In short. AdGuard DNS is a public resolver that strips ads and trackers at the DNS layer, before a page ever loads. It offers three address sets: ad blocking, family filtering, and no filtering at all. It works on any device without installing an app and supports DoH, DoT and DoQ. It does not block every ad, however — and understanding that boundary matters more than knowing the addresses.
How AdGuard DNS differs from an ordinary resolver
An ordinary DNS server translates a domain name into an IP address and stops there. AdGuard DNS checks the domain against filter lists first: if it belongs to an ad network, an analytics counter or a tracker, the resolver returns an empty address. The browser has nowhere to go, so the request is never sent at all.
The difference from resolvers such as Quad9 is fundamental. Quad9 blocks malicious domains and deliberately does not touch advertising. AdGuard DNS does precisely what Quad9 leaves alone. These are different jobs, and the choice should follow what you actually need.
The practical consequence is that blocking works where a browser extension cannot reach: inside mobile apps, on a television, in games, on smart home devices. Anything that reaches the internet through your router falls under the filter.
AdGuard DNS addresses: three modes
As with most filtering resolvers, the mode is determined by which address you choose.
| Mode | IPv4 | IPv6 | What it blocks |
|---|---|---|---|
| Default | 94.140.14.14 94.140.15.15 | 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff | Ads, counters, trackers |
| Family | 94.140.14.15 94.140.15.16 | 2a10:50c0::bad1:ff 2a10:50c0::bad2:ff | The above plus adult content and safe search |
| Non-filtering | 94.140.14.140 94.140.14.141 | 2a10:50c0::1:ff 2a10:50c0::2:ff | Nothing, plain resolution |
The third mode looks pointless — why run a filtering service with the filter off? It earns its place as a reference point. When a site breaks and you cannot tell whether the filter is responsible, switching to the same operator's non-filtering address answers the question in a minute while changing nothing else.
Do not mix addresses from different modes in one pair. The operating system does not query resolvers in strict order, so you get behaviour that shifts from request to request: one ad is blocked, the next slips through.
What DNS blocking can and cannot do
This is the section that matters most, and the one usually skipped. A DNS filter operates on domain names, which means it can only block what lives on a separate domain.
Blocked well: advertising networks, analytics counters, trackers, pixels, telemetry collection endpoints. All of these traditionally sit on domains of their own, and refusing to resolve them removes them entirely.
Never blocked, by design: advertising a site serves from its own domain. The classic case is video advertising on large platforms, where the clip and the ad arrive from the same address and cannot be told apart by hostname. Refusing to resolve it would break the site itself.
Outside the mechanism entirely: cosmetics. A DNS filter cannot hide empty containers, collapse leftover spacing or remove placeholders — it knows nothing about page content. A gap often remains where the banner used to be. Closing that gap is a job for a browser extension that can see the DOM.
If the expectation is that "nothing should be visible at all", a DNS filter alone will disappoint, and that is not a fault in it. DNS removes the network layer; an extension removes the cosmetic layer. The layers add up rather than replace one another.
How to set it up
Starting at the router makes sense: it covers the whole network, including devices that expose no DNS settings of their own.
Router
In the router's web interface find the WAN, Internet or DHCP section and a field for manual DNS entry. Enter 94.140.14.14 and 94.140.15.15, save, reboot. Clients pick up the addresses on their next DHCP lease renewal.
Windows, macOS, Linux
# Windows
netsh interface ip set dns name="Ethernet" static 94.140.14.14
netsh interface ip add dns name="Ethernet" 94.140.15.15 index=2
ipconfig /flushdns
# macOS
sudo networksetup -setdnsservers "Wi-Fi" 94.140.14.14 94.140.15.15
sudo dscacheutil -flushcache
# Linux with systemd-resolved
sudo resolvectl dns wlan0 94.140.14.14 94.140.15.15
sudo resolvectl flush-cachesAndroid and iOS
Android exposes a Private DNS setting: enter dns.adguard-dns.com there and encrypted DoT applies across every network, mobile data included. iOS has no such system field and needs a configuration profile or an app. On an iPhone that is the only way to extend the filter to the cellular network rather than Wi-Fi alone.
After changing addresses, flush the system and browser caches, or some domains will keep answering from the old resolver. A full walkthrough of the caching layers is in the guide on flushing the DNS cache.
DoH, DoT and DoQ
Plain DNS travels in clear text: your ISP sees the domains you request and an intermediary can forge the answer. Encrypted transports close that gap.
# DoH — for browsers
https://dns.adguard-dns.com/dns-query
# DoT — for system resolvers and Android
dns.adguard-dns.com
# DoQ — DNS over QUIC
quic://dns.adguard-dns.comDoQ deserves separate attention. DoH carries DNS over HTTPS, and therefore over TCP with all its connection-setup latency. QUIC runs over UDP and does not suffer head-of-line blocking when a packet is lost, which is noticeable on a mobile connection with an unstable signal. DoQ support is far from universal, but AdGuard adopted it early. The mechanics of encrypted DNS in general are covered in the article on DNS over HTTPS.
