A look at AdGuard DNS
AdGuard unveiled the final version of the company's DNS provider service in December 2018 promising privacy, security, and high performance.
DNS is one of the cornerstones of the Internet. DNS, broken down to its core, is like a telephone directory for domains. Whenever servers are accessed, e.g. by clicking on a link in an email or on a website, DNS is used to look up the IP address of the server or device hosting the content.
In technical terms: domain names are send to a DNS resolver which returns the IP address required for the connection to the device that wants to make the request.
For many Internet users, it is their ISP that handles DNS automatically. Usually, that is not the fastest nor best option; some ISPs collect the data and sell it.
Third-party DNS services promise a lot: faster performance, better privacy and security, and add-on features such as filtering options to block unwanted content like advertisement or non-child friendly content automatically.
AdGuard DNS
AdGuard DNS is not a new service but it has been released as a final version in December 2018. The service features two different DNS server pairs that users may add to their device:
- Standard: 176.103.130.130 and 176.103.130.131
- Family protection: 176.103.130.132 and 176.103.130.134
AdGuard DNS supports DNS-over-TLS and DNS-over-HTTPS next to that which encrypt DNS queries.
- DNS-over-TLS: dns.adguard.com (Default) or dns-family.adguard.com (Family Protection)
- DNS-over-HTTPS: https://dns.adguard.com/dns-query (Default) or https://dns-family.adguard.com/dns-query (Family Protection)
Sign-up or registration is not required; users who require detailed instructions can open the help page on the Adguard website. There you find IPv6 addresses as well.
A quick DNS Benchmark check showed that Adguard's DNS servers perform equally well as Cloudflare DNS servers, Google DNS, or Open DNS.
AdGuard DNS blocks requests to "known" tracking or advertisement domains automatically. The main difference between the Standard and Family Protection servers is that the latter blocks content inappropriate to minors as well.
These built-in protections are never 100% but they block a good share of content automatically.
Russian company AdGuard is best known for its (paid) ad-blocking solution. The DNS server is free of charge and can be used by anyone.
Some users may not want to send their entire DNS traffic to a Russian company; others may distrust Google or Cloudflare, or their ISP. Those who want to be in control may want to take a look at Pi Hole instead, a local solution based on Raspberry Pi devices.
Now You: Which DNS service do you use, and why?
Adguard DNS uses Cloudflare infrastructure so I stopped using them. I don’t trust Cloudflare! You can find this through ‘DNS leak’ websites. Cloudflare hold on to their logs… indefinitely. Yes, totally law-abiding here but I don’t want Big Brother Cloudflare keeping tabs, it’s the principle of the matter.
Tout privacy… they fail to deliver on their promise.
Thank you very much for the great article and benchmarks !
Installed Enpass on Mint, it does not launch.
I’ve tested DNS leaks on dnsleaktest.com with my system DNS set to ‘AdGuard Standard 176.103.130.130 and 176.103.130.131’ and as to what I understand AdGuard DNS seems to run AnyCast : dnsleaktest.com showed Google, Cloudflare and OpenDNS servers but none of its own.
What am I missing?
@Tom Hawack: 1st of all I wih you a happy, healthy year 2019 for you and your loved ones.
With reference to VioletMoon’s remark above, what does the Cloudflare setting in about:config mean considering I have set different DNS addresses in Acrylic: which takes priority?
@Klaas Vaak, I was notified via email of your comment but because it wasn’t published immediately I answered to VioletMoon directly, above, at:
Tom Hawack said on January 1, 2019 at 8:22 pm
Hope that helps. I disable Firefox DNS resolver (so called TRR, Trusted Recursive Resolver)
because as you I have my own system-wide personalized DNS resolvers, managed as well with Acrylic; I remember when we discussed about it you and I, last year it was!
Last year, new year. I wish you all the best and look forwards to reading you here and sharing all valuable information we gather within our voyages in the fantastic (not always, ok!) Web galaxy!
Read you later :=)
@tom hawack
“That’s because AdGuard is not an authoritative DNS server, it means that we send DNS requests upstream to Google DNS etc, but do so on our own behalf so that they could never know the origin of those requests.”
(adguard twitter answer)
@noemata, Roger! I copy you on the ground! Corresponds to what I had in mind but wasn’t sure about the doing so “on our own behalf so that they could never know the origin of those requests”.
From there on I feel better. AdGuard DNS is, as i mentioned above, extremely fast, here in France anyway. Nice job.
Thanks for the info.
Hello,
Can anyone recommend a solution to get rid of Youtube ads without rooting my phone?
Can a DNS approach be productive in this regard?
Happy new year to all!
I use YouTube Vanced, if you have a YouTube account you need to to install MicroG to access it. I have adguard paid version – does not block YT ad`s. Please look it up, it`s great and easy to follow instruction`s.
