Skip to content
Network and DNS

Is your DNS filter blocking ads?

The test tries to reach ad and tracker domains and looks at where they stop: on the network, in a browser extension, or somewhere the page cannot pin down. When the blocking happens on the network, it also shows which DNS resolver goes out to the Internet.

Updated on · by

The test starts by itself: it tries to reach the domains of dozens of ad, tracking and telemetry services, checks whether the browser hides ad boxes, and asks a public DNS whether those domains really exist. Then it tells you at which layer the blocking happens.

How it actually works

The test issues real requests to the listed tracking and advertising domains. If your blocker stops them, nothing leaves your browser; if it does NOT, the requests really go out and those domains see the visit. That is the only way to measure blocking client-side, and it is worth stating plainly: nothing is sent to us, but the third-party requests are genuine.

Want the full grade of your ad blocker, cosmetic filters included? Take the adblock test.

What really happens: for the test we load the real ad-network scripts, as any website would. The ones your blocker lets through run, and some of them report a visit or an event to their servers: that is exactly what the test measures. We show no ads and send nothing to our servers: the result stays in your browser.

How to use the DNS ad blocking test

  1. 1

    Open the page on the device you want to check

    A DNS filter only protects the devices that use it: run the test from the phone, PC or TV you care about, on your home network.

  2. 2

    Let the test run

    It starts by itself after loading; press Analyze to run it again. It takes a few seconds.

  3. 3

    Read where the blocking happens

    Network, browser extension, both or neither. When both are active, the result says so instead of guessing.

  4. 4

    Separate the two layers

    Turn extensions off and run it again: whatever stays blocked is stopped by the network.

Why a DNS filter sometimes does nothing

Pi-hole and other DNS filters only work when the device sends its DNS questions to them. When the test says nothing blocks, it is usually one of these.

The device uses another DNS. The router may still hand out your provider's DNS, sometimes only over IPv6, and the device uses that instead of the filter.

The browser has secure DNS set to a provider. With DNS over HTTPS the browser asks the chosen provider directly, and the network filter never sees the requests.

A VPN is on. A VPN usually brings its own DNS.

The answer is cached. A domain resolved before you turned the filter on stays valid until its answer expires: restart the browser, flush the system DNS cache and run the test again.

Extension or network blocker: which to pick

They're not rivals: they complement each other, and the best protection uses both.

Network blocker (Pi-hole, NextDNS, AdGuard DNS): protects every device in your home, including the smart TV, your phone and smart appliances, without installing anything on each one. It just can't hide the empty boxes on pages. It's the ideal baseline for the whole network.

Browser extension (uBlock Origin is the most recommended): blocks ads and also hides the empty slots, handles sites that ask you to turn off your ad blocker, and works great. The only limit: it only applies in the browser where you install it.

The ideal combination: a network blocker for the whole home, plus uBlock Origin on the browser you use most. The network blocker stops the bulk of ads on every device; the extension polishes the experience in the browser. This test shows you exactly which of the two you're missing.

How the network is told apart from the browser

A DNS filter and an extension stop the same requests but leave different marks. Only an extension can hide the ad boxes on the page (the test places a few, plus a control element nothing should touch), and only an extension can answer a script with a harmless stand-in that never goes through the network. When requests fail and neither mark shows up, the blocking happens on the network.

For the domains the browser cannot reach, a public DNS (dns.google) tells whether they exist: a dead domain is not counted as blocked. The resolver that goes out to the Internet comes from a request to ipleak.net; behind Pi-hole or AdGuard Home you see their upstream, never their local address. AdGuard DNS and NextDNS are named only when the exit falls in address ranges known to be theirs.

What the page cannot know: whether network blocking comes from a DNS filter, the router or a firewall, and whether the DNS filter is also working while an extension is active.

Glossary

Technical terms used on this page, briefly explained.

Ad blocker #
A tool that stops ads and trackers from loading while you browse. It can be a browser extension or a blocker that works across your whole home network.
Tracker #
Small pieces of code that follow what you do online (which pages you visit, what you click) to build a profile and show you targeted ads. A good blocker stops them along with the ads.
uBlock Origin #
The most recommended ad-blocking extension: free, lightweight and effective, for Chrome, Firefox and Edge. Be careful not to confuse it with the many clones that have similar names.
Pi-hole #
A small "filter" you set up at home (often on a Raspberry Pi) that blocks ads for every device on the network, including TVs and phones. It can't hide the empty boxes on pages.
NextDNS / AdGuard DNS #
Services that block ads and trackers at the network level, without installing an extension. A few settings and they protect every device. Like Pi-hole, they don't hide empty slots.
Acceptable Ads #
A feature, on by default in Adblock Plus, that lets some ads deemed "non-intrusive" through. It's the most common reason for a only-partial score. It can be turned off in the extension settings.
Empty slot (ad box) #
When an ad is blocked but its empty box is left behind on the page. Browser extensions can hide it; network blockers can't.
Brave #
A browser with ad and tracker blocking built in (called Brave Shields). No extension needed: it protects against both connections and empty slots.

Questions about the DNS ad blocking test

I run Pi-hole but the test says nothing blocks. Why?
This device most likely does not ask Pi-hole. Check which DNS server it uses in the network settings, whether the router hands out a different IPv6 DNS, whether the browser has secure DNS set to a provider, and whether a VPN is on. Then run the test again.
How do I tell DNS blocking from extension blocking?
Run the test with extensions turned off. Whatever stays blocked is stopped by the network; whatever gets through was stopped by the extension.
Does the test see my Pi-hole's address?
No. Pi-hole and AdGuard Home forward requests to an outside DNS, and that is what the test sees. AdGuard DNS and NextDNS are recognized when the exit resolver falls in address ranges known to be theirs.
Does the test load real ads?
It tries to download the real scripts of ad and tracking services, without showing any ad. If nothing in your setup blocks them, those requests really reach those services, as on any other website.
Why does the test query dns.google?
It is the reference that tells whether a test domain still exists. The request leaves from your browser, so Google sees your IP address as any site would; the only names asked are those of the test domains.
Does it work on a phone?
Yes, from the phone's browser on your home Wi-Fi. On mobile data the phone does not go through your Pi-hole, unless a VPN or a private DNS setting points at your filter.

Sources used

Laws, official tables and reference implementations the logic of this tool was checked against.

Who built this tool

I'm Maurizio Fonte, a software engineer with 20+ years of experience. I build free, privacy-respecting tools like this one because I believe understanding how to protect your browsing should be simple, for everyone.

Learn more