Start with one phone. If something breaks, changing one setting back is easier than debugging the whole house. A compatible router can cover most devices later, with some exceptions.
What DNS blocking does
A DNS resolver translates a domain name into an address. AdGuard DNS checks requested domains against its filtering rules and refuses or redirects matches, depending on the service and rule.
If an app requests a separate advertising or tracking domain, that connection can be blocked before the content downloads. For me, this is the reason to use DNS blocking: it also catches separate ad and tracking domains used by apps.
Why AdGuard DNS does not block every ad
A DNS filter decides one thing: whether to answer a request for a domain. That is enough to stop an ad loading from a separate advertising domain, and it does nothing about an ad that arrives from the same domain as the content you asked for.
YouTube is the clearest case: AdGuard says DNS filtering cannot block video ads served from the same domain as the video. The same limitation applies whenever an app or site serves ads and content from one hostname. If a filter list claims to solve this at the DNS layer, check what it actually blocks before you trust the claim.
Three other limits are worth knowing before you decide the setup is broken:
- An ad written directly into the page HTML arrives with the page. Nothing was requested separately, so there is nothing to refuse.
- Sponsored posts and in-feed promotions are content on the platform's own domain, not calls to an ad network.
- A device or app can ignore your DNS setting through a VPN, its own encrypted DNS, a hardcoded resolver, cellular data, or IPv6 settings supplied elsewhere.
So your result depends on the device, app, site, resolver mode, and filter list. A blocked-query percentage counts refused lookups, not the share of ads you stopped seeing.
If you want a cleaner page rather than a cleaner network, a browser content blocker works on a different layer and can remove elements after they arrive. Running both is normal, as they solve different halves of the problem.
Test it on Android
Android supports encrypted private DNS on current versions:
- Open Settings.
- Search for Private DNS.
- Select Private DNS provider hostname.
- Enter
dns.adguard-dns.com. - Save.
Menu names vary by manufacturer. If the option is missing, use AdGuard's current public DNS instructions for your Android version.
I would leave it on for a day and use the phone normally. If one app stops working, switch Private DNS back first.
Set it up on iPhone or iPad
For coverage beyond one Wi-Fi network, follow AdGuard's current iOS instructions and use its configuration profile or supported app.
You can enter DNS addresses manually under a Wi-Fi network, but that setting applies only to that network. It does not cover cellular data, and you need to repeat it for every Wi-Fi network.
That is why I would use the documented profile for a device-wide setup. Before installing any profile, check that the download comes from AdGuard's official domain and read what the profile changes.
Apply it through your router
A router change can cover phones, laptops, TVs, consoles, and smart-home devices that accept DNS settings from the network.
Write down the current DNS values first. Then:
- Open your router's administration page.
- Find the WAN, Internet, DHCP, or DNS settings.
- Enter AdGuard's default public IPv4 servers:
- Primary:
94.140.14.14 - Secondary:
94.140.15.15
- Primary:
- Check whether the router has separate IPv6 DNS settings.
- Save the change and reconnect one test device.
Router menus differ, so use the manual for your model. Some internet-provider routers do not allow custom DNS at all.
Most devices that accept DNS from the router will now use AdGuard DNS on that network. A device or app can still bypass it through hardcoded DNS, private encrypted DNS, a VPN, cellular data, or IPv6 settings supplied elsewhere.
Network-wide does not mean impossible to bypass. It means one network setting covers the devices that follow it.
What the default service blocks
AdGuard's default public servers focus on ads and trackers. Its family-protection servers use different addresses and add adult-content blocking and safe search.
Check the current server list before choosing a mode. Do not mix addresses from different modes, as the result becomes harder to understand.
DNS filtering can block:
- advertising domains used by apps and websites
- tracking and telemetry domains included in the service's rules
- connections to domains covered by the selected protection mode
It cannot inspect encrypted page content or remove an element served from an allowed domain. A browser content blocker can still help inside the browser.
Privacy and encrypted DNS
A public DNS provider can process the domain lookups sent to it. You are moving that part of the connection from the resolver chosen by your network to AdGuard.
Read the AdGuard DNS privacy policy before making that choice. Use an encrypted method such as Android Private DNS or the supported iOS profile where available. Encryption protects DNS transport, but it does not make browsing anonymous.
