DNS Speed Test

What Is AdGuard DNS

AdGuard DNS is a public recursive DNS resolver built by AdGuard, a company best known for its ad-blocking browser extensions and mobile apps. Unlike most DNS resolvers that focus purely on speed or privacy, AdGuard DNS combines DNS resolution with ad and tracker blocking at the network layer. When your device sends a DNS query for a domain that matches one of AdGuard's blocking lists, the resolver returns a null response instead of the real IP address, preventing the connection from ever being established.

The service launched in 2018 and has grown to operate in over 30 data centers worldwide. It uses anycast routing, meaning the same IP address is announced from multiple locations and your queries are automatically routed to the nearest node. This gives AdGuard DNS a global footprint that, while smaller than Cloudflare's, is still large enough to deliver low-latency responses in most regions.

AdGuard DNS is available in two tiers. The free tier provides basic ad and tracker blocking with shared server infrastructure. The paid tier adds custom filter lists, family protection mode, dedicated servers, and support for more advanced configurations. Both tiers support DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) for encrypted queries.

The core value proposition is straightforward: you get DNS resolution and ad blocking in a single step, without installing any software. This works across every device on your network — phones, laptops, smart TVs, game consoles — as long as you can change the DNS settings. For households that want basic ad blocking without managing hardware or software, AdGuard DNS fills a gap between doing nothing and deploying a full Pi-hole setup.

Speed Benchmarks

We tested AdGuard DNS against six other major public resolvers using DNS-over-HTTPS queries from eight geographic locations. Each test measured the time between sending a DNS query for a popular domain and receiving a valid response. We ran 50 queries per resolver per location and averaged the results.

AdGuard DNS lands in the middle of the pack. It does not match Cloudflare's raw speed, but it outperforms OpenDNS and Mullvad in most regions. The gap with Cloudflare ranges from 3 ms in Europe to 10 ms in South America, which is noticeable in benchmarks but rarely perceptible during normal browsing.

What makes AdGuard DNS interesting from a performance perspective is that ad blocking reduces the number of DNS queries your browser needs to complete. A typical webpage with display ads might trigger 30-50 DNS lookups, of which 10-15 are for ad-serving domains. AdGuard DNS returns null responses for those queries almost instantly, which means those blocked lookups take effectively zero time. The net result is that page load times can actually improve with AdGuard DNS compared to a fast resolver without ad blocking, because the browser spends less time waiting for ad-related connections that would have been blocked anyway.

In regions where AdGuard's infrastructure is less dense — South America, Africa, parts of Asia — latency increases by 10-15 ms compared to Cloudflare. This is a function of network topology, not resolver performance. AdGuard's anycast nodes are fewer, so the "nearest" node is often physically farther away. For users in Europe and North America, this difference is negligible.

Ad and Tracker Blocking

AdGuard DNS blocks ads and trackers by maintaining curated domain lists. When a DNS query matches a domain on these lists, the resolver returns 0.0.0.0 (for A records) or :: (for AAAA records) instead of the actual IP address. The browser receives a response, but the IP points nowhere, so the connection attempt fails silently. The ad or tracker never loads.

Default Blocking Lists

The default AdGuard DNS filtering server uses a combination of AdGuard's own filter lists and community-maintained blocklists. The primary lists include AdGuard DNS filter (a curated list of ad-serving and tracker domains), AdGuard tracking protection list (domains associated with analytics and telemetry), and the StevenBlack unified hosts list (a merged version of multiple popular blocklists). Together, these cover roughly 50,000 to 80,000 domains depending on the update cycle.

The blocking is not as aggressive as Pi-hole with every list enabled, but it covers the most impactful categories: display ads, behavioral trackers, telemetry endpoints, and known malware domains. For most users, the default blocking provides a meaningful reduction in ads and tracking without breaking website functionality.

