Private DNS that bites back
Every app on every device looks up domain names before it connects. Swap your internet provider's DNS for one that refuses to answer for ad and tracker domains, and they vanish everywhere, even inside apps.
Our picks
All of these encrypt your lookups (DNS-over-HTTPS / DNS-over-TLS), so your internet provider can't read or sell your browsing history. Addresses change occasionally: confirm on the provider's site before setting up.
| Service | Price | Blocks ads | Android Private DNS hostname | Best for |
|---|---|---|---|---|
| AdGuard DNS | Free Paid plans | Yes | dns.adguard-dns.com | Zero-config ad blocking. Custom rules on paid tiers. |
| Mullvad DNS | Free | Yes (on base / adblock) | base.dns.mullvad.net | Privacy purists. No account, no logs. |
| Control D | Free Paid plans | Yes (on p2) | p2.freedns.controld.com | Power users who want per-device profiles. |
| NextDNS | Free tier Paid | Yes (you choose lists) | Personal ID from your dashboard | Fine-grained control, analytics you own, allow/deny lists. |
| Quad9 | Free | No malware only | dns.quad9.net | Non-profit, privacy-first, blocks malicious domains. |
| Cloudflare 1.1.1.1 | Free | No | one.one.one.one | Speed and encryption. Pair with a hosts file or browser blocker. |
| Pi-hole | Self-host | Yes (any lists) | Your own server | Whole-home blocking on a Raspberry Pi. Full control. |
| AdGuard Home | Self-host | Yes (any lists) | Your own server | Like Pi-hole, with built-in encrypted DNS. |
NextDNS's free tier covers a generous monthly query allowance; once you pass it, filtering pauses until next month while DNS keeps working.
Set it up
Start with your phone (biggest app-tracking surface), then your router to cover the whole house.
Android 9+
- Open Settings → Network & internet (or Connections → More connection settings on Samsung).
- Tap Private DNS.
- Choose Private DNS provider hostname and enter a hostname from the table, e.g.
dns.adguard-dns.com. - Save. It applies on Wi-Fi and mobile data, system-wide.
iPhone & iPad
iOS uses configuration profiles for encrypted DNS.
- In Safari, open your provider's setup page (AdGuard, NextDNS, Control D and Mullvad all publish one) and download the profile.
- Go to Settings → General → VPN & Device Management, tap the downloaded profile and install it.
- Confirm under Settings → General → VPN & Device Management → DNS.
Windows 11
- Settings → Network & internet → select Wi-Fi or Ethernet → your connection, or Hardware properties.
- Next to DNS server assignment, choose Edit → Manual, enable IPv4.
- Enter the provider's IPv4 addresses and set DNS over HTTPS to On (automatic template) where offered.
AdGuard DNS IPv4: 94.140.14.14 and 94.140.15.15.
macOS
Install the provider's configuration profile (same as iPhone) for encrypted DNS, or set plain servers in System Settings → Network → your connection → Details → DNS.
Just the browser (Chrome, Edge, Firefox)
- Chrome / Edge / Brave: Settings → Privacy and security → Security → Use secure DNS → choose Custom and paste a DoH URL such as
https://dns.adguard-dns.com/dns-query. - Firefox: Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom.
Router (whole household)
Log in to your router (often 192.168.0.1 or 192.168.1.1), find DNS under WAN, Internet or DHCP settings, and replace the automatic servers with your provider's IPv4 addresses. Every device that joins your Wi-Fi, including smart TVs and consoles, is now filtered. For the most control, point the router at a Pi-hole on your network.
After switching: flush your DNS cache so old answers don't linger. Commands are on the hosts page.