AdGuard DNS Test: 7 Powerful Checks for Better Privacy

An AdGuard DNS test should answer one basic question: is your device actually using AdGuard DNS, and is the filtering doing what you expect? That sounds straightforward, but DNS can become surprisingly messy once browsers, VPNs, routers, IPv6, encrypted DNS, and device-specific settings all start making decisions of their own.

That is why my AdGuard DNS test goes further than checking whether a few advertisements disappear. I want to confirm the resolver path, see whether blocked domains are really being filtered, verify encrypted DNS where applicable, and check whether a browser or VPN quietly bypasses the configuration.

This guide uses seven practical checks. The AdGuard DNS test covers resolver verification, filtering, encrypted connections, browser and VPN overrides, query logging, custom rules, and router-level deployment. I also look at the difference between free and paid service and where DNS filtering fits into a wider security setup.

If you searched for an AdGuard DNS review, is AdGuard DNS free, does AdGuard DNS work, or how to test if AdGuard DNS is working, this article combines those questions around one practical workflow rather than treating DNS as a mysterious checkbox.

AdGuard DNS test	What you verify	Why it matters
Resolver path	Your device really uses AdGuard DNS	Browsers, VPNs, and DHCP can override DNS
Filtering	Blocked domains are handled correctly	Confirms the policy is actually active
Private DNS	Logs, devices, and rules behave correctly	Shows whether extra management adds value

Affiliate disclosure: AdGuard is an affiliate partner of HackersGhost. If Private AdGuard DNS fits your setup, the button below takes you to my sponsored AdGuard DNS offer. I may earn a commission without increasing your price.

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically. AdGuard may occasionally run separate public promotions with similar pricing.

Key Takeaways From My AdGuard DNS Test

• A useful AdGuard DNS test starts by confirming the DNS resolver path instead of judging the setup from visible ads alone.
• The public AdGuard DNS IPv4 addresses for Default filtering are 94.140.14.14 and 94.140.15.15.
• An AdGuard DNS test should include browser and VPN checks because both can override DNS supplied by the router.
• AdGuard DNS supports encrypted DNS through DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC.
• Private AdGuard DNS adds device management, filtering rules, statistics, query logs, security filtering, and parental controls.
• A good AdGuard DNS test also confirms that custom rules can be reversed without breaking normal browsing.
• AdGuard DNS free is enough to test the platform, while Personal mainly adds more capacity and management room.
• The AdGuard DNS test should be treated as one security-layer check, not proof that antivirus, VPN, browser security, or segmentation are no longer needed.

How to Run an AdGuard DNS Test: 7 Practical Checks

The biggest mistake when running an AdGuard DNS test is starting with the result you expect. Ads disappear, therefore everything works. Ads remain, therefore AdGuard DNS failed. Neither conclusion is reliable on its own.

A proper AdGuard DNS test works from the network path outward. First confirm which resolver receives the request. Then verify filtering. After that, investigate encrypted DNS, browser overrides, VPN behavior, custom rules, and router-level deployment.

1. Start the AdGuard DNS Test by Confirming the Resolver

The first step in every AdGuard DNS test is confirming that your device is actually sending DNS requests to the resolver you configured.

This is more important than it sounds. Your router may advertise one resolver through DHCP while Windows, Linux, Android, or another operating system has a manual configuration. A browser can also use its own DNS-over-HTTPS provider, while a VPN may replace the normal resolver as soon as the tunnel connects.

If you use Private AdGuard DNS, generate normal browsing traffic and open the Query Log. A useful AdGuard DNS test should produce fresh requests from the test device or from the server configuration associated with that device.

If no traffic appears during the AdGuard DNS test, check whether the device is really attached to the expected configuration before touching the filters.

• Check browser Secure DNS or DNS-over-HTTPS settings.
• Check whether a VPN is active and supplying DNS through the tunnel.
• Check the operating system for manually configured DNS values.
• Check which resolver the router advertises through DHCP.
• Check IPv6 as well as IPv4.

HackersGhost Note: My AdGuard DNS test rule is simple: a green toggle is not proof of a network path. Logs and repeatable behavior beat optimistic interface design.

