Proton VPN Custom DNS: 7 Real AdGuard Setup Lessons

Proton VPN custom DNS lets you keep Proton VPN as your encrypted tunnel while using a third-party DNS resolver such as AdGuard DNS for domain filtering. On supported Proton apps, including Android and the latest Windows version, the cleanest setup is to enter the AdGuard DNS addresses inside Proton VPN instead of changing your operating system’s global DNS settings.

I ended up testing AdGuard DNS with Proton VPN after comparing three very different network setups: my normal ISP connection, Proton VPN running through my Cudy WR3000 router, and Proton VPN on my smartphone with AdGuard configured as the custom resolver. The interesting part was not that one magical setting suddenly made the internet invincible. It did not. The interesting part was how clearly the DNS behaviour changed once I stopped stacking privacy apps on top of each other and gave each tool one job.

This guide contains my 7 proven AdGuard setup tips from those tests. I will show you how I use Proton VPN custom DNS on Android and Windows, what happened to NetShield, why split tunneling deserved a cleanup, how my Cudy router changed the picture, and how I performed a Proton VPN DNS leak check before deciding the configuration was worth keeping.

My test setup	DNS result	What I learned
Direct ISP connection	Check My DNS: C	IPv6 worked, but DNSSEC validation failed in my Internet.nl test
Cudy + Proton VPN	Check My DNS: B	DNSSEC worked, while IPv6 was unavailable through this route
Proton + AdGuard DNS	Check My DNS: A	The custom DNS combination produced my best resolver grade

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically. AdGuard may occasionally run separate public promotions with similar pricing.

Key Takeaways

• Proton VPN custom DNS worked well in my testing. I kept Proton responsible for the VPN tunnel and let AdGuard handle DNS filtering.
• My resolver grade improved from C and B to A. Those are DNS-test grades, not overall cybersecurity scores.
• AdGuard DNS Android does not require another VPN app. I entered the public AdGuard resolver IP addresses directly into Proton VPN.
• AdGuard DNS Windows can be configured the same basic way. Proton provides its own Custom DNS setting in the Windows application.
• Custom DNS replaces NetShield’s DNS-filtering role. Proton cannot apply NetShield filtering when a third-party resolver handles the queries.
• Split tunneling deserves restraint. I found apps in my exclusion list that no longer needed to bypass Proton at all.
• Always test after changing DNS. I check my public IP, resolver behaviour, DNSSEC and potential DNS leaks instead of assuming a green toggle means everything is fine.

Lesson 1: Proton VPN Custom DNS Gives Each Tool One Job

The idea behind Proton VPN custom DNS is simpler than the name makes it sound. A VPN and a DNS resolver perform different jobs. Proton VPN creates the encrypted route between my device and the VPN server. DNS translates domain names such as hackersghost.com into IP addresses that computers can actually use.

Normally, Proton handles those DNS requests through its own infrastructure. When I enable Proton VPN custom DNS, I am deliberately telling Proton to send my DNS requests to another resolver instead. In this case, that resolver is AdGuard DNS.

I like this arrangement because I can understand it without drawing a conspiracy board on my wall. Proton handles the VPN tunnel. AdGuard handles DNS filtering. I am not trying to run Proton VPN, AdGuard VPN, an AdGuard DNS VPN profile and another local filtering VPN at the same time.

That separation became especially important on Android. A non-rooted Android device normally allows only one VPN-based service to control the VPN interface at a time. AdGuard Ad Blocker can use a local VPN for system-wide filtering, AdGuard VPN obviously needs a VPN connection, and Proton VPN needs one too. Three privacy tools reaching for one chair does not create defense in depth. It creates musical chairs with encryption.

Using AdGuard DNS with Proton VPN avoids that particular fight because AdGuard does not need to establish a second VPN. I simply use AdGuard’s resolver addresses through Proton’s built-in Custom DNS feature.

The official Proton VPN service supports Custom DNS in its applications, while AdGuard DNS provides both public filtering resolvers and more configurable private DNS options.

HackersGhost Note: I prefer configurations I can explain in one sentence. If I cannot tell which product handles the tunnel, DNS, filtering and routing, troubleshooting later becomes archaeology with Wi-Fi.

