How to block ads on your whole network without a Pi-hole

The idea

Ad blockers in the browser work on one browser on one device. Every other screen in the house, the smart TV, the console, the tablet the kids use, the phone apps, still loads ads and trackers. The way to cover all of them at once is the resolver: every device asks the router where ads.example.net is, and if the router asks a filtering resolver, the answer is "nowhere". No software on any device.

Pi-hole made this popular by running the filtering resolver on a Raspberry Pi in your living room. A hosted filtering resolver does the same job with nothing to run, and follows your phone out of the house, which a Pi in the living room cannot.

Five minutes, start to finish

Create a free account at app.dnsdome.com. No card. The Free plan has one profile, one allowed IP and every category.
Create a profile and enable Ads & Tracking and Threats & Malware. Ads & Tracking comes in four strengths; Normal is a good start, Pro if you do not mind the occasional allowlist entry.
Add your public IP to the profile's allowlist. The panel shows the IP you are connecting from.
Set your router's DNS server to 87.244.198.165 and leave the secondary empty. Brand-by-brand paths are in the router guide.
Reconnect a device and open a news site. Then open the query log in the panel: blocked entries start appearing within a minute.

What you will notice

Banner and interstitial ads vanish from most websites and from most free apps on phones and tablets.
Smart TV home screens stop loading sponsored tiles from ad networks; ads inside streaming services' own players mostly stay, because they come from the service's own domains.
Pages load faster, because the twenty tracker scripts never get requested.
The query log shows which devices talk home the most. Expect surprises from the TV and the robot vacuum.

What DNS cannot block: YouTube ads, ads inside Facebook and Instagram, and sponsored search results, all served from domains the service itself needs. See what DNS filtering cannot do before you expect a completely ad-free YouTube.

Phones that leave the house

The router covers the home. On mobile data the phone uses the carrier's resolver again. Two fixes, both free:

Android 9+: set Private DNS to your profile's hostname <token>.dns.dnsdome.com. The token identifies your profile anywhere. Guide: Android.
iPhone: install a small DNS configuration profile. Guide: iPhone and iPad.

Devices that ignore the router

Some devices, notably Chromecast and a few TVs, have Google's resolver hard-coded and skip your router's DNS. On a MikroTik, OpenWrt, pfSense or OPNsense box you add one rule that redirects all port-53 traffic to the router, and they are covered too. The MikroTik and OpenWrt guides have the exact commands. Consumer routers generally cannot do this.

When a site breaks

Open the query log, filter by blocked, and the culprit domain is at the top. Add it to the allowlist; it takes effect within a minute or two. If you just need to get through a checkout, Pause protection turns everything off for a few minutes and back on by itself, so there is nothing to remember to undo.

Is it really free?

The Free plan is one profile, one allowed IP, two custom blocks, all categories, 10 queries per second and a one-day log. That covers a household on one router. Home at €4.99 a month adds three profiles, 25 IPs, 200 custom blocks and a 30-day log.

Can my ISP or router vendor override this?

Some ISP boxes lock the WAN DNS field. The DHCP DNS field under LAN settings is usually still editable and is what clients actually use. If everything is locked, put your own router behind the ISP box.

Will my guests be affected?

Yes, everyone on your Wi-Fi is filtered. Most guests appreciate fewer ads. If you would rather not, give the guest network its own profile with only Threats & Malware.