Best wishes, Lee.
Great, trying now!
Thank you
My pleasure,take care. :)
These kind of hints, that anything Russian is potentially dodgy at best have become quite tiresome, and it’s sad to see it here as well. Please avoid all kinds of country-discrimination.
No thanks, russians are known for scamming people online and I don’t trust russians with my DNS queries, country discrimination is fully valid in this case.
@Alex, I agree with you; personally I’m fed up with Russian bashing, initiated when and by whom I don’t know, spread afterwards by a mass of non identified followers. It is not only, contrarily to a common acceptation, governments which start clashes/wars but people as well : I’ve never been and never will be a propagandist of superiority. Nothing is perfect but perfectibility remains a reasonable aim and requires dialog, honesty, lucidity, humbleness.
@Tom Hawack: +1
People are sheep that need to be lead, so shut-up!
No need for Adguard DNS – I’ll take my chances with cloudflare and quad9.net. Running unbound in my Rpi to get dns-over-tls support for my whole LAN.
@mikef900000,
Cloudflare suffered a major breach a couple 12 months ago and, quote: “session tokens, passwords, private messages, API keys, and other sensitive data were leaked to random requesters.” https://github.com/pirate/sites-using-cloudflare
Quad9 is sponsored by US law-enforcement and they log various data: https://www.quad9.net/policy/
Me? I use my VPN’s non-logging DNS server, but it’s not available to non-account users. ;)
I’ve now switched to using DNS Watch which supports both IPv4 and Ipv6 as well as DNSSEC: https://dns.watch/index
After testing it for a couple of hours sites seem to load much faster than before. Servers are located in Germany though so might be a bit slower when accessing them for the other side of the Pond.
Same here Mikef… Ok pihole works great
Is it free? Oe has it some hidden freemium ‘”feature'”?
Does it call it home as in Telemetry?
It’s not blocking ads for me. Back to ublock Origin.
I tried AdGuard’s DNS for a while along with some other DNS providers. They have a DNS Crypt service, too, which encrypts the request from Aguard’s servers, adding outbound anonymity at least. Their service works well.
The issue I’ve run into when rolling my own DNS is if something goes wrong, it can get very confusing troubleshooting DNS issues through the OS, network adapters, IP, etc. Typically what happens is after months of no problems, suddenly sites won’t load and the question is always “How did I set this up again?”
DNS Switcher works well if you want to try out a few of them.
Now I just use my IP’s DNS service if not using a VPN and the VPN’s service if I am. Expecting high degrees of privacy outside a VPN or Tor is wishful thinking, so may as well keep it simple.
AdGuard’s browser Add On/Extension is free. Works well for the most part and is easy to understand. The Android version works well but doesn’t block in-app ads except in the paid version.
I moved from Ad Block Plus long ago as it became slower and slower, bloaty, a crap shoot when FF updated; they got confused and lost their way, it seems. The Element Blocker in AdGuard blows away ublock origin in functionality. The only real issue I’ve found with AdGuard is the Annoyance Filter can cause some major conflicts: elements not staying blocked, videos not playing, etc. The filter doesn’t seem to add much to browsing, so I don’t use it. The Base and Social Media filters block most everything.
“The Android version works well but doesn’t block in-app ads except in the paid version.”
Where is the paid version?
Martin, please clarify for Mozilla users:
https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
https://www.ghacks.net/2018/08/05/is-mozillas-new-dns-feature-really-dangerous/
I wanted to check the browser and went to about:config/trr and sure enough Mozilla Firefox is configured to use Cloudflare as the default DNS provider which means, I assume, that regardless if one uses a tool like DNS Jumper and adds additional recursive resolvers and sets AdGuard as the default DNS, Firefox will still use 1.1.1.1. as the DNS address rather than AdGuard.
Or maybe Mozilla changed? Don’t know.
@VioletMoon, Firefox handles DNS according to about:config settings (enable, setup, disable).
Because I already use specific system-wide DNS resolvers I disable Firefox’s so called TRR ( Trusted Recursive Resolver).
Here are the settings. Source : earthlng user.js v64.0-beta at https://github.com/ghacksuserjs/ghacks-user.js/releases
// 0707: disable (or setup) DNS-over-HTTPS (DoH) (FF60+)
// TRR = Trusted Recursive Resolver
// 0- Off (default). To use operating system resolver.
// 1- Race native against TRR. Do both in parallel and go with the one that returns a result first. Most likely the native one will win.
// 2- First. Use TRR first, and only if the secure resolution fails use the operating system resolver.
// 3- Only. Only use TRR. Never use the native (after the initial setup).
// 4- Shadow. Runs the TRR resolves in parallel with the native for timing and measurements but uses only the native resolver results.