The AdGuard DNS Settings I Used

For my first Proton VPN custom DNS test, I used AdGuard’s free public filtering resolvers:

94.140.14.14
94.140.15.15

These public addresses are designed to block ads and trackers at the DNS level. They are available without buying an AdGuard subscription, which also makes them useful for testing whether AdGuard DNS with VPN is useful to you before you start changing more advanced settings.

A paid private AdGuard DNS account goes further by adding features such as device management, statistics, query information, configurable filtering and your own rules. I already have access to AdGuard DNS, so naturally I am interested in those controls, but the public IP addresses were the cleanest place to begin this specific experiment.

Lesson 2: AdGuard DNS With Proton VPN Changed My Test Results

I did not start this test because my existing connection was broken. I started because I wanted to understand what my different network configurations were actually doing. That distinction matters. Security testing becomes much more useful when you compare known baselines instead of changing twelve settings and celebrating whichever number turns green.

My normal connection went directly through my ISP modem. Internet.nl confirmed that IPv6 worked, but DNSSEC validation did not. The connection test itself showed 50%, although that percentage should not be interpreted as “50% secure.” Internet.nl measures specific modern internet standards, not the total security of a modem, router or computer.

When I ran Check My DNS on that direct connection, it returned a C. The resolver’s Port & ID behaviour did not look obviously broken, and the test detected IPv6. Still, it gave me a useful baseline.

My Cudy WR3000 and Proton VPN DNS Server Test

My second setup was the Cudy WR3000. I use WireGuard with Proton VPN on this router, and I sometimes use Secure Core routes when I specifically want that additional routing layer. Privacy-friendly locations such as Switzerland or Iceland can be useful choices depending on the server route and what I am testing, but geography does not replace a correct configuration.

The Cudy result was almost the inverse of my direct ISP connection. Internet.nl showed DNSSEC validation working, while IPv6 was not available through that route. Check My DNS gave the Cudy configuration a B.

I did not treat the missing IPv6 result as an emergency. If a VPN-router setup does not properly tunnel IPv6, casually enabling IPv6 outside the VPN can be worse than leaving it unavailable because it can create an alternate path around the tunnel. I prefer a limitation I understand over a protocol checkbox that leaks around my routing rules.

Then I tested Proton VPN custom DNS directly on my smartphone using AdGuard’s public DNS addresses. Check My DNS returned an A. That was my best resolver result of the three configurations.

Again, the important wording is resolver result. My A does not mean my smartphone became more secure than every B-rated or C-rated connection. It means the DNS resolver path tested better against the criteria used by that particular tool.

My Test Result: Direct ISP gave me C, Cudy plus Proton gave me B, and Proton VPN custom DNS with AdGuard gave me A. I kept the final setup because the configuration also made sense technically, not because I wanted to collect letters like security-themed Pokémon.

Lesson 3: AdGuard DNS Android Works Best Inside Proton

The AdGuard DNS Android setup I kept is intentionally boring. That is a compliment. Proton VPN remains the only local VPN connection on my smartphone, and I configure Proton VPN custom DNS inside Proton itself.

In the Proton VPN Android app, I go to Settings → Connection → Advanced Settings → Custom DNS. I add the AdGuard resolver addresses and enable Custom DNS. If Proton is already connected, reconnecting ensures the new DNS configuration is active.

I do not simultaneously launch AdGuard VPN. I also do not run the AdGuard Ad Blocker in its normal local-VPN filtering mode while Proton VPN owns the Android VPN connection. On a standard non-rooted device, those VPN-based modes compete for the same Android facility.

This was the key discovery behind my preferred AdGuard DNS with Proton VPN configuration. AdGuard DNS itself does not need to become another VPN if I give its DNS server addresses directly to Proton.

Why I Do Not Set Android Private DNS Separately

Android also has a system-wide Private DNS feature. I leave that out of this configuration. Proton specifically provides Proton VPN custom DNS for third-party resolvers, so I prefer configuring the resolver in the VPN application instead of creating competing DNS rules at operating-system level.