2. Use the AdGuard DNS Test to Verify Filtering

Once the resolver path is confirmed, the second AdGuard DNS test checks whether filtering rules actually affect DNS requests.

Browse normally and watch the Private DNS Query Log. Depending on your enabled filters, you should see permitted requests mixed with domains that were blocked. This is much more useful than deciding that the AdGuard DNS test succeeded because one banner vanished.

DNS filtering operates on hostnames and domains. It does not understand the visual structure of a webpage. If an advertising network uses a dedicated hostname, the resolver may block it. If the advertisement comes from the same hostname as wanted content, DNS cannot neatly remove only the unwanted part.

For that reason, my AdGuard DNS test looks for blocked DNS requests rather than perfect cosmetic page cleanup.

3. Include Encrypted DNS in the AdGuard DNS Test

An AdGuard DNS test should also distinguish between plain DNS and encrypted DNS. AdGuard supports DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC.

These protocols protect DNS traffic in transit between your device and the resolver. That can prevent a casual observer on the local network from simply reading DNS requests in plain text.

During an AdGuard DNS test, however, remember that encrypted DNS does not make the resolver itself blind. AdGuard still has to process the DNS request in order to answer it.

Encrypted DNS also does not hide your public IP address from websites. That requires VPN routing rather than DNS resolution. If IP masking and encrypted tunnel routing are what you need, AdGuard VPN is the separate product for that job.

HackersGhost Note: During any AdGuard DNS test, I ask the boring question that marketing pages often skip: encrypted between which two points, and what can each endpoint still see?

Man in the Middle Attacks Explained: How Attackers Intercept Traffic

Man in the Middle Attacks Explained: How Attackers Intercept Traffic 🧠

4. Check Browser and VPN Overrides During the AdGuard DNS Test

This part of the AdGuard DNS test catches one of the most common causes of confusing results. Your router can be configured correctly while an application quietly uses another resolver.

Modern browsers may enable Secure DNS or DNS-over-HTTPS. That means browser requests can bypass the DNS settings supplied by Windows, Linux, Android, or the router.

A VPN introduces another layer. Many VPN services supply their own DNS resolver through the encrypted tunnel. During an AdGuard DNS test, that does not automatically indicate a problem. It may be intentional leak protection.

In my own lab, I use a Cudy WR3000 with Proton VPN over WireGuard. When I run an AdGuard DNS test while that VPN is active, I first establish which DNS path Proton intends to use. I do not force another resolver outside the tunnel simply because I want the AdGuard dashboard to light up.

The goal of the AdGuard DNS test is understanding the DNS route, not forcing every security product to fight over ownership of it.

5. Use the Query Log as an AdGuard DNS Tester

The Query Log is one of my favorite tools during an AdGuard DNS test because it turns filtering into something observable.

I browse normally, open applications, and then inspect recent DNS activity. If a legitimate feature breaks during the AdGuard DNS test, the log can help identify a blocked dependency instead of forcing me to disable every filter at once.

A practical troubleshooting workflow looks like this:

• Find the blocked request in the Query Log.
• Identify which device generated it.
• Check whether the hostname makes sense for the broken feature.
• Temporarily allow the likely dependency.
• Repeat the AdGuard DNS test and reload the affected service.

This gives the AdGuard DNS test an actual troubleshooting purpose instead of turning the blocked-request counter into a high score.

6. Add and Reverse a Rule During the AdGuard DNS Test

One of the cleanest ways to test if AdGuard DNS is working is to create a temporary rule for a harmless hostname you control or do not need during the experiment.

Add the rule, repeat the AdGuard DNS test, and confirm that the request is blocked. Then remove or override the rule and verify that the hostname resolves again.

I deliberately test both directions because blocking is only half the story. A useful DNS platform should also make recovery predictable when a rule causes trouble.

If the AdGuard DNS test works when adding the rule but behaves unpredictably after the rule is removed, clear relevant caches and repeat the request before blaming the resolver.

7. Compare Router and Device Results in the AdGuard DNS Test

The final AdGuard DNS test compares device-level configuration with router-level DNS.