A browser may query its own DoH resolver regardless of system settings. You would then believe the whole machine runs through AdGuard DNS while Chrome or Firefox resolve past the filter entirely. Verify the setup from the browser itself.
What family mode adds
The .15 and .16 addresses add adult content blocking and enforced safe search on major search engines to the advertising filters. The latter works by rewriting answers for search domains to their "safe" variants, so turning safe search off inside the search engine's own settings will not help.
The limitation is honest: the filter works from domain lists, not from page content. A new or obscure site may simply be absent from the lists. As the sole parental control measure that is not enough; as one layer among several it works.
AdGuard DNS is not working: what to check, in order
There are usually three symptoms: one site stopped opening, the internet died entirely, or the ads are still there. Each has a different diagnosis.
A single site will not open. Almost always a filter false positive. Compare the answer on the filtering and non-filtering addresses of the same operator — an empty address on 94.140.14.14 and a normal one on 94.140.14.140 means the filter fired.
The internet died entirely. Check the addresses for a typo: 94.140.14.14, not 94.140.14.4. Then check whether traffic reaches the resolver at all — some ISP networks intercept port 53 and substitute answers. An encrypted transport gets around that; plain DNS does not.
The ads are still there. First confirm the filter is applied at all — you may still be on the old resolver because of caching or the browser's own DoH. If it is applied and ads persist, they most likely come from the same domain as the content; see the section on the boundaries of the mechanism.
# Which resolver is actually answering
dig +short o-o.myaddr.l.google.com TXT @94.140.14.14
# Compare filtering and non-filtering addresses of one operator
dig +short doubleclick.net @94.140.14.14
dig +short doubleclick.net @94.140.14.140
# Confirm port 53 is not being intercepted
dig +short example.com @94.140.14.14 +tcp
AdGuard DNS versus Quad9 and Cloudflare
| Property | AdGuard DNS | Quad9 | Cloudflare 1.1.1.1 |
|---|---|---|---|
| Ad and tracker blocking | Yes, its core purpose | No | No |
| Malicious domain blocking | Yes | Yes, its core purpose | On a separate address |
| Family filtering | Separate address | No | Separate address |
| DoQ | Yes | No | No |
| Operator | Commercial company, Cyprus | Non-profit foundation, Switzerland | Commercial company, US |
The choice follows the job. If you want threat protection with no interference in content, Quad9. If you want ads and trackers gone across every device at once, AdGuard DNS. If only speed and correctness matter, take any of the three and measure from where you are: figures from someone else's review describe someone else's geography. A broader comparison lives in our roundup of public DNS servers.
How to verify it works
Three things deserve checking: which resolver actually answers, whether ads are being filtered, and whether anything you need has broken.
If dig is unavailable, the same checks work from a browser. DNS Lookup returns every record type and compares roughly twenty resolvers in a single table, so a divergence between AdGuard and the rest is immediately visible. When you suspect a domain has been filtered in error, compare it through the DNS propagation check: if every resolver agrees and AdGuard does not, that is the filter rather than the domain.
Site owners deserve a separate note: if your domain lands on an advertising list by mistake, part of your audience simply cannot open the site and will not tell you. Putting records under continuous monitoring costs less than learning about it from a traffic decline.
Frequently asked questions
Is AdGuard DNS free?
The public addresses are free and require no registration. The company also sells a paid service with a dashboard, statistics and custom rules — a separate product that basic filtering does not need.
Will it block YouTube ads?
No. Those ads come from the same domains as the video itself, and a DNS filter can only distinguish domains. Refusing to resolve them would break playback entirely.
How is this different from a blocker extension?
An extension sees page content and can hide empty containers, but it works only inside its own browser. A DNS filter covers every device and application but cannot see content. Together they close different layers.
Will AdGuard DNS slow down my connection?
List matching happens on the resolver side and is imperceptible. Real differences come from the distance to the nearest point of presence, which you should measure yourself. Indirectly, pages often load faster because requests to ad networks are never made.
A site stopped opening after I switched. What now?
Compare the answers on 94.140.14.14 and 94.140.14.140. Different answers mean the filter fired. For one-off work, switching temporarily to the non-filtering address is enough.
Can I use it on a router if my ISP supplies its own DNS?
Usually yes — manual addresses in the WAN settings override those handed out over DHCP. If the field is unavailable, the remaining option is configuring each device individually.
Migration checklist
- Pick a mode: default for ads and trackers, family to add adult content, the third for no filtering.
- Configure both addresses of the chosen mode without mixing modes.
- Start at the router to cover devices with no DNS settings of their own.
- Add the IPv6 addresses if IPv6 is active, or part of your traffic bypasses the filter.
- Enable Private DNS on Android so the filter applies on mobile data too.
- Flush the system and browser caches.
- Disable the browser's separate DoH or point it at the same resolver.
- Test work services, banking and corporate resources before rolling out network-wide.
- Remember 94.140.14.140 — the fastest way to establish whether the filter is to blame.