Set up dnsdome on Linux (NetworkManager, systemd-resolved, resolv.conf)

systemd-resolved with DNS-over-TLS (recommended)

Most current distributions run systemd-resolved. It speaks DNS-over-TLS natively, so a laptop can use your profile's encrypted hostname and stay filtered on any network without IP allowlisting.

1. Copy the DNS-over-TLS hostname from your profile's Encrypted DNS card in the panel: <token>.dns.dnsdome.com.
2. Create a drop-in:

   sudo mkdir -p /etc/systemd/resolved.conf.d
   sudo tee /etc/systemd/resolved.conf.d/dnsdome.conf >/dev/null <<'EOF'
   [Resolve]
   DNS=87.244.198.165#<token>.dns.dnsdome.com
   DNSOverTLS=yes
   Domains=~.
   EOF
   sudo systemctl restart systemd-resolved

   The #hostname suffix tells resolved which certificate name to verify, and Domains=~. makes this server win over per-link DNS from DHCP.
3. Verify:

   resolvectl status | grep -A3 'Global'
   resolvectl query doubleclick.net

   With Ads & Tracking enabled the query returns the block response and shows as blocked in your log.

If /etc/resolv.conf is not a symlink to /run/systemd/resolve/stub-resolv.conf, applications bypass resolved. Fix it with sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf.

NetworkManager (GNOME, KDE)

1. Add your network's public IP to the profile's allowlist in the panel, since this method uses plain DNS.
2. Open Settings → Network, click the gear next to your connection, open IPv4.
3. Set Method to Automatic (DHCP), addresses only, turn the DNS Automatic switch off and enter 87.244.198.165.
4. On IPv6, do the same or set DNS to the same server, so nothing leaks through the IPv6 resolver the network hands out.
5. Apply, then toggle the connection off and on.

Or from a terminal:

nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns yes ipv4.dns 87.244.198.165
nmcli con up "Wired connection 1"

Static resolv.conf (servers, containers)

nameserver 87.244.198.165
options edns0 trust-ad

Make sure nothing rewrites the file: on Debian and Ubuntu that means uninstalling or disabling resolvconf, or writing the server into your DHCP client's configuration instead. On a server with a fixed public IP, add that IP to the allowlist once and it stays valid.

Test any of the above

dig example.com @87.244.198.165 +short
dig doubleclick.net @87.244.198.165 +short

The first should return normal addresses. The second returns the block response if Ads & Tracking is enabled. If the first times out or returns REFUSED, your public IP is not on the profile's allowlist.