Router-level DNS is useful because it can cover smart TVs, consoles, IoT devices, and other hardware where installing dedicated filtering software may be impossible or inconvenient.

But the AdGuard DNS test should confirm that router DNS really applies to the device. An operating system can use manual DNS, a browser can use DoH, a VPN can provide another resolver, and IPv6 can create a second DNS path if only IPv4 was configured.

I normally run the AdGuard DNS test directly on one computer and compare it with another device relying entirely on the router. If both produce the expected requests and filtering behavior, the router-level configuration becomes much easier to trust.

What Is AdGuard DNS?

AdGuard DNS is a DNS resolver with optional filtering. DNS normally translates a domain name into the network address your device needs to reach that destination.

A filtering resolver adds another decision before returning the answer. If the hostname matches an active advertising, tracking, phishing, scam, malicious-domain, parental-control, or custom filtering rule, the resolver can block or alter the response.

This is why an AdGuard DNS test can show filtering on devices that do not have a browser extension installed. The filtering decision happens at DNS resolution rather than inside the webpage.

That wider reach is useful, but it also explains the limitations seen during an AdGuard DNS test. DNS understands domains. It does not understand every object inside a webpage.

HackersGhost Note: My AdGuard DNS test analogy is a receptionist with a deny list. The receptionist can refuse to give you directions to a known bad address. They do not follow you inside, inspect every room, and quarantine a suspicious ZIP file.

Public AdGuard DNS Server Addresses

AdGuard provides Default, Family Protection, and Non-filtering public resolver profiles.

The standard public IPv4 addresses for Default filtering are:

• 94.140.14.14
• 94.140.15.15

The Default resolver blocks many advertising, tracking, phishing, and malicious-domain requests according to the active AdGuard filtering policy. Family Protection adds adult-content filtering and Safe Search features where supported.

The Non-filtering profile is especially useful during an AdGuard DNS test. It gives you a comparison point when a site or application behaves differently under filtering.

AdGuard also publishes IPv6 addresses and encrypted DNS endpoints. I always check the current official configuration before changing router infrastructure. DNS addresses deserve slightly more respect than a random value copied from a forum post written during the age of Internet Explorer.

7 Features My AdGuard DNS Test Evaluates

1. Network-Level Ad and Tracker Filtering

The obvious feature to examine in an AdGuard DNS test is domain-level advertising and tracker blocking.

Advertising networks, analytics platforms, telemetry services, and tracking systems often use dedicated hostnames. If a hostname matches an active filter, AdGuard DNS can prevent normal resolution.

The benefit is reach. A single DNS policy can affect browsers, mobile apps, smart televisions, consoles, and other connected devices.

The limitation becomes obvious during the AdGuard DNS test. DNS cannot surgically remove one object from a page when the wanted content and the advertisement come from the same hostname.

2. Public and Private DNS

You can perform an AdGuard DNS test without buying anything. The public DNS resolvers provide a simple way to try Default, Family Protection, or Non-filtering behavior.

Private AdGuard DNS adds your own configurable servers, connected devices, filtering controls, custom rules, statistics, and Query Log.

That difference matters because a private AdGuard DNS test gives you visibility into what the devices are actually requesting rather than only showing the final browser result.

3. Encrypted DNS

AdGuard DNS supports DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC. These encrypted protocols protect queries between the client and resolver.

When I include encryption in an AdGuard DNS test, I keep the threat model realistic. Encrypting DNS traffic protects that connection. It does not turn DNS into a complete privacy tunnel.

Websites can still see the network connection that reaches them, which is why a VPN solves a different problem.

4. Blocklists and Custom Rules

Private AdGuard DNS supports additional filter lists and custom rules. That gives an AdGuard DNS test more depth than a fixed public resolver can provide.

I can tighten filtering for one environment without forcing the same policy onto every device. That is especially useful when one device needs stricter blocking while another depends on domains that would otherwise trigger false positives.

A custom rule is also one of the easiest controlled experiments to include in an AdGuard DNS test because you know exactly what result to expect.

5. Statistics and Query Logs

Private DNS statistics and Query Log make an AdGuard DNS test much easier to interpret.

