dnsdome
Create account Sign in
Setup guide · UniFi

UniFi (Dream Machine, Cloud Gateway): network-wide DNS filtering with dnsdome

Point a UniFi gateway at dnsdome so every network and VLAN is filtered. WAN DNS, per-network DHCP DNS, DNS Shield for encrypted upstream, and how to give a guest or kids network its own policy.

Last updated 24 September 2026

Two places DNS is set in UniFi

UniFi gateways can either resolve for clients themselves and forward upstream, or hand clients a DNS server directly through DHCP. Both are set in the UniFi Network application. Use the first for a single policy across the house, and the second when different VLANs should use different dnsdome profiles.

Option 1: one policy for everything (WAN DNS)

  1. In the dnsdome panel, add the gateway's public IP to the profile's allowlist. The panel shows the IP you are connecting from.
  2. In UniFi Network open Settings → Internet, select your WAN, and under DNS Server choose Manual. Enter 87.244.198.165 as primary and leave secondary empty.
  3. Open Settings → Networks, edit each network, and under DHCP → DNS Server keep Auto. Clients then receive the gateway's address and the gateway forwards to dnsdome.
  4. Apply. Renew a client's lease or reconnect it.

On recent UniFi OS releases, Settings → Security → DNS Shield can encrypt the gateway's upstream DNS with DNS-over-HTTPS. Choose a custom server and enter your profile's DoH address, https://dns.dnsdome.com/dns-query/<token>. With DoH the token identifies your profile, so a dynamic WAN IP stops mattering.

Option 2: a different profile per network

A kids' VLAN with Adult, Gambling and Social Media blocked and schedules enabled, a guest VLAN with only Threats & Malware, and the main network with Ads & Tracking: three profiles in one dnsdome account. Plain DNS cannot tell VLANs apart, because they all leave through the same public IP, so this needs the encrypted per-profile endpoints on the devices, or a small forwarder per VLAN. The practical route on UniFi:

  1. Create one dnsdome profile per network and note each profile's DoT hostname.
  2. For phones and laptops on each VLAN, set Private DNS (Android) or install the configuration profile (Apple) with that network's hostname, see the Android and iOS guides. Devices carry their policy with them.
  3. For everything else on the VLAN, run a tiny forwarder (a Raspberry Pi with systemd-resolved or unbound, or a container) with that profile's DoT hostname as upstream, and set the VLAN's DHCP → DNS Server to its address.

Stop bypass

UniFi has no simple NAT redirect for port 53 in the UI. What you can do: in Settings → Firewall & Security, add a LAN Out rule that drops TCP/UDP 53 and TCP 853 to any destination except the gateway or your forwarder. Devices with hard-coded DNS then fail to resolve and most fall back to DHCP DNS.

Verify

From a client, nslookup doubleclick.net. With Ads & Tracking enabled it returns the block response, and the query shows in the panel's log within a minute. If nothing resolves at all with option 1, the public IP is not on the allowlist.

Should I disable UniFi's own Ad Blocking or Content Filtering?
They intercept DNS on the gateway and can answer before dnsdome sees the query. Turn them off so your log is complete and your rules are the only ones applying.
Does dnsdome see per-client names like UniFi does?
With plain DNS from the gateway, all queries arrive from one IP and one profile. Add the devices that matter as devices in the panel and use their own endpoints; each then shows under its own name in the log.

Related

Put a dome over your network.

Free plan, no card. Create a profile, point your DNS, and watch the first blocked queries within minutes.

Start free See pricing