AdGuard DNS on Linux: 7 Secure Setup Checks

AdGuard DNS on Linux works by sending your DNS lookups to AdGuard’s resolvers, where domain filtering can block many advertising, tracking, and malicious domains. Configure the network profile that actually controls DNS, account for IPv6, and check whether you also need encrypted DNS. Entering a resolver address alone does not encrypt the connection.

The seven checks below focus on one Linux computer: identify its resolver, make a recoverable change, verify the result, and keep a way back. This is a client-configuration guide, separate from installing AdGuard Home, AdGuard Ad Blocker, or AdGuard VPN. Most importantly, you will distinguish saved settings from temporary tests.

Setup	What it provides	Important limit
Public DNS addresses	Preset domain filtering	IP entry alone is unencrypted
Private DNS endpoint	Personal rules and query logs	Use your own device details
Encrypted DNS client	Protected DNS transport	Does not encrypt other traffic

Key Takeaways

• Change DNS settings, not your working IP address or gateway.
• Check the active connection and both address families before assuming coverage.
• A public resolver address does not attach requests to your private dashboard.
• Temporary resolvectl commands are a test, not a persistent installation.
• Test the browser and VPN separately, then repeat checks after reconnect and reboot.

You can use the public service without buying a subscription. Private AdGuard DNS is useful when you need device policies, custom filtering, or query logs. Affiliate disclosure: I may earn a commission if you buy through the AdGuard DNS links in this article, at no extra cost to you.

HackersGhost offer: 20% off a 1-year subscription.
Exclusive HackersGhost discount code HACKERSGHOST20. The link passes the code automatically; confirm that the discount appears at checkout before paying. AdGuard may occasionally run separate public promotions with similar pricing.

1. Identify who controls DNS on your Linux computer

Start AdGuard DNS on Linux by checking the network stack you already have. Ubuntu, Debian, Linux Mint, Fedora, Kali, and Parrot do not all ship the same resolver arrangement. A tutorial that assumes one service can overwrite settings managed by another.

cat /etc/os-release
nmcli --version
nmcli connection show --active
ls -l /etc/resolv.conf

These are discovery commands, not configuration changes. If nmcli is missing or NetworkManager does not manage your connection, skip the NetworkManager commands below. Use your distribution’s existing network configuration method rather than installing a second manager just to follow a tutorial.

The AdGuard website introduces the separate Linux products in its range. This guide uses your network manager to configure the DNS client. If your system also runs systemd-resolved, inspect its view of DNS with resolvectl status. An unavailable command is a compatibility clue, not a reason to disable networking services.

Before changing AdGuard DNS on Linux, record the original profile UUID, DNS entries, automatic-DNS flags, and search domains. A UUID identifies the connection profile; the interface name identifies the network device. They are different values and are not interchangeable in commands.

Make the first AdGuard DNS on Linux change from a local console. Reactivating a profile may interrupt SSH, downloads, meetings, or other sessions. On an employer-managed device or a network requiring internal DNS, obtain the appropriate configuration rather than replacing the organisation’s resolver with a public service.

With AdGuard DNS on Linux inside a VM, inspect the guest separately from the host. My lab includes Kali and Parrot in VMware, but this article does not claim a completed DNS benchmark there. A Windows host, virtual adapter, router, and guest can each introduce a different network setting.

2. Choose public filtering or your private DNS endpoint

Choose what AdGuard DNS on Linux should do before copying any address. The public default service applies preset filtering. Private AdGuard DNS adds account-based controls, including custom rules and query logs, when the device is connected using the correct dashboard instructions.

The public default IPv4 addresses are 94.140.14.14 and 94.140.15.15. Their IPv6 counterparts are 2a10:50c0::ad1:ff and 2a10:50c0::ad2:ff. These are the public filtering addresses used in the next example, not private device identifiers.

AdGuard also offers separate non-filtering and family-protection public services. Do not mix their addresses unintentionally. If one server follows a different policy, the result can look random even though both servers are working exactly as configured.