That choice also makes troubleshooting easier. If something fails, I know the VPN application controls the tunnel and the selected Proton VPN DNS server path. I do not have to remember whether Android Private DNS, a Wi-Fi profile, an AdGuard app and Proton are all trying to be the smartest setting on the phone.

This setup is especially useful for me because I do not always use my Cudy router. A router VPN is convenient, but it cannot provide the same per-app split tunneling flexibility as the Proton application on my smartphone. When I leave home or simply use my normal Wi-Fi connection, Proton VPN custom DNS stays with the device.

Proton Unlimited bundles Proton VPN, Proton Mail, Proton Drive and Proton Pass under one subscription. If you already use several Proton services, the complete bundle can be the more practical option.

Lesson 4: AdGuard DNS Windows Is Useful Without a VPN Router

The same idea is useful on a computer. You do not need a dedicated VPN router to use Proton VPN custom DNS. This matters because many people move between home Wi-Fi, work networks, hotels, mobile hotspots and other connections where they cannot control the router.

On the latest Windows version, Proton provides Custom DNS servers in its advanced settings. I can enable the option, select DNS servers, add the AdGuard addresses and then reconnect Proton. The second address acts as redundancy rather than giving me two simultaneous layers of filtering.

For an AdGuard DNS Windows configuration used alongside Proton, I prefer this over manually changing the DNS servers on the Windows Wi-Fi or Ethernet adapter. Proton is already managing the VPN network path. Letting its own Proton VPN custom DNS feature manage the third-party resolver keeps the logic in one place.

My main computer is a second-hand HP EliteBook that I upgraded to 32 GB of RAM. Windows is my host system, while VMware carries the security lab where I mainly use Parrot OS and also keep Kali available. That mix gives me another reason to dislike mysterious global networking changes. A DNS setting that made sense for ordinary browsing may not be what I want for every VM, isolated test network or lab target.

I therefore treat Proton VPN custom DNS as part of a specific VPN profile rather than as a law of nature for every packet my laptop can produce. My isolated lab networks remain isolated, and my everyday Windows traffic can use Proton with AdGuard when that is the configuration I want.

HackersGhost Note: The more networking environments I use, the more I value settings that are attached to the correct layer. A global DNS change is easy to make and even easier to forget three troubleshooting sessions later.

My Basic AdGuard DNS Windows Steps

1. Open Proton VPN and go to Settings.
2. Open the advanced connection settings and enable Custom DNS servers.
3. Add 94.140.14.14.
4. Add 94.140.15.15 as the secondary resolver.
5. Apply the changes or reconnect the VPN.
6. Run a Proton VPN DNS leak check before assuming the setup is finished.

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically. AdGuard may occasionally run separate public promotions with similar pricing.

Proton VPN Free Tier: 7 Limits You Should Know Before Using It

Proton VPN Free Tier: 7 Limits You Should Know Before Using It

Lesson 5: Proton VPN Custom DNS Replaces NetShield Filtering

There is an important trade-off when enabling Proton VPN custom DNS: Proton NetShield cannot perform its normal DNS filtering at the same time. This is not a bug. It follows directly from how the features work.

NetShield filters domains because Proton’s own DNS infrastructure receives the queries. If I send those queries to AdGuard instead, Proton can no longer inspect them for NetShield’s ad, tracker and malware-domain filtering. AdGuard DNS becomes the DNS-filtering layer.

That is why I do not describe AdGuard DNS with Proton VPN as “adding another filter on top of NetShield.” I am choosing a different resolver and therefore choosing a different filtering system.

For me, that can still be attractive. AdGuard DNS is built around DNS filtering and, with a private account, gives me more visibility and control over DNS rules, connected devices and filtering decisions. Proton continues doing what I primarily hired it to do: provide the VPN connection.

If NetShield already gives you exactly what you want, there is no security law requiring you to replace it. Proton VPN custom DNS is useful because it provides choice. I would not change a stable setup purely because another dashboard contains more switches. Switches are wonderful. They also breed after midnight.

