Who This Is For
Beginner.
Think of it like a bouncer standing at the door for every website request that comes through your network. Ads and trackers try to get in, and the bouncer just turns them away before they ever reach your screen.
What You'll Build
Whole-home DNS filtering, plus a foundation for local service names.
Prerequisites
- A Raspberry Pi, VM, LXC, or Docker host
- Router admin access
Pi-hole vs. AdGuard Home
- Pi-hole, straightforward DNS sinkhole with a mature ecosystem of blocklists
- AdGuard Home, integrated DNS rewrites and broader DNS controls in one interface
Deploy It
$ pihole:
$ image: pihole/pihole:latest
$ ports:
$ - "53:53/tcp"
$ - "53:53/udp"
$ - "8080:80"
Choose a DHCP/DNS Architecture
- Router handles DHCP, Pi-hole/AdGuard handles DNS only (simplest)
- Pi-hole/AdGuard handles both DHCP and DNS (more control, more to manage)
Point Your Router at It
Set the router's DHCP DNS option to your Pi-hole/AdGuard Home IP.
Choose an Upstream DNS Provider
Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or your ISP's resolver are all reasonable choices, pick one with a privacy policy you're comfortable with.
Allowlist Broken Services
Some apps break under aggressive blocklists, allowlist specific domains as needed rather than disabling blocking entirely.
Add DNS Redundancy
Configure a second DNS server (router fallback, or a second Pi-hole instance) so a single outage doesn't take down DNS for the whole house.
Security & Backup Notes
- A DNS outage takes down internet access for the whole network, redundancy here isn't optional once family members depend on it
Troubleshooting
- Devices bypass DNS, some apps and OSes hardcode DNS servers (DNS-over-HTTPS especially); check device-level settings
- Router ignores custom DNS, some ISP routers override DHCP DNS options; you may need router DNS settings changed directly instead
- IPv6 DNS bypass, if IPv6 is active, make sure DNS is also handled over DHCPv6/RA
- Smart TVs or apps break, allowlist the specific domains rather than disabling blocking network-wide
- DNS server outage disrupts the whole network, this is exactly why redundancy matters
Lab Finish Line
Whole-home DNS filtering plus local service names.