers can use their own DNS client; Mullvad documents these commands to disable it:
defaults write com.google.Chrome BuiltInDnsClientEnabled -bool false
defaults write com.brave.Browser BuiltInDnsClientEnabled -bool false
defaults write com.microsoft.Edge BuiltInDnsClientEnabled -bool falseIs RethinkDNS best for Android users who want a firewall as well?
RethinkDNS combines a configurable cloud DNS service with a companion Android firewall and DNS app. The app is free and open source, while the cloud content-blocking service has free and paid tiers. It advertises ad, tracker, spyware and malware blocking with more than 190 available blocklists (RethinkDNS).
RethinkDNS uses DoH or DoT exclusively. It is not a single public resolver pair: use the homepage’s Configure now → control, which opens its configuration documentation, to create the service endpoint that matches your selected lists. The public homepage does not provide a universal IPv4 address, so do not substitute an address copied from an old guide.
Is LibreDNS a good simple encrypted ad-blocking DNS?
LibreDNS provides two DoH URLs: the ordinary resolver https://doh.libredns.gr/dns-query and the ad/tracker-blocking resolver https://doh.libredns.gr/noads (LibreDNS). Its DoT service uses IP 116.202.176.26, IPv6 2a01:4f8:1c0c:8274::1, port 853 and hostname dot.libredns.gr; the ad-blocking DoT hostname is noads.libredns.gr.
How do I install LibreDNS?
In Firefox, open Settings → General → Network Settings → Settings, enable Enable DNS over HTTPS at the bottom, choose Custom, and enter the normal DoH URL or the /noads variant. In Chrome or Chromium, use Settings → Privacy and security → Security → Use secure DNS → Custom. In Edge, open edge://settings/privacy, find Security, enable secure DNS and enter the endpoint.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Widely Compatible: Transform any USB-C port into a USB-A port and USB-A port into a USB-C port, and connect up a wide range of USB-C(including MacBook, iPad Pro/Air/Mini, iPhone models with USB C ports, Samsung Galaxy series, and Google Pixel series. ) and USB A devices(including external hard drives, phones, mice, printers, and more)
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
On Android, search Settings for Private DNS, select Custom, enter noads.libredns.gr and save. For systemd-resolved on Linux, LibreDNS documents:
[Resolve]
DNS=116.202.176.26#noads.libredns.gr
FallbackDNS=127.0.0.1 ::1
DNSOverTLS=yesLibreDNS says its DNS daemon has logging disabled and uses OpenNIC as its Tier 1 resolver. Its blocklist is a crowdsourced list of known advertising and tracking domains, not a promise to remove page elements or every first-party advert.
Is BlahDNS worth choosing for protocol variety or location?
BlahDNS is a hobby project that supports DoH over HTTP/2 and HTTP/3, DoT, DoQ, DNSCrypt v2 and DNS-over-DTLS. It advertises filtering for ads, trackers, malware and CNAME cloaking (BlahDNS).
Which BlahDNS servers are currently active?
| Region | DoH | DoT details |
|---|---|---|
| Singapore | https://doh-sg.blahdns.com/dns-query |
IPv4 46.250.226.242; IPv6 2407:3640:2205:1668::1; TLS name dot-sg.blahdns.com; port 853 |
| Germany | https://doh-de.blahdns.com/dns-query |
IPv4 78.46.244.143; IPv6 2a01:4f8:c17:ec67::1; TLS name dot-de.blahdns.com; port 853 |
Japan, Switzerland and Finland were discontinued on July 15, 2024, so they are not current choices. BlahDNS requires strict SNI for DoH and DoT on port 443; connections without SNI are dropped by default. Its site includes Check Domain Status, where you can enter a domain and select Check to see whether it is filtered.
How should you choose among these DNS servers?
- Choose AdGuard DNS for the shortest path from a router or computer to broad ad and tracker blocking.
- Choose NextDNS when you need profiles, custom allow/deny entries, rewrites, analytics or adjustable retention.
- Choose Control D Free when you want a named preset without maintaining an account, accepting its fixed free-tier limits.
- Choose Mullvad DNS when category choices such as malware-only, family or social-media blocking matter.