For private AdGuard DNS on Linux, add the Linux device in your dashboard and copy its current connection details. A personalised encrypted endpoint identifies the configuration you intend to use. Plain private DNS connection methods can require a linked public IP or another supported identification method.

Do not paste a private hostname from somebody else’s screenshot. Treat your device endpoint as configuration information worth keeping private: it can identify your filtering profile and affect how requests are attributed. Redact it when asking for public troubleshooting help.

Use the AdGuard DNS versus AdGuard Home comparison if you are deciding between a managed resolver and running a filtering server yourself.

AdGuard DNS vs AdGuard Home: 7 Smart Differences

For AdGuard DNS on Linux, keep the first configuration narrow: one computer, one intended policy, and one documented transport. More layers are useful only when you can explain which layer handles the lookup.

3. Save a recoverable NetworkManager DNS profile

For AdGuard DNS on Linux on a NetworkManager-managed desktop, make a separate test profile. The commands below clone your existing connection, leave the original available for rollback, and prevent the test clone from automatically taking over at boot.

Replace ORIGINAL_UUID with the UUID of your active Wi-Fi or Ethernet profile. Choose another test name if HG-AdGuard-DNS-test already exists. Use these examples only for an ordinary personal connection, not a specialised VPN, bridge, or managed corporate profile.

sudo nmcli connection clone uuid "ORIGINAL_UUID" "HG-AdGuard-DNS-test"
sudo nmcli connection modify "HG-AdGuard-DNS-test" connection.autoconnect no

The public AdGuard DNS on Linux example changes DNS-related properties without changing DHCP addressing, your gateway, or Wi-Fi credentials. It is a plain DNS baseline, not an encrypted-DNS configuration. If the cloned profile already requires encrypted DNS or has unusual DNS routing, stop and review that policy first.

sudo nmcli connection modify "HG-AdGuard-DNS-test" \
  ipv4.dns "94.140.14.14 94.140.15.15" \
  ipv4.ignore-auto-dns yes \
  ipv6.dns "2a10:50c0::ad1:ff 2a10:50c0::ad2:ff" \
  ipv6.ignore-auto-dns yes
sudo nmcli connection up "HG-AdGuard-DNS-test"

Apply the AdGuard DNS on Linux profile locally when a brief reconnection is acceptable. Each backslash continues the same command; it must be the final character on that line. Check for errors before continuing. If your profile has IPv6 disabled or an incompatible IPv6 method, do not enable it just to paste this example: configure the address family your connection actually uses.

The ignore-auto-dns properties stop automatically supplied resolvers and search domains from being merged into this profile’s DNS settings. Inspect local-name requirements before changing them. This profile-level change does not prevent another active connection, application, or VPN from selecting a different resolver.

After configuring AdGuard DNS on Linux, inspect nmcli device show and, where available, resolvectl status. A successful modify command proves the profile accepted settings. It does not prove the browser used them.

4. Test encrypted DNS without confusing it with filtering

AdGuard DNS on Linux can filter over ordinary DNS, but filtering and encryption solve different problems. DNS-over-TLS protects supported DNS traffic between the client and resolver. It does not turn DNS into a VPN or encrypt every connection your applications make.

On a machine already using systemd-resolved, the following is a temporary per-interface DNS-over-TLS test. Do not run it on a resolver stack that does not use this service. Close sensitive activity first and record the current interface configuration.

Replace YOUR_INTERFACE with the active interface name, such as the actual value shown by your system. The example uses public default filtering with the documented TLS server name. Keep the quoted address and hostname together.

sudo resolvectl dns YOUR_INTERFACE \
  "94.140.14.14#dns.adguard-dns.com" \
  "94.140.15.15#dns.adguard-dns.com"
sudo resolvectl dnsovertls YOUR_INTERFACE yes
sudo resolvectl domain YOUR_INTERFACE "~."
resolvectl status YOUR_INTERFACE

Here, yes requires TLS for that interface’s resolver, while the hostname enables server-name verification. Opportunistic mode can fall back to unencrypted resolution, so it is a different policy. The route-only domain ~. prefers this link for general DNS; more specific routes and other resolver paths still require attention.

