AdGuard Home DNS Setup A Complete Configuration Guide

AdGuard Home is one of the most powerful self-hosted DNS solutions available today. It blocks ads, trackers, and malware domains at the DNS level for every device on your network — no browser extensions, no per-device configuration. If you have been running Pi-hole or just relying on your ISP's default DNS, switching to AdGuard Home gives you a cleaner interface, built-in HTTPS/DNS-over-TLS support, and more granular filtering control. This guide walks through installation, initial DNS configuration, router integration, and verification so you can go from zero to a fully working setup in under an hour.

What AdGuard Home Does and Why It Matters

When a device on your network requests analytics.example-ad-network.com, that request hits your DNS server first. AdGuard Home checks the domain against its blocklists and, if it matches, returns NXDOMAIN or a zero IP instead of the real address. The ad never loads. The tracker never fires. This works for every device — smart TVs, phones, game consoles — without touching each one individually.

Beyond blocking, AdGuard Home lets you:

• Encrypt outbound DNS queries using DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to upstream resolvers like Cloudflare or Quad9
• Set custom DNS rewrite rules for local hostnames
• See a real-time query log per client
• Schedule blocking rules by time of day
• Override specific domains for specific clients

Hardware and OS Requirements

AdGuard Home is a single Go binary. It runs on Linux (x86-64, ARM, MIPS), Windows, macOS, and inside Docker. For a home network serving 20-50 devices, a Raspberry Pi 3B or newer is more than sufficient. A spare PC or a small VM on your NAS works equally well. The only firm requirement is that the machine has a static IP address on your LAN — DNS clients need a stable target to point at.

Installation on Linux (Recommended Method)

The fastest way to install is with the official automated script. Run this as root or with sudo:

The script detects your architecture, downloads the correct binary to /opt/AdGuardHome/, installs a systemd service, and starts it. After the script completes you will see output like:

If you prefer Docker, the one-liner below mounts config and work directories so your settings survive container updates:

Initial Web UI Setup Wizard

Open a browser and navigate to http://<server-ip>:3000. The setup wizard runs only once. Key decisions during the wizard:

1. Admin web interface port — leave at 3000 or change to 80 if nothing else is using it. Port 80 is convenient so you do not need to remember the port number.
2. DNS server port — must be 53. If your Linux system has systemd-resolved occupying port 53, stop it first: sudo systemctl disable --now systemd-resolved. Then remove or edit /etc/resolv.conf to not point at 127.0.0.53.
3. Admin username and password — choose something strong. The interface is accessible to anyone on your LAN by default.

After completing the wizard, the main dashboard appears and AdGuard Home starts answering DNS queries on port 53.

Configuring Upstream DNS Servers

Go to Settings > DNS Settings > Upstream DNS servers. This is where AdGuard Home sends queries that are not blocked. Options:

• Cloudflare DoH: https://dns.cloudflare.com/dns-query
• Quad9 DoT: tls://dns.quad9.net
• Google DoH: https://dns.google/dns-query
• NextDNS (with your profile ID): https://dns.nextdns.io/<profileid>

Using DoH or DoT means your ISP cannot snoop on your DNS queries — they see an encrypted HTTPS or TLS connection rather than plain-text UDP port 53 traffic. Set the Load balancing method to Parallel if you list multiple upstreams; this picks the fastest response for each query.

Under Bootstrap DNS servers, enter plain IP addresses used to resolve the DoH/DoT hostnames themselves (a chicken-and-egg problem). Reliable choices:

Adding Blocklists

Navigate to Filters > DNS blocklists > Add blocklist. AdGuard Home ships with several pre-loaded lists. Recommended additions for most home networks:

• OISD Big — comprehensive, low false-positive rate: https://big.oisd.nl
• HaGeZi Multi PRO: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt
• Steven Black Unified Hosts: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

After adding lists, click Update filters. The dashboard will show total blocked domains — 200,000 to 500,000 is a typical range depending on your lists. Avoid piling on dozens of overlapping lists; it wastes RAM and increases query latency without meaningfully improving coverage.

