A browser ad blocker only protects the browser. Ads in phone apps, on the TV, on the console or on the connected fridge get served all the same. A filtering DNS is the way to cover all of that at once, and understanding how it does it also explains its limits.
How a DNS blocks ads
When an app or a website wants to show an ad, it almost always fetches it from a domain other than the content: an ad network, a tracking server, an analytics provider. Before connecting, the device asks the DNS for that domain. A filtering resolver keeps a list of those domains and, when asked for one, answers that it doesn’t exist (or returns an empty address). The app can’t download the ad and shows a gap, or nothing.
That gives this method its three properties:
- It covers everything that uses that DNS. Set on the router, it covers every device in the house; set on the phone as Private DNS, it covers every app.
- Nothing to install, no resources used. No extension, no app, no background process.
- It can only block whole domains. It doesn’t see the page content and can’t tell the ad from the video if they come from the same place.
What no DNS can block
This is what disappoints first-timers most, so it goes first.
Same-domain ads. YouTube serves ads from the same domains as the videos; so does Twitch; so do social networks with their sponsored posts. A DNS can’t block that without blocking the whole service. For YouTube you still need a browser blocker.
Ads inside the content. Sponsored mentions in a video, native advertising on a site, promoted results in a search engine: there’s no domain to block.
Tracking by other means. A DNS blocks tracking domains, but not the site’s own cookies, nor browser fingerprinting, nor what the app sends to its own servers.
With that clear, for everything else it works very well: website banners, interstitials in free apps, third-party trackers, audience measurement and a good share of the ads in TV apps.
The free options, one by one
| Resolver | Addresses | Name for Private DNS (DoT) | Blocks | Logs |
|---|---|---|---|---|
| AdGuard DNS | 94.140.14.14 · 94.140.15.15 | dns.adguard-dns.com | Ads, trackers, malware | None kept |
| Control D (Ads mode) | 76.76.2.2 · 76.76.10.2 | p2.freedns.controld.com | Ads, trackers, malware | None kept |
| DNS4EU (Protective + ad-free) | 86.54.11.13 · 86.54.11.213 | noads.joindns4.eu | Ads, trackers, malware | None kept |
| NextDNS | With account (45.90.28.0 is unfiltered) | <id>.dns.nextdns.io | Whatever you configure | Optional |
AdGuard DNS is the reference. It uses AdGuard’s own filter lists, maintained daily, and also has a family variant (94.140.14.15) that adds adult content and safe search, and an unfiltered one (94.140.14.140). It operates from Cyprus and keeps no logs. In our measurement from Madrid it was the slowest of the group (34 ms cached, 107 cold), which is still fine for browsing but noticeable next to DNS4EU’s 6 ms.
Control D offers six free resolvers with no account, in steps: unfiltered (76.76.2.0), malware (2.1), malware and ads (2.2), the previous plus social networks (2.3), family (2.4) and uncensored (2.5). The ads one is 76.76.2.2. From Madrid it answered in 7 ms cached and 106 cold. Canada, no logs.
DNS4EU is the European public resolver and has two ad-free variants: protective (86.54.11.13) and child (86.54.11.11), both with malware blocking. It’s the only one on this list with an operator and jurisdiction inside the European Union, and it was the fastest from Madrid: 6 ms cached, 35 cold. If you’re in Europe, start here.
NextDNS is different: its public addresses (45.90.28.0) filter nothing. To block you create a free account, pick lists (you can load AdGuard’s, EasyList, OISD and dozens more), add exceptions and view the query log if you want. It’s the most powerful and the only one where you can fix what breaks yourself. The free plan goes up to 300,000 queries a month, which is plenty for a normal household.
What breaks and how to fix it
Blocklists are aggressive by design and every so often take something down with them:
- Affiliate and tracking links (the ones in newsletters, the “see deal” buttons on coupon sites) go through a tracking domain and come up blank. The fix is opening them in a browser without that DNS, or adding an exception in NextDNS.
- Buy buttons and checkouts that load a measurement script before they work.
- Games and apps whose login or store depends on a telemetry domain that’s on the list. We cover it in the gaming article.
- Apps showing “no connection” because they read the block as a network failure.
The practical rule: when something fails oddly, switch for a minute to an unfiltered resolver (1.1.1.1 or the same provider’s unfiltered variant). If it works, you know the cause. And don’t pair a filtering primary with an unfiltered secondary: the blocking would have holes.
Where to set it
On the router, to cover the whole house in one go, TV and console included (router guide). On the phone, as Private DNS on Android or with the provider’s profile on iPhone, so it applies on mobile data too (phone article). And if you only want blocking on the computer, directly on Windows or macOS.
Before deciding, the speed test tells you which of the four answers fastest from your network; a slow filter shows on every page.