Instead of seeing only that a page behaved differently, you can inspect which domains were requested and whether AdGuard DNS allowed or blocked them.

This is particularly valuable during troubleshooting. If a login form, video player, payment widget, or embedded resource stops working, I can repeat the AdGuard DNS test while watching recent blocked requests.

I also avoid unnecessary logging. If a specific diagnostic detail is not useful for the AdGuard DNS test, I see no reason to collect it simply because a checkbox exists.

6. Security Filtering

Security filtering can block known malicious, phishing, scam, and other risky domains. I include this behavior in an AdGuard DNS test, but I do not treat it as antivirus.

Reputation systems have limits. A newly created malicious domain may not be classified immediately, and a legitimate domain can still distribute a malicious file.

The AdGuard DNS test therefore tells me whether domain filtering works, not whether the endpoint has somehow become immune to malware.

7. Parental Controls and Device Policies

Private DNS also includes parental-control features such as adult-content filtering, Safe Search, service restrictions, and pause schedules.

Practical test: several breaks in one day. On a dedicated test server, enable Parental control and restrict a service such as YouTube. Open Servers → select your server → Parental control → Pause schedule and add three non-overlapping intervals: 07:00–07:30 before school, 12:30–13:00 at lunchtime, and 18:00–19:00 in the evening. AdGuard DNS supports up to five pause intervals per day. These are windows when Parental control restrictions are suspended; outside them, the restrictions apply again.

To run this AdGuard DNS test without waiting all day, temporarily place one short pause a few minutes ahead. Check the restricted service before the pause, during it, and after it ends. Confirm that the test device uses this server and inspect its query log for fresh requests. DNS caching or an already-open app session can delay the visible change, so retry with a fresh lookup rather than assuming the schedule failed. A pause suspends Parental control restrictions, so do not assume adult-content filtering stays active during these breaks. Use a test server before applying the schedule to a child’s devices. See AdGuard’s parental-control documentation for the schedule settings.

An AdGuard DNS test becomes more useful when policies are tested per device. A child’s tablet, work computer, smart TV, and lab system do not necessarily need the same restrictions.

Per-device control also reduces the temptation to disable the entire configuration because one machine needs an exception.

Is AdGuard DNS Safe?

Is AdGuard DNS safe? Based on what an AdGuard DNS test can realistically measure, it is a useful privacy and security layer when configured correctly and understood within its limits.

It supports encrypted DNS protocols, filtering rules, security controls, and private-account management. Those features can reduce unwanted connections and make DNS behavior easier to control.

The trust model still matters. AdGuard has to process the domains you ask it to resolve. An AdGuard DNS test can confirm that encryption protects the connection to the resolver, but it does not make the resolver disappear from the chain.

DNS also cannot solve every security problem. Browser fingerprinting, stolen cookies, compromised passwords, malicious extensions, vulnerable software, social engineering, and harmful files can all sit outside the scope of an AdGuard DNS test.

HackersGhost Note: The result I want from an AdGuard DNS test is not “this product does everything.” I want to know whether it does its own job clearly and predictably.

Is AdGuard DNS Free?

Yes. AdGuard DNS free gives you more than one way to start an AdGuard DNS test.

You can use the public resolver without creating a customized configuration, or create a free Starter account for Private AdGuard DNS.

The current Starter limits include:

• 300,000 DNS requests per month
• 5 devices
• 2 servers
• 100 rules

That is enough capacity for a meaningful AdGuard DNS test on a few devices and gives you access to the private management workflow before paying for a larger plan.

AdGuard DNS Free vs Personal After My AdGuard DNS Test

The Personal plan is not simply the version where DNS filtering suddenly starts working. My AdGuard DNS test reaches essentially the same conclusion here every time: the paid upgrade is mostly about capacity and practical management.

Personal currently expands the service to 10 million monthly requests, 20 devices, 5 servers, and 1,000 rules.

That changes the size of setup you can comfortably manage. A Starter account works well for an initial AdGuard DNS test. Personal is more appropriate when you want to cover a larger household, separate more devices, maintain extra rules, and collect meaningful statistics without constantly watching a small monthly allowance.