Pointing Your Router at AdGuard Home

The most efficient way to cover every device on your network is to update your router's DHCP settings so it hands out AdGuard Home's IP as the DNS server. Instructions vary by router brand:

Asus Routers (asusrouter.com or 192.168.1.1)

1. Log in at http://router.asus.com or 192.168.1.1
2. Go to LAN > DHCP Server
3. Set DNS Server 1 to your AdGuard Home server IP (e.g., 192.168.1.100)
4. Clear DNS Server 2 or set it to a fallback only if you accept bypassing AdGuard Home during downtime
5. Click Apply

TP-Link Routers (tplinkwifi.net or 192.168.0.1)

1. Log in at http://tplinkwifi.net or 192.168.0.1
2. Go to Advanced > Network > DHCP Server
3. Set Primary DNS to your AdGuard Home IP
4. Set Secondary DNS blank or to a trusted fallback
5. Click Save

Netgear Routers (routerlogin.net or 192.168.1.1)

1. Log in at http://routerlogin.net or 192.168.1.1
2. Go to Advanced > Setup > Internet Setup
3. Under Domain Name Server (DNS) Address, select Use These DNS Servers
4. Enter your AdGuard Home IP as the Primary DNS
5. Click Apply

Generic / Other Routers (192.168.0.1 or 192.168.1.1)

Look for a section called DHCP, LAN Setup, or Local Network. The field will be labeled DNS Server, Primary DNS, or Name Server. Enter your AdGuard Home IP and save. Devices will receive the new DNS server on their next DHCP lease renewal — force it immediately by running ipconfig /renew on Windows or sudo dhclient -r && sudo dhclient on Linux.

DNS Rewrites for Local Hostnames

AdGuard Home doubles as a lightweight local DNS resolver. Instead of remembering IPs like 192.168.1.50, you can give your NAS a friendly name. Go to Filters > DNS rewrites > Add DNS rewrite:

Any device using AdGuard Home as its DNS server will now resolve these names. Use a .home or .lan suffix — avoid .local since that conflicts with mDNS/Bonjour.

Enabling DNS-over-HTTPS for Clients

If you want browsers and individual devices to use AdGuard Home over HTTPS (preventing even LAN-level snooping), go to Settings > Encryption Settings. You will need:

• A domain name pointing to your server (works with a local cert too)
• An SSL certificate — Let's Encrypt works if your server is reachable externally, or use a self-signed cert for internal use

Once configured, your DoH address will be https://<your-domain>/dns-query. Paste this into Firefox under Settings > Privacy > DNS over HTTPS > Custom for per-browser encrypted resolution.

Verifying the Setup Works

Before trusting AdGuard Home to handle all your DNS, run these tests from a client machine that has received the new DHCP settings:

In the AdGuard Home web UI, the Query Log (accessible from the top menu) shows every query in real time. You should see your test queries appear within seconds, with blocked domains shown in red and the reason listed as the matching blocklist name.

You can also use the DNS Lookup tool to check how public DNS servers resolve a domain versus what AdGuard Home returns — useful for comparing your filtered results against authoritative answers.

Common Problems and Fixes

Port 53 already in use

On Ubuntu and Debian systems, systemd-resolved listens on 127.0.0.53:53. Disable it before starting AdGuard Home:

Devices not using AdGuard Home

Devices with statically configured DNS (common on Chromebooks, some Android phones, and corporate laptops with MDM policies) will bypass DHCP-assigned DNS. On Android, disable Private DNS (Settings > Network > Advanced > Private DNS > Off) or point it at your AdGuard Home DoT address. For Windows: Settings > Network > Change adapter options > IPv4 Properties — set DNS to your AdGuard Home IP manually.

Too many false positives blocking legitimate sites

Use Filters > Custom filtering rules to whitelist specific domains. The syntax is simple:

Alternatively, in the Query Log, click on any blocked query and select Unblock to add it to your allowlist instantly.

High query latency

Check Settings > DNS Settings > Cache size. The default is 4MB. For a busy home network, bumping this to 16MB or 32MB significantly reduces upstream round trips. Also verify your upstream DoH/DoT servers respond quickly — switch from parallel to load-balanced mode and let AdGuard Home pick the fastest upstream automatically.

Keeping AdGuard Home Updated

AdGuard Home checks for updates automatically. When a new version is available, a notification appears in the web UI. Click Update and the binary updates and restarts in place — typically under 30 seconds of downtime. For Docker deployments, pull the latest image and recreate the container:

Filter lists update on a schedule you set under Filters > Update interval. A 12-hour or 24-hour interval is sufficient for most home use cases — no need to refresh every hour.

Final Thoughts

AdGuard Home delivers network-wide ad and tracker blocking with a level of visibility and control that default router firmware cannot match. The setup takes less than an hour from install to router configuration, and once it is running it is largely self-maintaining. The query log alone — showing you exactly which domains every device on your network is reaching out to — is worth the effort even if you never touched the blocklists. Start with the default lists, monitor for false positives over the first week, and tune from there.