Public AdGuard DNS Versus My Paid AdGuard DNS

The two IP addresses I used for this test are the free public AdGuard filtering resolvers. That means someone can reproduce the basic AdGuard DNS with VPN configuration without buying a private DNS plan.

The paid service becomes interesting when I want more than the default public filtering behaviour. A private AdGuard DNS account can provide per-device visibility, query statistics, customized blocklists and user-defined filtering rules. Those features turn DNS from a mostly invisible background service into something I can actually inspect and tune.

For a family, multiple devices or someone who enjoys knowing why a domain was blocked instead of muttering at the router, those controls can justify the subscription. For someone who only wants basic filtering, the public servers remain a perfectly reasonable starting point.

Lesson 6: Proton VPN Split Tunneling Needed a Cleanup

Testing Proton VPN custom DNS also exposed something unrelated to AdGuard: my split tunneling list had become too generous. I had accumulated applications that bypassed the VPN because, at some point, I had probably experienced a problem or wanted to test something quickly.

Even ChatGPT was in the exclusion list. I removed it, tested the app through Proton, and it worked normally. That one small test reminded me why exceptions should have a reason rather than a fossil record.

I now prefer to start with no unnecessary split-tunneling exclusions. I use Proton normally and add an application only when I can reproduce a real problem through the VPN. Banking services, streaming platforms, local-network tools or regional services can sometimes need special treatment, but I want to know why each exception exists.

This matters when testing AdGuard DNS with Proton VPN because an excluded application deliberately follows a different network route from applications inside the VPN. I therefore do not assume that one successful browser DNS test describes every split-tunneled application on the device.

My Split Tunneling Rule

My Rule: I exclude an app only after I can demonstrate that it fails through Proton and works when bypassing the VPN. “I think this one once behaved strangely” is no longer enough evidence to earn permanent diplomatic immunity.

That approach also reduces the number of paths I need to think about during a Proton VPN DNS leak check. Fewer exceptions mean fewer surprises.

Where the Cudy Router Still Fits

I have not abandoned my Cudy WR3000. A VPN router is excellent when I want an entire network to use Proton without installing a VPN client on every device. It is also useful for devices that do not offer a good VPN application of their own.

The trade-off is flexibility. My Cudy cannot give me the same convenient app-by-app split tunneling I have on Android or Windows. Some websites and applications also dislike VPN addresses, which is why I do not force every daily activity through the Cudy.

There is an interesting reverse scenario, though. If Proton is running on the router instead of locally on my smartphone, the smartphone itself is no longer using Proton’s Android VPN slot. In that situation, I have more freedom to use a local filtering application on the phone. The correct setup depends on where the VPN actually runs.

That is the broader lesson behind Proton VPN custom DNS: topology matters. “I use Proton and AdGuard” does not describe enough. Proton on a router, Proton on Android and Proton on Windows can create very different practical limitations.

Lesson 7: Run a Proton VPN DNS Leak Check Before You Finish

I do not consider Proton VPN custom DNS configured just because the Save button worked. The last stage is verification. This is where many privacy tutorials become suspiciously quiet.

First, I confirm that my public IP address still belongs to the VPN route I selected rather than my ordinary ISP. Changing DNS should not unexpectedly remove the VPN tunnel.

Second, I perform a Proton VPN DNS leak check. I want the observed resolver behaviour to match the configuration I intended. If my ordinary ISP resolver suddenly appears while I expect AdGuard through Proton, I stop and investigate rather than declaring the tutorial a success because the internet still loads.

Third, I check DNSSEC behaviour. In my own Internet.nl comparison, my direct ISP resolver did not validate DNSSEC while the Cudy/Proton route did. That was one of the clues that different resolvers were genuinely being used.

Fourth, I run Check My DNS. This gave me the C, B and A results described earlier. I use the result as evidence about resolver behaviour, not as a complete security grade.

Finally, I test ordinary life. Websites should load, apps should connect, banking or streaming apps should behave as expected, and anything deliberately placed in split tunneling should be tested separately. A theoretically elegant Proton VPN custom DNS configuration that breaks half my daily workflow is not elegant. It is an unpaid support ticket I wrote for myself.