// 5- Off by choice This is the same as 0 but marks it as done by choice and not done by default.
// [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
user_pref(“network.trr.mode”, 5);
user_pref(“network.trr.bootstrapAddress”, “”);
user_pref(“network.trr.uri”, “”);
As you see I’ve set network.trr.mode to 5 (Off by choice)
Up to everyone to enable and set or to disable.
Testing the [expletive deleted] comment system…..
Under capitalism, man exploits man. Under communism, it’s just the opposite.
What happened to my previous comment about Paessler’s PRTG (https://www.paessler.com/prtg)?
@X: +1 ;-)
I wanted to add “The same goes with any variants as soon as it’s based on a hierarchical structure”…
But the bloody comment system didn’t allow me to verify my post. Even less edit it…
Interesting that the area of safe dns has suddenly become more popular! There is cloudflare, quad 9, open dns, and of course Google. I probably wouldn’t go with a Russian company for various reasons. I have to say that cloudflare is quite simple on IOS. Works well and easily enabled or disable. Changing search engine to duckduckgo on my iOS devs as well at least keeps some data from Google!
Happy new year, Martin!
Warning: Totally unrelated to the topic.
As a New Year present to all, even for Martin to write an article on: Paessler’s PRTG, a powerful tool to monitor everything on your network (Internet included).
They do offer a free version with no registration required. See them at: https://www.paessler.com/prtg.
Happy New Year to (almost) all!
@X
I’ll give the free version a try…but…186MB file? really?
Virus total does give it a clean bill…
Also, will set a restore point first
You keep informing people about adblockers, then ask people not to use them on your site, hard to do because they would have to whitelist Google Adsense. It will bite you back.
Tried DNSBench and it was quite slow for me.
CloudflareDNS still remains the fastest one when it comes to resolving stuff but for some websites it gives me a different network route and serves different end-point IPs and those are VERY slow, as if I’m browsing those websites from a dial-up internet.
I’ll keep on using GoogleDNS. It’s slower than Cloudflare but not enough to notice a difference.
Any idea how to configure “https://dns.adguard.com/dns-query” in Windows 10 ?
I could not find details (in adguard site) on how to setup DNS-over-HTTPS in Windows 10
https://adguard.com/en/adguard-dns/overview.html
The only way to enable DoH in Windows 10 is to use “Simple DNSCrypt” or “dnscrypt-proxy 2” ?
@anonymous
right:
https://kb.adguard.com/en/dns/setup-guide
(last point before the FAQ)
https://dnscrypt.info/implementations/
you can also try another solution: adguard – home (see post above). especially for windows at an early stage of development. can be configured more individually + DoH & ToH (upstream -> cloudflare ressolver) + dns crypt support.
for me adguard – home doesn’t work on windows. could be the comodo – firewall. i need to take a closer look.
@crambie ( .. “but swapped to cloudfare as they were faster but sounds like they’re all the same now”)
.. adguard – dns is not an authoritative dns – server. thy upstream dns – requests:
https://twitter.com/AdGuard/status/1075402350297313283
and as far as adguard – home is concerned (see post above; new also for windows), you have the concrete choice (in this case cloudflare – dns is preconfigured).
@ Weilan
you trust Russian and China but not the West, you should not be trusting anybody, they are all playing us, we are being played with
Indeed, the enemies of my enemies are my friends only in mathematics.
Basic psychology, relevant of weakness, when one believes or even hopes that those opposed to what/whom he is confronted to are the way to go. That’s not a quest for friends but a desperate run for a sense of life as if we’s be legitimate to think as we do because others do, forgetting that it may be for different reasons.
I’ve never made mine the idiocy which is to believe in the “all rotten” yet I’d rather opt for “Neither West, East, North or South : be free, don’t search for approvals, especially within geopolitics.”
This said, I’m used to the Western World and I feel rather comfortable, whatever the problems, fake news, hypocrisy and you name it, in an area, in a culture where one can say his truth without fearing a trial.
“Some users may not want to send their entire DNS traffic to a Russian company; others may distrust Google or Cloudflare, or their ISP. Those who want to be in control may want to take a look at Pi Hole instead, a local solution based on Raspberry Pi devices.”
pi-hole is primarily an adblocker. It not a replacement for dns service provided by Google, Cloudfare etc. In fact it depends on such services to perform the dns lookup.
Always thought Adguard were American, never checked just presumed. I’ve not read or seen anything that flags them as dodgy and did try it a while back without any problems but swapped to Cloudfare as they were faster but sounds like they’re all the same now.
In Italy the AdGuard DNS are not fast like Google or Cloudflare ones, but the protection feature is a great value.
Thanks Martin and Happy New Year!