For me, the strongest reason to move from the public resolver to Private AdGuard DNS is visibility. The AdGuard DNS test becomes much easier when I can see devices, requests, rules, blocks, and false positives in one place.

If your own AdGuard DNS test proves that the workflow suits your network, the Personal plan is the logical step once Starter capacity becomes restrictive.

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically. AdGuard may occasionally run separate public promotions with similar pricing.

What the AdGuard DNS Test Shows About Ad Blocking

The AdGuard DNS test also explains why DNS-based ad blocking behaves differently from a browser content blocker.

Separate Advertising and Tracking Domains

This is the environment where the AdGuard DNS test usually produces the clearest filtering results. Many ad networks, analytics systems, telemetry services, and trackers use dedicated hostnames.

If the hostname matches an enabled filter, the resolver can block the DNS request before the device establishes the normal connection to that destination.

First-Party Advertising

The limitations become obvious when the AdGuard DNS test encounters advertising delivered from the same hostname as wanted content.

DNS sees the hostname request. It cannot understand that one object is an advert while another object from the same server is the video, article, image, or application data you actually requested.

Blocking that hostname may break the entire service. This is why a successful AdGuard DNS test should never be defined as removing every advertisement from every website.

Cosmetic Filtering

DNS cannot rewrite HTML or remove empty page containers. During an AdGuard DNS test, you may therefore see a blank space where an advertising request was blocked.

If precise visual cleanup matters, DNS filtering works better beside a dedicated content blocker such as AdGuard Ad Blocker on supported devices.

Downloaded Files and Malware

An AdGuard DNS test can confirm that known malicious hostnames are blocked, but DNS cannot inspect a downloaded ZIP archive, analyze a macro, or quarantine a malicious executable.

Endpoint security still has its own job. I prefer several layers doing specific jobs rather than forcing DNS to become antivirus while wearing a fake moustache.

How to Test DNS & WebRTC Leaks: 7 Sneaky Checks

How to Test DNS & WebRTC Leaks: 7 Sneaky Checks 🕵️‍♂️

AdGuard DNS vs Cloudflare and NextDNS

Cloudflare is widely known for its public DNS service and privacy-focused resolver options. Its standard 1.1.1.1 experience is simpler than a configurable Private AdGuard DNS setup.

NextDNS is a closer comparison because it also focuses on configurable DNS filtering, analytics, device policies, security controls, and blocklists.

I would not choose between them using a feature list alone. An AdGuard DNS test on your own connection matters because DNS performance depends on location, network routing, device configuration, and the policies you enable.

My preference is to configure one test device first, run the AdGuard DNS test over normal browsing sessions, inspect the logs, and only then consider moving the rest of the network.

Five minutes of controlled testing usually teaches me more than forty minutes staring at comparison charts and pretending every network behaves the same.

My AdGuard DNS Test in a Real Home Lab

I prefer an AdGuard DNS test in a real network because that exposes conflicts that product screenshots cannot show.

My setup includes a Cudy WR3000 used with Proton VPN over WireGuard, separate lab infrastructure, and deliberately vulnerable virtual machines for controlled security testing.

That makes the AdGuard DNS test especially useful because I can compare ordinary client traffic with router-level behavior and VPN-controlled DNS.

I also keep vulnerable machines separated rather than expecting a resolver to compensate for bad network design. An AdGuard DNS test may prove that known unwanted domains are blocked, but it cannot provide segmentation.

My typical lab checklist looks like this:

• Run the AdGuard DNS test with the VPN disconnected and note the resolver.
• Connect the VPN and repeat the AdGuard DNS test.
• Inspect whether DNS now follows the VPN provider’s intended route.
• Check whether Private DNS requests appear under the correct device.
• Add one custom rule and repeat the AdGuard DNS test.
• Remove the rule and verify recovery.
• Restart or reconnect the test device and repeat the AdGuard DNS test once more.

That process gives me much more confidence than opening one ad-heavy website and deciding the AdGuard DNS test passed because three rectangles vanished.