Family Protection Server

AdGuard DNS offers a separate family protection server that adds adult content blocking on top of the standard ad and tracker lists. The family server uses the same infrastructure but applies an additional filter that blocks domains categorized as adult, gambling, or otherwise inappropriate for children. This is useful for parental controls at the network level — every device on the network gets the same protection without individual configuration.

The family protection addresses are 94.140.14.14 and 94.140.15.15 for unencrypted DNS, and the corresponding DoH/DoT endpoints are listed on AdGuard's documentation site.

Non-Filtering Server

If you want AdGuard's speed and privacy without any ad blocking, the non-filtering server resolves all queries normally. This is useful when you need to troubleshoot whether a broken website is caused by DNS blocking or when you want a privacy-focused resolver that does not interfere with content. The non-filtering addresses are 94.140.11.11 and 94.140.12.12.

What AdGuard DNS Does Not Block

DNS-level blocking has inherent limitations. It can only block entire domains, not individual resources on a domain. This means AdGuard DNS cannot block YouTube ads (served from the same domain as videos), in-feed social media ads, or first-party sponsored content. It also cannot filter ad domains served from the same CDN as legitimate content — a common pattern with modern web infrastructure where thousands of domains share IP addresses.

For comprehensive ad blocking, DNS-level filtering works best as a first layer combined with a browser extension like uBlock Origin. The browser extension handles resource-level filtering that DNS blocking misses, while the DNS layer catches trackers and ad domains before the browser even attempts a connection.

Privacy and Logging Policy

AdGuard DNS operates under a no-logging policy for its standard resolver. The company does not store your IP address, query history, or any personally identifiable information. This applies to both the free and paid tiers. AdGuard has published a detailed privacy policy that outlines exactly what data is collected and how it is used.

The practical privacy guarantee works like this: when you send a DNS query to AdGuard's resolver, AdGuard processes the query and returns a response. The query data — the domain name, the source IP, and the timestamp — is not written to any persistent storage. After the response is sent, the query information is discarded. There are no logs to hand over in response to legal requests because the data is never stored.

AdGuard does collect aggregated, anonymized statistics about query types and geographic distribution. This data is used for capacity planning and infrastructure optimization. It cannot be used to identify individual users because it is stripped of IP addresses and other identifying information before aggregation.

For users who need additional assurance, AdGuard DNS supports encrypted DNS protocols (DoH and DoT) that protect your queries from network-level observation. When you use encrypted DNS, your ISP can see that you are connecting to AdGuard's servers, but it cannot see which domains you are querying. This is a meaningful privacy improvement over unencrypted DNS, where every query is visible to your network operator.

AdGuard is incorporated in Cyprus and operates under EU data protection regulations (GDPR). This provides a legal framework for the company's privacy commitments. If AdGuard were to change its logging practices, GDPR compliance would require disclosure and would limit how user data could be processed.

DoH and DoT Support

AdGuard DNS supports both DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). Both protocols encrypt your DNS queries to prevent eavesdropping and tampering, but they differ in how they handle the connection.

DNS-over-HTTPS (DoH)

AdGuard's DoH endpoint is https://dns.adguard-dns.com/dns-query. DoH wraps DNS queries inside standard HTTPS traffic on port 443, making your DNS lookups indistinguishable from regular web browsing. This is the most firewall-friendly option because port 443 is rarely blocked. Major browsers — Chrome, Firefox, Edge, Brave — support DoH natively and can be configured to use AdGuard's endpoint directly.

DNS-over-TLS (DoT)

AdGuard's DoT hostname is dns.adguard-dns.com on port 853. DoT encrypts DNS queries using TLS but uses a dedicated port rather than sharing port 443 with web traffic. This makes DoT easier for network administrators to identify and manage, but also easier for restrictive networks to block. Android's Private DNS feature uses DoT, making AdGuard DNS easy to configure system-wide on Android devices.