My Proton VPN DNS Leak Check Routine

1. Check the public IP. It should still match my intended Proton connection.
2. Check the DNS resolver. I verify that the DNS path makes sense for the Custom DNS configuration.
3. Test DNSSEC. I use it as another signal that the expected resolver behaviour is active.
4. Run Check My DNS. I compare the result with my previous baseline rather than obsessing over one grade.
5. Test excluded apps separately. Split tunneling intentionally changes their network path.
6. Keep the change only if daily use still works. Security settings should be maintainable, not ceremonial.

When I Would Keep the Proton VPN DNS Server Instead

I like my Proton VPN custom DNS experiment, but that does not mean I would immediately reproduce it on every machine I touch. Sometimes the best configuration is the one that is already working and has a clear purpose.

A good example is a dedicated torrent setup. If qBittorrent is correctly bound to the Proton network interface, the kill-switch behaviour has been tested, port forwarding works and the connection is stable, I would not change the DNS resolver merely because another DNS test might produce a prettier letter.

DNS filtering and torrent routing solve different problems. A custom blocklist can also prevent a hostname from resolving if that domain matches a filtering rule. That does not mean AdGuard DNS is unsuitable for P2P; it means I do not introduce a new variable into a proven setup without a reason.

For my smartphone and everyday Windows use, the balance is different. Ads, trackers and unwanted domains are part of normal browsing and app traffic, and I move between networks. There, AdGuard DNS with Proton VPN provides a practical combination without requiring my Cudy router to be present.

What Proton VPN Custom DNS Does Not Do

Proton VPN custom DNS does not turn DNS into a full content-filtering proxy. DNS filtering works at the domain level. If an advertisement and the useful content come from the same domain, a DNS resolver cannot surgically remove the ad from the page without also affecting the useful resource.

This is one reason a dedicated browser content blocker or AdGuard Ad Blocker can provide more detailed cosmetic and element-level filtering than DNS alone. The problem on Android is not that those tools are bad; it is that the standard local-VPN mode can conflict with another locally running VPN.

Proton VPN custom DNS also does not replace endpoint security, browser security, sensible permissions, updates or safe account practices. DNS filtering can prevent connections to many unwanted domains, but it cannot make a malicious file harmless after you deliberately run it.

Nor does Secure Core, a privacy-friendly server location or an A on Check My DNS grant “absolute security.” I use all of these as layers with specific jobs. The moment I expect one privacy product to solve every security problem is usually the moment reality starts sharpening a stick.

My Final Proton VPN Custom DNS Setup

After testing the alternatives, my preferred everyday smartphone configuration is straightforward: Proton VPN provides the VPN connection, AdGuard DNS provides the custom resolver, and split tunneling contains only applications that genuinely need to bypass the VPN.

On Windows, I would use the same principle whenever I am running Proton locally rather than relying on the Cudy router. I configure Proton VPN custom DNS inside Proton, keep Windows’ global DNS configuration out of the experiment, reconnect, and verify the result.

My Cudy remains useful when I want VPN protection at network level. I simply no longer treat the router as mandatory for every device and every situation. App-based split tunneling is too useful for me to give up just to say everything passes through one box.

The biggest lesson from this test was not the A grade. It was discovering that a simpler design gave me a configuration I could actually explain and verify. Proton VPN custom DNS gave me the flexibility of Proton’s VPN application while AdGuard DNS handled filtering without opening another local VPN connection.

HackersGhost Verdict: Proton plus AdGuard DNS is not interesting because it stacks two recognizable privacy brands. It is interesting because each service can perform a separate, understandable job. My test improved from C to B to A at the DNS-resolver level, but the configuration stayed because it also survived real use.

If you are considering the same setup, start with the free public AdGuard DNS addresses, configure them through Proton’s own Custom DNS feature, remove unnecessary split-tunneling exceptions, and test the result. If you later want richer statistics, device controls and custom filtering, the private AdGuard DNS service adds the management layer that the public resolver intentionally keeps simple.

Exclusive HackersGhost discount code HACKERSGHOST20 applies automatically to the eligible one-year subscription. AdGuard may occasionally run separate public promotions with similar pricing.

Frequently Asked Questions