First, what DNS does
Every time a device opens a website or an app talks to its servers, it first asks a DNS resolver to turn a name like example.com into an IP address. Nothing on the internet happens before that answer arrives. The resolver is normally whatever your internet provider or your router hands out, and it answers everything it is asked.
What a filtering resolver does differently
A filtering resolver checks each name against lists before answering. If the name is on a list you enabled, say advertising networks, it does not return the real address. It returns a "no such domain" answer, an empty answer, or the address of a block page. The device never connects to the ad server, because it never learns where it is. Everything else resolves normally and is cached, so browsing feels the same or faster.
That is all DNS filtering is. Its power comes from where it sits: every device on a network uses the same resolver, so one setting on the router covers the phone, the laptop, the TV and the doorbell, with no software on any of them.
Where the lists come from
Good lists are maintained by people who watch the ad and malware ecosystem full-time. dnsdome's Ads & Tracking and Threats & Malware categories are built from the HaGeZi lists, updated daily. Adult, Gambling, Piracy, Fake News and Social Media come from category feeds curated for that purpose. On top of the categories you add your own blocked domains, an allowlist for false positives, and blocked services such as TikTok or all AI assistants, which are just curated groups of domains.
How the resolver knows it is you
A public resolver such as 8.8.8.8 applies the same policy to everyone. A per-account service needs to know which policy to apply. There are two ways:
- By source IP. You tell the service your network's public IP and it applies your profile to queries from it. Simple, covers a whole router, breaks when the IP changes.
- By a token in the hostname. Encrypted DNS lets the client address the resolver by name, and the name can carry a secret:
<token>.dns.dnsdome.com. The token identifies your profile from anywhere, mobile data included. See DoH vs DoT vs DoQ.
dnsdome uses both and, unlike most services, runs no open resolver at all: a query from an unknown IP with no token is refused rather than answered with a default policy.
What DNS filtering cannot do
Being honest here saves you a support ticket later.
- Ads served from the same domain as the content. YouTube ads come from the domains YouTube itself needs. Blocking them blocks the video. The same goes for ads inside Facebook or Instagram, and for sponsored results on Google. A browser extension that works on page content can hide those; DNS cannot.
- Anything that does not use DNS. An app with a hard-coded IP address, or one that brings its own encrypted resolver, bypasses the network's DNS. Routers that redirect port 53 and block port 853 catch most of it; see the MikroTik and OpenWrt guides.
- Content within an allowed domain. DNS sees
reddit.com, not which subreddit. Blocking is per domain or subdomain, not per page. - Malware that is already running and talks to its server by IP. DNS filtering stops the download and the phone-home for the majority that use domains, not all.
Within those limits, it removes most ads and trackers on most sites, stops the majority of phishing and malware domains before a connection is made, and enforces content categories on devices you could never install software on.
Privacy: who sees your DNS
Whoever resolves your names sees the names. Today that is usually your ISP or a US public resolver. With dnsdome it is an EU company, on EU servers, keeping a log for your plan's retention, from one day on Free to 365 days on Business, that you can search yourself and that exists so that you can see what was blocked. The privacy policy spells out the details.