iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
DNS ad blocking works before a website or app connects to an advertising, tracking, or malware domain. Instead of downloading the request, the DNS resolver returns a blocked response. That makes DNS filtering useful across browsers, apps, smart TVs, and other devices—but it does not remove every visible ad. It cannot generally hide page elements or block advertising served from the same domain as the content.
The seven services below are the strongest choices for different needs: a simple public resolver, detailed per-device controls, encrypted DNS, open-source Android protection, or a regional community-run service. Where a provider offers both IPv4 and encrypted-DNS options, the setup details are included.
Quick comparison
| Service | Best for | Filtering option | Useful limitation |
|---|---|---|---|
| AdGuard DNS | Simple setup on almost any device | Ads and trackers | Limited control on the public endpoint |
| NextDNS | Custom rules and detailed control | Configurable blocklists, allowlists, rewrites | Requires a profile-specific configuration for filtering |
| Control D Free DNS | Choosing a ready-made filter preset | Ads & Tracking, Family Friendly, and third-party lists | No free dashboard, custom rules, or analytics |
| Mullvad DNS | Encrypted DNS with several filtering levels | Ads, trackers, malware, social media, or adult content | Some browser and VPN interactions need attention |
| RethinkDNS | Android users who want DNS plus firewall controls | More than 190 configurable blocklists | No universal public IP pair is documented on its current homepage |
| LibreDNS | A straightforward ad-blocking DoH or DoT endpoint | Ads and trackers | Less feature-rich than profile-based services |
| BlahDNS | Users who want multiple encrypted-DNS protocols | Ads, trackers, malware, and CNAME cloaking | Current server regions are limited |
1. AdGuard DNS — best all-purpose ad-blocking DNS
AdGuard DNS is the easiest recommendation when you want to change DNS and start blocking ads and trackers without creating an account. Its standard filtering resolvers are:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- IPv4:
94.140.14.14and94.140.15.15 - IPv6:
2a10:50c0::ad1:ffand2a10:50c0::ad2:ff - Android Private DNS:
dns.adguard-dns.com
On Android, open Settings → Network & Internet (or Wi‑Fi & Internet) → Advanced → Private DNS. Select Private DNS provider hostname, enter dns.adguard-dns.com, and tap Save. Private DNS requires a hostname; entering an IPv4 address there will not work.
Popular on Amazon
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
For a Windows installation, AdGuard’s current public-DNS instructions use the legacy Control Panel route: Start menu → Control Panel → Network and Internet → Network and Sharing Center → Change Adapter Settings. Select the Wi‑Fi connection, choose Properties, open Internet Protocol Version 4 (TCP/IPv4), select Use the following DNS server addresses, and enter the two IPv4 addresses. Repeat under Internet Protocol Version 6 (TCP/IPv6) if IPv6 is enabled.
AdGuard also provides separate non-filtering and family endpoints. Non-filtering DNS uses unfiltered.adguard-dns.com, or IPv4 addresses 94.140.14.140 and 94.140.14.141. The family service uses family.adguard-dns.com, or 94.140.14.15 and 94.140.15.16.
Choose it if: you want a well-documented, set-and-forget resolver. If a legitimate domain is blocked, an allowlist inside a separate AdGuard app may not override upstream DNS blocking; use the non-filtering resolver or add the domain to the upstream service’s allowlist.
2. NextDNS — best for custom filtering
NextDNS is the strongest choice when a single public IP pair is not enough. Its filtering is profile-based: you select blocklists and create rules for a particular configuration, then install or use that configuration on your devices.
Go to NextDNS and select Try it now. The configuration service lets you select blocklists, add custom denylist and allowlist entries, create rewrites, inspect analytics, and control logging. Log retention can be set from one hour to two years, or disabled completely. You can begin without signing up, but an account preserves your settings.
Unlike AdGuard DNS, NextDNS filtering is not represented by one universal ad-blocking IPv4 pair. Its public non-filtering endpoints are https://dns.nextdns.io for DoH and tls://dns.nextdns.io for DoT; filtering normally uses the endpoint generated for your selected profile.
NextDNS is particularly useful for households or people who need exceptions. For example, you can allow a payment provider that a broad list blocks, apply one configuration to a phone, and use a stricter profile for a child’s tablet.
Recommended Free Tools
Remember that NextDNS is still DNS filtering. It can stop an ad or tracker domain from resolving, but it cannot generally remove an empty ad slot or other page element after the page has loaded.
Also popular on Amazon
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
3. Control D Free DNS — best preset-based alternative
Control D Free DNS offers ready-made endpoints rather than a free dashboard with custom per-device policies. Its main Ads & Tracking preset blocks malware, ads, and trackers:
- IPv4:
76.76.2.2and76.76.10.2 - IPv6:
2606:1a40::2and2606:1a40:1::2 - DoH:
https://freedns.controld.com/p2 - DoT:
p2.freedns.controld.com - DoQ:
quic://p2.freedns.controld.com
There is also a Family Friendly preset at 76.76.2.4 and 76.76.10.4. It adds adult-content and drug-site blocking. The encrypted endpoints are https://freedns.controld.com/family and family.freedns.controld.com.