Plain DNS addresses entered on a router usually travel without that encryption unless the router explicitly supports DNS over HTTPS or DNS over TLS.
Other public resolvers
These services solve different problems, so choosing one from a generic “fastest DNS” list makes little sense.
| Provider | Main purpose | Blocks ads by default |
|---|---|---|
| AdGuard default public DNS | Advertising and tracker filtering | Yes, at DNS level |
| Quad9 | Malicious-domain protection | No general ad blocking |
Cloudflare 1.1.1.1 |
General public DNS with a privacy focus | No |
| NextDNS | Account-based filtering and rules | Configurable |
Quad9 and Cloudflare are not ad-blocking replacements.
Public AdGuard DNS or AdGuard Home
Public AdGuard DNS is enough for the quick setup. I would move to AdGuard Home only for local logs, custom lists, or per-device rules, as you own the maintenance too.
I would create an AdGuard DNS account only if I needed hosted statistics, device configuration, or custom rules. AdGuard offers a free Starter plan, but its request, device, server, and rule limits can change, so check the current plan page before relying on them.
AdGuard Home runs the resolver on your own system and adds those controls. DNS-level blocking still has the same-domain limits described above.
Revert before debugging everything else
Some sites and apps depend on domains a filter may block. If something breaks, restore the previous DNS value on the test device first.
If that fixes the problem, you know where to investigate. If it does not, the DNS change was probably not the cause. Small test, clear answer.
Sources
- AdGuard DNS public servers, AdGuard. Lists the current default and family-protection resolver addresses and setup methods.
- AdGuard DNS Privacy Policy, AdGuard. Explains public-resolver retention and the configurable query-log behavior of private accounts.
- How ad block DNS can make the Internet better, AdGuard. Documents the YouTube same-domain limitation and other limits of DNS-level blocking.
- Threat blocking, Quad9. Says its filtered service blocks malicious domains rather than ads or general content.
- 1.1.1.1 Public DNS Resolver, Cloudflare. Documents its standard resolver as unfiltered and separates it from Families malware and adult-content modes.
- NextDNS, NextDNS. Describes its configurable security, ad and tracker blocking, and allow and deny controls.
Get Personalized Help
Copy this prompt to ChatGPT, Claude, or your favorite AI assistant. Fill in your details and get guidance tailored to your specific situation.
Act as a cautious setup guide for someone who read https://ivanmisic.net/blog/tech/block-ads-every-device-adguard-dns and wants to try public AdGuard DNS. This is an interactive interview. Start with one reversible device test, not a network-wide router change. Ask one question at a time and wait for each answer. Establish the exact device and operating-system version, whether the test should cover one Wi-Fi network or mobile connections too, the filtering goal, the current DNS or private-DNS state, and whether a VPN, encrypted DNS, cellular data, mesh system, or IPv6 configuration is involved. Ask which apps or sites must keep working and how I will record and restore the current setting. Before giving addresses, hostnames, profile links, or menu steps, check AdGuard's current public DNS documentation and privacy policy. Cite the primary pages and state what you could not verify. For router-specific instructions, require the exact model and current manufacturer or ISP manual. Do not infer menus from a similar router. Explain the limits before setup: DNS filtering can block requests to listed domains, but it cannot remove same-domain ads, sponsored content, or page elements. A VPN, app-specific resolver, private DNS, cellular connection, or separate IPv6 DNS setting can bypass a router configuration. A blocked-query percentage is not the percentage of ads removed. Never ask for router credentials, Wi-Fi passwords, public IP details, private keys, profiles from unofficial domains, or identifiable DNS logs. Show one proposed change at a time, explain its scope and privacy trade-off, and wait for approval. Keep default and family-protection server modes separate. After the one-device test, ask me to verify normal browsing and the apps I named. If anything breaks, restore the prior DNS setting before diagnosing further. Only then compare three choices: keep one-device coverage, use a verified router setting, or stop. Finish with a network-wide plan only if requested. It must include recorded old values, current official resolver details, IPv4 and IPv6 checks, one reconnected test client, bypass expectations, privacy implications, and an exact rollback test.