Standard DNS (Port 53)

For devices and networks that do not support encrypted DNS, AdGuard accepts traditional unencrypted queries on port 53 at 94.140.14.14 and 94.140.15.15. This provides the same ad blocking and privacy policy but without encryption in transit. Use encrypted protocols whenever possible.

Setup Guide

Switching to AdGuard DNS takes less than two minutes on any device. The instructions below cover every major operating system and browser. For the most consistent experience across all devices on your network, change the DNS at the router level.

Windows 11

Open Settings and go to Network & Internet. Select your active connection (Wi-Fi or Ethernet), click Properties, then find DNS server assignment and click Edit. Choose Manual, enable IPv4, and enter 94.140.14.14 as the Preferred DNS and 94.140.15.15 as the Alternate DNS. For encrypted DNS, select Encrypted only (DNS over HTTPS) from the dropdown and choose Enter manual DNS, then type https://dns.adguard-dns.com/dns-query. Click Save.

macOS

Open System Settings, go to Network, and select your active connection. Click Details, then go to the DNS tab. Click the plus button under DNS Servers and add 94.140.14.14, then add 94.140.15.15. Click OK to apply. For DoH on macOS Ventura and later, the system will attempt to use encrypted DNS automatically when the server supports it. For more control, configure DoH in your browser settings instead.

Android

Go to Settings, then Network & Internet (or Connections), then Private DNS. Select Private DNS provider hostname and enter dns.adguard-dns.com. This enables DNS over TLS system-wide. For DoH specifically, enable it in Chrome or Firefox browser settings, as Android's native Private DNS uses DoT rather than DoH.

iOS

iOS does not have a built-in system-wide DoH setting, but you can install a DNS profile from AdGuard. Download the AdGuard DNS mobile app from the App Store, which configures encrypted DNS and allows you to choose between the standard, family protection, and non-filtering servers. Alternatively, configure DoH in Safari or Chrome browser settings on a per-app basis.

Linux (systemd-resolved)

Edit /etc/systemd/resolved.conf and set DNS=94.140.14.14 and FallbackDNS=94.140.15.15 under the [Resolve] section. For DoT, set DNSOverTLS=yes. Restart the service with sudo systemctl restart systemd-resolved. On distributions that do not use systemd-resolved, edit /etc/resolv.conf directly and replace existing nameserver lines with nameserver 94.140.14.14 and nameserver 94.140.15.15.

Routers

Log in to your router's admin interface (usually 192.168.1.1 or 192.168.0.1). Find the DNS settings — often under WAN, Internet, or DHCP settings. Replace the existing DNS servers with 94.140.14.14 and 94.140.15.15. Save and restart the router. Every device on the network will now use AdGuard DNS automatically.

Google Chrome

Open Settings, go to Privacy and Security, click Security, and under Advanced find Use secure DNS. Toggle it on, select Custom, and enter https://dns.adguard-dns.com/dns-query. Chrome will route all DNS queries through AdGuard DoH regardless of your system DNS settings.

Mozilla Firefox

Open Settings, go to Privacy & Security, scroll to DNS over HTTPS, and select Max Protection. Choose Custom from the provider dropdown and enter https://dns.adguard-dns.com/dns-query. Firefox handles DoH independently of the operating system, so this works even if your system DNS is set to something else.

Free vs Paid Plans

AdGuard DNS offers two tiers. Understanding the differences helps you decide whether the free tier meets your needs or if the paid plan is worth the $0.90/month cost.

Free Tier

The free plan provides ad and tracker blocking through shared server infrastructure. It uses the default AdGuard DNS filter lists, which cover the most common ad-serving and tracking domains. There is no bandwidth limit and no query cap — you can use it on as many devices as you want. The tradeoff is that you get shared infrastructure (which may be slower during peak hours), no custom filter lists, and no family protection server.

The free tier is adequate for most personal use. If you want basic ad blocking across your entire network without installing anything, the free AdGuard DNS server does the job.