Common AdGuard DNS Test Problems and Fixes

The AdGuard DNS Test Shows No Filtering

If the AdGuard DNS test shows no filtering, start by confirming the resolver rather than immediately adding more blocklists.

Check the device DNS settings, browser Secure DNS configuration, router, VPN, and IPv6. If Private DNS is configured, generate fresh traffic and watch the Query Log during the AdGuard DNS test.

If the requests never appear, another DNS path is probably being used.

The Dashboard Shows No Requests

Reconnect the device after changing DNS settings and repeat the AdGuard DNS test.

Then check browser DoH, VPN-provided DNS, manual operating-system settings, and IPv6 DNS. Any of these can make the AdGuard dashboard look completely inactive while DNS resolution continues elsewhere.

A Legitimate Website Stops Working

Repeat the AdGuard DNS test while watching the Query Log and inspect recently blocked domains from the affected device.

Look for a hostname associated with the broken login, checkout system, embedded service, video player, or external content provider. Temporarily allow the likely dependency and repeat the AdGuard DNS test.

If the page starts working, you have a useful troubleshooting result without disabling every filter.

Ads Remain Visible

Visible advertising does not automatically mean the AdGuard DNS test failed.

The advert may be first-party, share a hostname with wanted content, remain cached, or require cosmetic filtering that DNS cannot provide.

The useful question is whether the AdGuard DNS test confirms that matched domains are blocked, not whether every page becomes visually empty of advertising.

DNS Changes When the VPN Connects

That result can be completely normal during an AdGuard DNS test. Many VPNs provide DNS through the encrypted tunnel to reduce leak risks.

Check the VPN documentation and actual resolver path before overriding that behavior. I would rather allow the VPN’s intended DNS design than send requests outside the tunnel merely to make another dashboard show activity.

The AdGuard DNS Test Works on One Device but Not Another

Compare how each device receives DNS. One may inherit the router configuration while another uses manual DNS or browser-level encrypted DNS.

Also compare IPv4 and IPv6 during the AdGuard DNS test. Configuring only one protocol can leave an unexpected second route available.

Who Should Run an AdGuard DNS Test?

An AdGuard DNS test makes the most sense for people who want to understand whether network-level DNS filtering fits their setup before applying it everywhere.

• People who want DNS-level filtering on devices that cannot run traditional browser extensions.
• Households that want separate policies for computers, phones, televisions, consoles, and children’s devices.
• Users who want encrypted DNS without confusing it with VPN anonymity.
• Home-lab users who want rules, query visibility, blocklists, and troubleshooting controls.
• People who want to run an AdGuard DNS test on the free service before paying for more capacity.

An AdGuard DNS test is less useful if you expect DNS alone to provide perfect cosmetic ad removal, antivirus-style file analysis, IP masking, malware cleanup, or protection from every form of social engineering.

Those tasks require different controls. DNS works best when it is allowed to remain DNS.

My Verdict After the AdGuard DNS Test

After running an AdGuard DNS test properly, the biggest benefit is not simply that some advertisements disappear. The real benefit is that DNS filtering becomes measurable and, with Private DNS, much easier to control.

The public resolver is a simple place to start. It can provide domain-level filtering without requiring dedicated software on every device.

Private DNS becomes more valuable when the AdGuard DNS test moves beyond basic blocking and you want device visibility, custom rules, statistics, filtering policies, and easier false-positive troubleshooting.

The limitations are just as important. An AdGuard DNS test cannot prove that downloaded files are safe, hide your public IP address, remove every first-party advertisement, replace endpoint security, or compensate for weak network segmentation.

In my setup, I keep DNS filtering beside browser protection, endpoint security, VPN routing where appropriate, software updates, and separate networks for vulnerable lab systems.

HackersGhost Note: The best result from an AdGuard DNS test is boring in the best possible way: the resolver goes where I expect, the rules behave predictably, and nothing needs a cape.

If your own AdGuard DNS test shows that the free service improves your network and you want more devices, requests, rules, and private management, the AdGuard DNS Personal plan is the natural next step.

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically. AdGuard may occasionally run separate public promotions with similar pricing.

Frequently Asked Questions