Advanced users can select a third-party filter endpoint, including OISD Full (https://freedns.controld.com/x-oisd), Hagezi Normal, Hagezi Pro, or the AdGuard Filter. Control D says its free filters are rebuilt and deployed every 30 minutes.
Free tools Windows power users keep installed
One-click scans. No signup required.
The trade-off is important: the free resolvers do not include dashboard or profile management, custom rules, analytics, historical query data, or mixed-and-matched filters. Third-party lists can also create false positives. Hotel and airport captive portals may not work until you temporarily use automatic DNS, accept the portal, and then restore the filtered resolver.
4. Mullvad DNS — best encrypted DNS with filtering levels
Mullvad DNS provides named filtering hostnames that make the desired blocking level easy to identify. The basic ad-blocking service is:
- Hostname:
adblock.dns.mullvad.net - IPv4:
194.242.2.3 - IPv6:
2a07:e340::3 - DoH:
https://adblock.dns.mullvad.net/dns-query - DoT hostname:
adblock.dns.mullvad.net
Other hostnames are base.dns.mullvad.net for ads, trackers, and malware; extended.dns.mullvad.net for those categories plus social media; family.dns.mullvad.net for adult content and gambling; and all.dns.mullvad.net for all listed categories.
On Android 9 or later, use Settings → Network & internet → Private DNS → Private DNS provider hostname, enter adblock.dns.mullvad.net, and tap Save.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For Windows 11, open Settings → Network & internet → Wi‑Fi or Ethernet → Hardware properties → Edit beside DNS server assignment. Select Manual, enable IPv4, enter 194.242.2.3, set DNS over HTTPS to On (manual template), enter https://adblock.dns.mullvad.net/dns-query, and select Save. Configure IPv6 separately if you use it. Mullvad says this encrypted Windows procedure is not available in Windows 10.
Also popular on Amazon
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Browsers can override system DNS. In Chrome or Brave, use Settings → Privacy and security → Security → Use secure DNS → With: Custom. In Edge, open Settings → Privacy, search, and services, find Secure DNS, choose a custom provider, and enter the DoH URL. Firefox uses Settings → Privacy & Security → Enable secure DNS using → Max Protection → Choose provider → Custom.
When connected to Mullvad VPN, Mullvad says its VPN resolver is faster and that adding this separate encrypted DNS service provides negligible additional security. On iOS and iPadOS, iCloud Private Relay can also cause queries to use Apple’s DNS instead.
5. RethinkDNS — best Android-focused option
RethinkDNS combines a configurable cloud DNS service with a companion Android firewall and DNS app. It advertises blocking for ads, trackers, spyware, and malware, with more than 190 blocklists available. The Android app is free and open source, while the cloud content-blocking service has free and paid tiers.
Select Configure now → on the RethinkDNS site to open its current configuration documentation. The service uses DoH or DoT exclusively. This is a better fit than a generic public resolver if you want app-level network controls on Android, rather than only changing the DNS address used by a device.
There is no universal IPv4 resolver pair exposed on the current public homepage. Do not copy an old RethinkDNS IP address from another guide; obtain the current endpoint from the configuration page and use the profile it generates.
6. LibreDNS — best simple DoH endpoint
LibreDNS offers two clearly separated encrypted DNS endpoints:
- Normal DoH:
https://doh.libredns.gr/dns-query - Ad- and tracker-blocking DoH:
https://doh.libredns.gr/noads
In Firefox, open Settings → General → Network Settings → Settings. At the bottom, enable Enable DNS over HTTPS, choose Custom, and enter the LibreDNS endpoint. Use the /noads URL for filtering.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallChromium browsers use Settings → Privacy and security → Security → Use secure DNS → Custom. In Edge, open edge://settings/privacy, find Security, enable Use secure DNS, and choose the custom endpoint.
Also popular on Amazon
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Android’s documented route is Settings → search for Private DNS → select Custom → enter noads.libredns.gr → Save. For DoT, LibreDNS lists standard DNS at 116.202.176.26 with hostname dot.libredns.gr; the ad-blocking hostname is noads.libredns.gr.
LibreDNS says logging is disabled and that it uses OpenNIC as its Tier 1 resolver. Its blocklist is described as a crowdsourced list of known advertising and tracking domains, not as a cosmetic ad remover or a guarantee against first-party advertising.
