CompareInternet is independent and reader-supported. When you buy through links on this page we may earn a commission from Amazon or eBay at no extra cost to you. We don't accept payment for placement, and we don't publish made-up speeds, test scores or prices — tiers ($ to $$$) show relative cost only. Provider plans and pricing change often; always confirm on the provider's site.
Browser ad blockers only protect one browser on one device. DNS filtering protects everything on your network, including phones, tablets, smart TVs, streaming sticks, consoles and smart-home gadgets, by refusing to look up the addresses of known ad, tracking and malware domains.
The best-known tools are Pi-hole and AdGuard Home, free software you run on a small device at home, and hosted services like NextDNS that do the filtering in the cloud. This guide explains how DNS filtering works, which option to choose, how to set it up, and its limits.
How DNS filtering works
When a device wants to reach a website or ad server, it first asks a DNS server to translate the name into an address. A DNS filter sits in the middle. For normal sites it answers as usual. For domains on its blocklists (ad networks, trackers, known malware) it returns nothing, so the request never happens.
Because every device on your network uses your router's DNS settings by default, pointing your router at a filter protects the whole house at once.
Choosing your approach
| Option | Runs on | Best for |
|---|---|---|
| Pi-hole | Raspberry Pi, old PC, Docker | Tinkerers who want full control and detailed stats |
| AdGuard Home | Raspberry Pi, Docker, or built into some routers (GL.iNet) | A polished interface; encrypted DNS built in |
| NextDNS and similar cloud services | The cloud (no hardware) | No setup hardware; protection that travels with phones |
| Router with built-in blocking | Your router | The simplest single-box setup |
Setting up Pi-hole on a Raspberry Pi
- Prepare the Pi. Install Raspberry Pi OS Lite with the Raspberry Pi Imager and enable SSH.
- Give it a fixed address. Set a DHCP reservation for the Pi in your router so its IP address never changes.
- Install Pi-hole. Run the official installer from Pi-hole's website over SSH and follow the prompts. Choose an upstream DNS provider.
- Point your network at it. In your router's DHCP settings, set the DNS server to the Pi's address. If your router doesn't allow that, set DNS manually on key devices or use Pi-hole's own DHCP server.
- Test. Reconnect a device and open the Pi-hole dashboard. You should see queries and blocks appear.
- Tune. Add blocklists carefully and allowlist anything that breaks.
AdGuard Home's setup is similar and offers a guided web installer.
The easiest option: routers with it built in
Some routers include DNS filtering out of the box. GL.iNet routers, for example, include AdGuard Home that you can switch on in their admin panel. That's the simplest way to get network-wide blocking with no extra hardware. Several mesh systems also offer ad and tracker blocking, sometimes as part of a subscription.
What DNS blocking can't do
- YouTube and some streaming ads are served from the same domains as the video, so DNS filtering can't block them without breaking playback.
- In-app ads that use first-party domains may get through.
- Devices with hard-coded DNS (some smart TVs and streaming boxes) may ignore your DNS settings. Advanced users can redirect DNS traffic at the router.
- Encrypted DNS in browsers (DNS over HTTPS) can bypass your filter. You can turn it off in the browser or set the browser to use your filter.
DNS filtering complements browser ad blockers rather than replacing them.
Avoiding problems
Overly aggressive blocklists break websites, login pages, shopping links and smart-home apps. Start with one well-maintained default list, add more gradually, and keep an allowlist. Add a backup plan: if your Pi-hole goes down, your whole network loses DNS. Either run two instances or know how to point the router back to a normal DNS server quickly. Also note that DNS filtering can break affiliate and tracking links on some sites. That's working as designed, but worth knowing when a link won't open.
Pair it with a secure network
DNS filtering is one layer of home network security. Keep router firmware updated, use strong Wi-Fi passwords and WPA3, and put smart-home gadgets on a guest network. See home Wi-Fi security, router parental controls and guest Wi-Fi setup.
Pi-hole for families
DNS filtering can also block categories of sites for kids, such as adult content, gambling and known malware, across every device on the network. Pi-hole and AdGuard Home can apply group-based rules, and services like NextDNS offer ready-made parental control categories and per-device profiles. Combine this with your router's parental controls and schedules for a solid baseline. See router parental controls.
Encrypted DNS upstream
By default, your filter sends allowed lookups to an upstream DNS provider in plain text, which your ISP can see. AdGuard Home supports encrypted upstream DNS (DNS over HTTPS or TLS) natively, and Pi-hole can use a local encrypted resolver such as cloudflared or unbound for privacy. It's an optional step, but worth doing once the basics are working.
Hardware for network-wide blocking
1. Raspberry Pi 5 starter kit
$$Best for: A dedicated, low-power DNS filter
A Raspberry Pi with case, power supply and storage is the classic Pi-hole or AdGuard Home host. It's silent, cheap to run and powerful enough for any home.
What we like
- Low power, always on
- Huge community support
Watch out for
- Some Linux setup
2. Raspberry Pi Zero 2 W
$Best for: Lightweight Pi-hole on a tight budget
A tiny, inexpensive Pi that handles Pi-hole for a typical home. It's Wi-Fi only unless you add an Ethernet adapter, and wired is better for a DNS server.
What we like
- Very cheap
- Tiny
Watch out for
- Add an Ethernet adapter for reliability
3. GL.iNet Flint 2 (GL-MT6000)
$$Best for: AdGuard Home built into the router
GL.iNet's firmware includes AdGuard Home you can enable in a click, giving you network-wide blocking with no extra device.
What we like
- No extra hardware
- Also offers SQM and VPN
Watch out for
- Router-based filtering is less tweakable than Pi-hole
Frequently asked questions
Does Pi-hole block YouTube ads?
Generally no. YouTube serves ads from the same domains as videos. Use a browser ad blocker or a premium subscription for that.
Is Pi-hole better than AdGuard Home?
Both are excellent. Pi-hole has a huge community. AdGuard Home has a polished interface and built-in encrypted DNS. Choose whichever you find easier.
Do I need a Raspberry Pi for DNS blocking?
No. You can use a cloud service like NextDNS, a router with built-in blocking, or run Pi-hole in Docker on an existing server.
What happens if my Pi-hole goes down?
Devices can't look up addresses, so the internet appears down. Run a second instance or know how to switch DNS back on your router.
Can DNS filtering break websites?
Yes, with aggressive blocklists. Start with a default list and allowlist anything that breaks.