- Choose RethinkDNS when an Android firewall and more than 190 selectable lists are part of the plan.
- Choose LibreDNS for a minimal encrypted endpoint with a distinct
/noadsservice and stated disabled logging. - Choose BlahDNS when you need many protocols or prefer one of its two current regions.
How do you install and verify an ad-blocking DNS server safely?
- Record the current setting. Note your router or device’s existing DNS addresses so you can restore them if a network stops working.
- Use a matching pair or one provider profile. Do not treat unrelated filtering services as dependable “primary” and “alternate” failover. A device may query either one, producing inconsistent results; use the pair published by the same provider.
- Configure IPv6 as well as IPv4. If IPv6 remains active with only IPv4 changed, some requests can bypass the filter.
- Check browser-level secure DNS. Chrome, Brave, Edge and Firefox can send DNS directly to a configured DoH service instead of using the operating system or router. Set the browser to the same provider or turn its custom service off when you want the system resolver to apply.
- Test normal sites and an app. A blocked request may show a blank space, an error or slower page loading rather than a visible “blocked” notice. Check important banking, work and sign-in domains before rolling the setting to every device.
- Keep a rollback path. Return to automatic DNS or the recorded addresses if a captive portal, business network or legitimate service fails.
What problems do ad-blocking DNS services commonly cause?
A hotel or airport Wi‑Fi network will not open its sign-in page
Captive portals sometimes need ordinary DNS or an unfiltered resolver before authentication. Control D specifically lists hotel-style captive portals as a failure case. Temporarily switch to automatic DNS, accept the portal, then restore the filtering service.
A legitimate site or app stops working
Blocklists can contain false positives. Control D warns that third-party lists may be overzealous, and its free service has no custom per-domain override. Temporarily use a non-filtering resolver, or add an allowlist entry where your chosen service supports one; an allowlist inside a local app cannot override an upstream DNS server that already blocked the domain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ads still appear
Confirm that the device and browser are using the intended resolver, that IPv6 is configured, and that browser Secure DNS is not bypassing the system. Then remember the architectural limit: DNS cannot remove cosmetic elements or reliably stop ads served by the same domain as the page.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Encrypted DNS will not connect
Check the endpoint spelling, TLS hostname and port requirements. BlahDNS requires strict SNI, and some virtual machines do not support Mullvad’s Windows 11 encrypted-DNS procedure. A plain DNS address can be a temporary diagnostic fallback, but it does not encrypt the lookup.
What is the practical verdict?
Start with AdGuard DNS if you want a broadly compatible public resolver and do not need personal rules. Move to NextDNS for policy control, profiles and retention settings; select Mullvad DNS for category-specific hostnames; and use Control D Free for a published preset with no dashboard. RethinkDNS, LibreDNS and BlahDNS are credible alternatives when their Android integration, no-ads endpoint, protocol support or regional locations match your requirements. Whichever you choose, treat DNS filtering as a first layer—not a replacement for browser content blocking, app permissions and safe browsing.
Frequently Asked Questions
Will an ad-blocking DNS stop advertisements in YouTube or other streaming apps?
Usually not consistently. Streaming platforms often serve advertisements from the same domains as video or other requested content, so blocking the domain would also break the stream. DNS filtering is most dependable for separate ad, tracker and malware hostnames.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhich of these DNS services is fastest?
There is no universal winner: latency depends on your location, ISP routing, congestion and whether your device uses encrypted DNS. A nearby regional resolver can outperform a more distant service, so compare connection times from your own network rather than relying on a global ranking.
Can I put one filtering DNS provider in Preferred DNS and another in Alternate DNS?
You can enter the addresses, but that is not reliable policy failover. Devices may use either resolver, so one request could be filtered while the next is answered by a provider with different lists or no filtering. Use the matching addresses supplied by one service.
Why does Android ask for a hostname instead of an IP address?
Android’s Private DNS mode establishes DNS over TLS, which needs a server hostname for TLS authentication. Enter a value such as dns.adguard-dns.com, adblock.dns.mullvad.net or noads.libredns.gr; an IPv4 address belongs in a conventional DNS-server field instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