Do not present this AdGuard DNS on Linux test as persistent. NetworkManager can reapply its profile settings, and reconnecting or rebooting can remove runtime changes. Revert the test afterwards with sudo resolvectl revert YOUR_INTERFACE, then reactivate the intended saved profile.

For lasting encrypted AdGuard DNS on Linux, select a persistent method supported by your distribution. NetworkManager’s DNS-over-TLS property requires a compatible DNS plugin and correct server identity configuration; setting a property on an unsupported backend has no effect. The systemd project publishes its resolver source and development resources on GitHub.

An alternative: the separate AdGuard DNS CLI

AdGuard DNS CLI is a local DNS forwarder with encrypted-upstream support. It is separate from AdGuard VPN CLI and AdGuard Ad Blocker CLI. AdGuard documents downloading the appropriate official release, installing its service, editing the generated configuration, and starting it.

Before choosing that persistent route for AdGuard DNS on Linux, inspect the generated configuration and current release instructions. Verify the localhost listener, encrypted upstream, bootstrap and fallback settings, service startup, and which operating-system component forwards requests to it. Merely starting a local daemon does not redirect every application.

Keep a workstation-only listener bound to loopback and check for an existing port conflict before changing services. A local encrypted forwarder is a separate deployment choice, not another command to paste on top of every working resolver. This guide does not supply a universal service configuration for all distributions.

5. Verify IPv6, browser DNS, and VPN overrides

AdGuard DNS on Linux needs checking at the application boundary. The desktop can show one resolver while a browser uses its own DNS-over-HTTPS provider. A VPN can also push DNS settings or route private namespaces through a tunnel.

• Check the active Wi-Fi or Ethernet profile, including IPv6 DNS information.
• Inspect browser Secure DNS or DNS-over-HTTPS settings and note the selected provider.
• Test with the VPN disconnected, then connected, without changing several other settings.
• Compare an ordinary system lookup with a browser request made under the same conditions.
• Repeat after network switching, not only immediately after editing the profile.

Do not disable browser privacy features automatically to make AdGuard DNS on Linux appear successful. Choose a consistent policy: use your intended encrypted provider in the browser where supported, or deliberately let the browser use the system resolver. Record exceptions instead of hiding them.

Keep VPN-specific DNS requirements intact when they resolve private services or prevent DNS from escaping the tunnel. If you need a custom resolver inside a VPN, use the VPN’s documented support. A router VPN, host VPN, and guest VPN can make “where did this query go?” a surprisingly layered question.

The DNS and WebRTC leak-checking guide explains how to interpret browser evidence without treating every unfamiliar address as a leak.

DNS Leak Test: 7 Smart DNS and WebRTC Checks

For AdGuard DNS on Linux, IPv6 connectivity and DNS transport are related but different. A computer can resolve IPv6 website addresses through an IPv4 DNS server. The important question is which resolver receives the queries, not whether every answer contains an IPv4 address.

6. Confirm resolver use and filtering separately

Validate AdGuard DNS on Linux with a few repeatable observations. First check that ordinary resolution works. Then inspect the selected resolver and test filtering against a harmless domain or a rule you control. Do not visit a live malicious website to prove a blocklist exists.

getent ahosts example.com
resolvectl query example.com

The first command uses the system’s configured name-service mechanisms; local files or caches may contribute. The second applies only where systemd-resolved is active. A successful answer demonstrates resolution for that lookup, not that every application follows the same path.

A common trap with AdGuard DNS on Linux is a direct test such as dig @94.140.14.14 example.com. That explicitly selects AdGuard for one query. It can test reachability to that server, but it does not establish that the computer’s default resolver changed.