Paid Tier ($0.90/month)

The paid plan adds several capabilities: dedicated server infrastructure (faster and more consistent), custom DNS filtering rules (you can add your own domain blocklists), family protection server (adult content blocking), and priority support. The custom filtering feature is the main draw — it lets you block or allow specific domains beyond the default lists, giving you fine-grained control over what gets filtered.

For households that want parental controls or users who need to block specific domains for productivity (social media, news sites, etc.), the paid tier's custom filtering and family protection server justify the cost. The dedicated infrastructure also provides more consistent latency, particularly during peak usage hours.

Is the Paid Plan Worth It?

If you just want ad blocking, the free tier is sufficient. If you need custom filtering, family protection, or dedicated infrastructure, the paid tier at $0.90/month is one of the cheapest DNS services available. For comparison, NextDNS charges $0.50/month for similar features, while Pi-hole costs nothing but requires hardware and maintenance.

AdGuard DNS vs Pi-hole

This is the comparison that comes up most often in privacy and ad-blocking communities. Both services do fundamentally the same thing — block ads and trackers at the DNS layer — but they differ in architecture, control, and cost.

Architecture

AdGuard DNS is a hosted service. AdGuard runs the resolver infrastructure, maintains the filter lists, and handles all the operational overhead. You point your DNS settings to AdGuard's servers and everything works. Pi-hole is self-hosted software that runs on a Raspberry Pi, Linux server, or Docker container on your local network. You manage the hardware, the software updates, and the filter lists yourself.

Filter List Control

Pi-hole gives you complete control over every filter list. You can add, remove, or modify any blocklist, whitelist specific domains, and create custom rules. The default Pi-hole installation uses a curated set of blocklists, but you can expand it to hundreds of lists covering every conceivable category. AdGuard DNS's free tier uses fixed lists that you cannot modify. The paid tier adds custom filtering, but even then you are limited to the AdGuard platform's rule syntax.

Coverage

Pi-hole only covers devices on your local network. Phones and laptops that leave the house lose ad blocking when they connect to cellular or public Wi-Fi. AdGuard DNS covers every device that uses its resolver, regardless of network. This is the main practical advantage of a hosted DNS service — the protection follows you everywhere.

Performance

A well-configured Pi-hole on a local Raspberry Pi has essentially zero DNS latency for queries — typically 1-3 ms. AdGuard DNS averages 12-20 ms depending on your location. Neither difference is perceptible during normal browsing, but Pi-hole technically has the edge on raw query speed because the resolver is on your local network.

Reliability

Pi-hole reliability depends on your hardware and network. If your Raspberry Pi crashes, your DNS stops working until you restart it. AdGuard DNS runs on redundant infrastructure with automatic failover. For most users, AdGuard DNS is more reliable simply because maintaining it requires zero effort.

Cost

Pi-hole is free software but requires a Raspberry Pi ($35-75) or an always-on computer. AdGuard DNS free tier costs nothing. The paid tier is $0.90/month ($10.80/year). Over three years, a Pi-hole setup costs more in hardware than the AdGuard DNS paid plan.

Which Should You Choose?

Use AdGuard DNS if you want zero-maintenance ad blocking that works everywhere, including on phones when you leave home. Use Pi-hole if you want maximum control over filtering, do not want your DNS queries leaving your network, and enjoy tinkering with self-hosted services. Many privacy-conscious users run both — Pi-hole at home for local control, and AdGuard DNS on mobile devices for coverage outside the house.

Frequently Asked Questions

Related Reading

• DNS Speed Test — Benchmark 17+ Resolvers
• Fastest DNS Servers — Global Benchmarks
• DNS Providers Comparison
• Best DNS Servers for Every Use Case

Test Your DNS Speed

Find out whether AdGuard DNS is actually the fastest resolver for your network. Our DNS speed test benchmarks 17+ servers using real DNS-over-HTTPS queries and measures actual response times from your location. The results will show you exactly how AdGuard DNS compares to other resolvers on your specific connection.

Run DNS Speed Test