This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.

For blocking, I would much rather run my own service.

I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!

Technitium is also really good as a performant local blocker and recursive dns server. I have been running mine for years now and it is fast as well.

How do you block ads when you're outside of your home network? Do you expose your pihole outside?

VPN back to your home network?

I've assumed the latency suffers then

You could set it up to only route DNS, but that might be complicated for most people

Yeah I have a VPN set up. I don't have the best internet so sometimes it's slow (mostly just app downloads seem to take the longest, so I'll just disable it and then re-enable it.) But it works just fine for streaming, including video

I set up a WireGuard VPN and use that to connect back to my home network. It's fast enough for what I do on my phone.

Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.

Maybe it’s time to try nym.com?

That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.

  > That's something people should run themselves. I run Adguard Home on my router. 

I'll second this. People should really be flashing their routers. OpenWRT is simple enough that if you're on HN I think you'll easily be able to do it. And like most routers, you set it up and forget it.

But you'll also get a bunch more benefits from OpenWRT, to make it worth your while.

  - I was able to buy a router for <$100 that was WiFi 7 capable (W1700K[0]) and had better hardware than most consumer routers. You can find plenty of cheaper routers that are flashable and more capable.
  - Adguard Home
  - Split tunneling/VLANs: Since we're talking Mullvad, you can put devices behind Mullvad on a VLAN. So activate Mullvad by changing SSIDs.
    - Trivial to put IOT devices on a VLAN (can make one directional too so you can access from your main network but they can't reach back. I throttle everything IOT)
  - Tailscale
  - QoS (Control the speed and prioritization of different connections)
  - It's a fucking computer, you can even run shell scripts

[0] You don't need something like this unless you're getting >1Gbps from your ISP. Big thing I wanted is the 2 10G ports.

It's probably the software I trust the most on my network to 'just work', and with the local caching I can use slower upstream dns providers and still have sub 1ms average latency (no performance worries by excluding google and cloudflare). I don't use it for dhcp, but it is a good fit that it's available as well. Couldn't be happier.

I use Mullvad's adblocking DNS server on my phone which is not always behind my home router.

If you're on Android, FF supports add-ons.

If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269...

There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/

It's not the same thing at all. Mullvad DNS blocks all ads across the system.

I've been using NextDNS [0] for a long time. It's worth the price because you can set up all kinds of different blocking profiles and have different ones on different devices, allows you to have overrides for local network items (or internals like on a Tailnet, Pangolin, Wireguard, etc) and a lot more. The ad blocking ends up working so well a lot not only are ads blocked on web pages but it works with some streaming audio ads as well as VoD that has ads injected. Highly recommend.

[0] https://nextdns.io

Up until the developers roll their host files into their app. That's why a pihole doesn't stop ads when you use the YouTube app.

Look, I still run AdGuard on my router, but it's not the same thing

Yes, I use Firefox on Android with ublock origin, it works great. But using adblocking DNS on your phone will also block most in-app ads which is a big quality of life improvement.

I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.

Really? I never found it effective unless I messed with certs on my phone.

For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.

For apps I always use revanced.

Ads from providers like Google AdMob and AppLovin are blocked. Apps could bundle their own DNS or DoH resolver or use hardcoded static IP addresses but in my experience most do not.

Youtube ads do not get blocked by DNS adblock because Youtube ads are served from the same domains as the content and thus DNS blocking would be counterproductive. I don't think it has anything to do with respecting DNS.

I don't have the Youtube app installed to test but the Internet suggests that at least in 2023 it was very possible to block the Youtube android app (content and all) via DNS, which hints it does not bypass system DNS. [1]

[1] https://superuser.com/questions/713289/blocking-youtube-andr...

FYI I don't see YouTube ads on Android + Firefox mobile + uBlock Origin

Are you explaining my comment or rebuting it? I really can't tell what the intent is. Maybe the internet has trained me poorly in thinking most replys are generally rebuttals. But it really does seems like you're just explaining my comment.

Mostly a clarification of what I find DNS ad blocking works for on Android, which seems to be somewhat different from your experience (probably we use different apps).

A weak rebuttal of the reason why DNS adblock doesn't work for Youtube and the Youtube app.

You can use NextDNS as your dns provider on your phone or use Rethink DNS app like me

The uBlock Origin lite that can run on iOS is very limited compared to the uBlock Origin that runs on Firefox Android.

Sure, but you're on iPhone. It's better than nothing.

I'm on your side but telling people to buy a new phone doesn't solve their problem. Short of that uBlock and/or Orion are their best options

I could, but DoH/DoT seems very involved to run yourself, and sometimes I need to give a recommendation to someone less tech-savvy.

I'd argue you don't need to run DoT/DoH yourself if it is just for your local network.

Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.

This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.

I stopped recommending anything I host myself for those people. When it breaks I'm the support team, and I'd rather not be. NextDNS free tier is what I give them now, takes two minutes, and I never hear about it again.

I've been using Control D and have been happy with it so far

My setup goes like this:

Fiber ONT -> Proxmox x86 -> OpenWRT -> Adguard Home -> unbound -> Quad9.

Browser: Firefox + ublock origin & privacy badger & strict privacy setting & Https-only.

My internet is rock solid and super fast, extra low latencies. OpenWRT shapes my traffic to 90% of line speeds, so zero bufferbloat on my end. All my devices connect to this setup. The proxmox box is just an old dual core mini-pc with 8gb ram and 2x 1gbps NIC's and a wifi 6 module for 2.3gbps wireless (only 5Ghz, no 2.4Ghz). I want to replace this box with a new one to get 2.5gb ethernet & better power efficiency as my box is a 51W cpu, but total powerdraw is about 20w without causing wifi to drop. Aggressive power saving can make wifi unstable.