A local address such as 127.0.0.53 can represent a resolver stub. Do not replace it solely because you expected a public IP in /etc/resolv.conf. Inspect the upstream configuration before deciding whether the stub is forwarding correctly.

For private AdGuard DNS on Linux, create a temporary block rule for a harmless domain you control or an appropriate test domain. Generate a new request, inspect its device attribution in the query log, remove the rule, and verify recovery. Record time and domain so that an unrelated background lookup does not get mistaken for your test.

Caches can delay visible AdGuard DNS on Linux changes. Where systemd-resolved is in use, sudo resolvectl flush-caches clears its cache; application caches may remain. Do not repeatedly alter working DNS settings because a previously loaded page continues to display.

Use the broader AdGuard DNS testing guide for filtering diagnostics and dashboard checks.

AdGuard DNS Test: 7 Powerful Checks for Better Privacy

Finally, AdGuard DNS on Linux cannot reliably remove ads served from the same hostname as wanted content or perform browser cosmetic filtering. Remaining page space or first-party advertising is not, by itself, evidence that the resolver configuration failed.

7. Prove persistence and keep a rollback path

Finish AdGuard DNS on Linux by checking what survives. The test NetworkManager profile is saved, but autoconnect is disabled deliberately. The resolvectl overrides are runtime tests. A local DNS service needs both a persistent configuration and a verified startup arrangement.

Reconnect the chosen profile, repeat the checks, and then reboot when convenient. Confirm which profile became active. If you want the test profile to become your everyday default, make that a deliberate profile-management decision after successful checks; do not assume the original profile disappeared.

To undo the NetworkManager experiment, reactivate the original UUID. This restores that profile’s recorded settings rather than inventing a generic “factory default” that might not match your network.

sudo nmcli connection up uuid "ORIGINAL_UUID"

If you applied temporary resolved settings for AdGuard DNS on Linux, revert those interface overrides as described earlier. If you deployed a local DNS forwarder, restore the operating system’s upstream settings before stopping it. Otherwise applications may continue querying a localhost service that no longer runs.

If pages fail after the change, restore the original working configuration first, then investigate the failing stage: connectivity, resolver reachability, TLS, browser override, or filtering rule. Preserve the error and relevant settings privately. Do not disable the firewall or certificate verification as a general troubleshooting shortcut.

A useful AdGuard DNS on Linux handover note records the profile, transport, intended policy, verification steps, and rollback. That is more useful than a screenshot containing only a green status indicator. Future you should not have to reverse-engineer today’s enthusiasm.

HackersGhost Note: Keep the configuration you can explain and reverse. A DNS change should leave you with a clear traffic policy and a repeatable check, not a mystery collection of resolver files and background services.

Do you need private DNS for a Linux computer?

Public filtering can be enough for a simple AdGuard DNS on Linux setup. Private DNS becomes useful when individual device rules, exceptions, and query logs help you manage real needs. Check current plan limits and privacy settings before buying; logging detail is also data you should protect.

If those controls suit your setup, use the confirmed HackersGhost Pretty Link below. The supplied affiliate offer is 20% off a one-year subscription with HACKERSGHOST20. The link includes the code, but verify the final discount and renewal terms at checkout rather than assuming offers stack.

HackersGhost offer: 20% off a 1-year subscription.
Exclusive HackersGhost discount code HACKERSGHOST20. The link passes the code automatically; confirm that the discount appears at checkout before paying. AdGuard may occasionally run separate public promotions with similar pricing.

Conclusion: choose one policy and verify it

AdGuard DNS on Linux is most useful when resolver choice, filtering, and encryption are treated as separate checks. Identify the active manager, preserve your working profile, configure the intended service, and inspect the result in the applications you use.

Your first action is to record the current connection and its DNS settings. Then test AdGuard DNS on Linux on one recoverable machine. Keep the change only when you can show where requests go, what survives a restart, and how to restore the earlier working state.

AdGuard DNS on Linux FAQ