7. BlahDNS — best for protocol and region choice
BlahDNS is a hobby project supporting DoH over HTTP/2 and HTTP/3, DoT, DoQ, DNSCrypt v2, and DNS-over-DTLS. It advertises filtering for ads, trackers, malware, and CNAME cloaking.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe current service lists Singapore and Germany regions:
| Region | DoH | DoT address and TLS name |
|---|---|---|
| Singapore | https://doh-sg.blahdns.com/dns-query |
46.250.226.242; dot-sg.blahdns.com |
| Germany | https://doh-de.blahdns.com/dns-query |
78.46.244.143; dot-de.blahdns.com |
The Singapore DoT IPv6 address is 2407:3640:2205:1668::1; Germany’s is 2a01:4f8:c17:ec67::1. DoT uses port 853. BlahDNS requires strict SNI for DoH and DoT on port 443, and drops connections without SNI by default.
Before switching, use the site’s Check Domain Status control: enter a domain and select Check to see whether it is filtered. Japan, Switzerland, and Finland are not current regions; the project says those locations were discontinued on July 15, 2024.
How to choose the right DNS ad blocker
- Choose AdGuard DNS or Mullvad DNS for a quick hostname-based setup on Android and encrypted DNS in browsers.
- Choose NextDNS if you need custom allowlists, denylist entries, rewrites, profiles, analytics, or adjustable log retention.
- Choose Control D Free DNS if you prefer selecting a ready-made filter without managing an account.
- Choose RethinkDNS if the main device is Android and firewall controls matter as much as DNS blocking.
- Choose LibreDNS if you want a direct, noads DoH or DoT endpoint with minimal configuration.
- Choose BlahDNS if its Singapore or Germany location and broad encrypted-protocol support suit your network.
Problems you may encounter
Some ads still appear
That is normal for DNS filtering. The resolver can block a hostname, but it cannot reliably remove HTML elements or stop ads delivered by the same domain as the page. A browser content blocker is still more effective for cosmetic filtering on supported desktop browsers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A website or app stops working
Blocklists can contain false positives. Temporarily switch to a non-filtering resolver to confirm the cause. NextDNS allows an explicit allowlist; public Control D free endpoints do not provide custom per-domain overrides. AdGuard’s non-filtering hostnames are unfiltered.adguard-dns.com.
Also popular on Amazon
- Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
- WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
- Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
- Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
- EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
The device appears to ignore the new resolver
Check for three common bypasses: IPv6 still points to the old DNS service, a browser’s Secure DNS setting is overriding the operating-system setting, or a VPN is supplying its own resolver. Configure matching IPv6 addresses and review browser and VPN DNS settings.
Hotel Wi‑Fi will not open its sign-in page
Captive portals can fail when encrypted or filtered DNS is active. Temporarily return DNS to automatic, complete the portal sign-in, then restore the chosen DNS service.
Two DNS providers give inconsistent results
Do not use unrelated providers as preferred and alternate DNS and assume the second is reliable failover. A device may query either one. If one filters a domain and the other does not, behavior will vary. Use the matching pair supplied by one provider, such as AdGuard’s two IPv4 addresses.
FAQ
Which DNS server blocks the most ads?
There is no universal winner because blocklists change and different services block different domains. AdGuard DNS and Mullvad DNS are simple general-purpose choices, while NextDNS gives you the most control over which lists and exceptions are used.
Can DNS block YouTube or streaming-video ads?
Usually not reliably. DNS can block a separate advertising domain, but it cannot generally distinguish an ad from content when both come from the same service domain. DNS filtering also cannot remove empty ad containers from a webpage.
Is NextDNS free?
You can start using NextDNS without signing up, and signing up preserves your configuration. Its feature set is profile-based, so check the current service limits and account terms if you plan to use it extensively.
What should I enter in Android Private DNS?
Enter a provider hostname, not an IP address. Examples include dns.adguard-dns.com, adblock.dns.mullvad.net, and noads.libredns.gr. The exact menu is usually Settings → Network & internet → Private DNS, although manufacturers use different labels.
Does changing DNS make my internet connection private?
Encrypted DoH or DoT protects DNS queries in transit from the local network, but it does not make all internet traffic anonymous. The DNS provider can still receive queries, and websites can identify you through other signals.
Should I configure IPv6 as well as IPv4?
Yes, if IPv6 is enabled on the device or network. Otherwise the device may continue resolving names through an IPv6 DNS server and bypass the IPv4 filtering configuration.
The Bottom Line
AdGuard DNS is the best starting point for most people because its filtering addresses and Android hostname are simple to deploy. Pick NextDNS for granular rules, Mullvad DNS for named encrypted filtering levels, or RethinkDNS for Android firewall features. Control D Free DNS, LibreDNS, and BlahDNS are worthwhile alternatives when their preset, endpoint, or regional approach matches your needs.
Whichever service you select, test a few sites and apps after changing DNS, configure IPv6, and check whether your browser or VPN is using a separate resolver.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