.. .. apropos adguard, dns, pi hole, et cetera – new news:
https://twitter.com/AdGuard/status/1079424665171517441
https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.92
– adguard home. for windows too! thrilling (imho).
https://adguard.com/en/adguard-home/overview.html
ps: had no time to test yet, still busy with comodo firewall & new computer.
pps: yeah, what an irony; my “windows – light” was “too much” for him.
The mysteries of networks… I recall having tested AdGuard DNS some time ago, having noticed ping 4 times those of other DNS resolvers and tracert ending with a Moscow based server if I remember correctly.
Just pinged and tracerted AdGuard DNS primary1, 176.103.130.130, and the ping is now the same as others I know, fast. Tracert shows that before ending to 176.103.130.130 (located in Russia), given my devices’s location (France) there are two hops via NTT America, Inc. servers,
81.93.181.101 (NTT America, Inc. FR)
82.112.96.238 (NTT America, Inc. UK)
So we’d have : my place (French castle!) to a UK based server to a RU based server? And what does NTT America have to do with a Russian company?
I’m all mixed up :=) Less than I’ll be tomorrow January 1st 2-0-1-9 : HAPPY NEW YEAR TO ALL!!!
It used to be quite slow. I guess it has improved. The optimal approach is to use AdGuard software with Cloudflare DNS.
Is this a New year present for gHacks readers? Happy New year Martin!!!
:)
I already voice my opinion in the previous article, I like it on phone. Better than having an application always running to create a local VPN for filtering, mainly for battery saving reasons.
Happy New Year!
I trust Russia and China, the West scares me with their practices of acting like they care about the people and their privacy. The USA and UK are the most disgusting to me in that regard.
Russian operators and websites are required to keep your data, check out the Yarovaya law. Some VPN providers have withdrawn, and Opera’s VPN blocks some sites if you’re in Russia. Their government doesn’t even have to do the spying. And if you want someone’s data you can simply pay someone who knows someone. As for China, they block slightly more outside websites and VPNs, and arrest a bit more people for social media posts, than Russia does.
Your choice.
@The Commenter
Since this article has been cooling down, I think now I can contribute a few points of my very personal view with specific facts to your little off-topic political agenda discussion, to avoid pissing off some sensitive ones who could be unable to accept such facts again finally.
You have provided some facts about China, which only touched the skin of its real problem. Since I never used to live a life in Russia, let me just talk about China.
“Under capitalism, man exploits man. Under communism just the opposite”, right^^? The truth is that, even if a chineses student
talks about Marxism publicly not in accordance with the CCP’s wishes but in solidarity with oppressed laborers and workers whom a Communism pary should originate from and speak for, he could be banned from their national LAN services which is controlled by the Great Firewall (they don’t have a so-called “real” Internet as we know). Usually the worse cases occure to him would be, mandatory suspension, beaten and kidnapped by the plainclothes polices, illegal detention unable to meet your lawyer as the two canadians were recently, and which is also almost one million Uyghur people suffering now because the CCP forces them to give up their faith, who just disappeared from the outside. Or just the worst, He could be charged with “inciting subversion of state power” then be put into jail like the former Nobel Peace Prize Chinese winner Liu Xiaobo until his death from some fatal diseases, i.e, a terminal liver cancer.
https://de.labournet.tv/search?search_api_views_fulltext=jasic
https://en.wikipedia.org/wiki/Jasic_Incident
So it is not that I didn’t intend to trust China under the control of the CCP, but they made me unable to trust them, because their ruling by law but rule of law, their “One Party to Rule Them All”, no judicial independence, no separation of powers. But I trust my Chinese friends, who are the same kindly and friendly as those in the West, who also live under suppression by the CCP for decades.
Here are two speeches from the 35C3 presenting why (I think) the Chinese *Social Credit System* is shaping China a high-tek version of Orwellian 1984, plus a bit of Brave New World by Huxley only for their upper class, which would take you about only one and a half hour in your valuable weekend together. Maybe you could ask yourself if you would really like to live such a life with your children in the near future.
https://media.ccc.de/v/35c3-9904-the_social_credit_system (highly recommend with fluent English expressing and rich details which is the same AFAIK from my Chinese friends)
https://media.ccc.de/v/34c3-8874-gamified_control
So this is not some ignorant and naive “Good Commie or Bad Commie” guessing game which was only popular in the West and US of A last century, but “whether you are a good person or bad person”, or “Good Communist or Bad Communist”, to the CCP.
At last I’d like to refer to this interview: https://www.youtube.com/watch?v=ox-shlDXKO4
the *WARNING* at the end of this video continuously happened repeatedly modern times, in USSR, in China during their “Cultural Revolution”, in East Germany, being happening in North Korea right now, in Iran maybe, which has been ready to happen in China once again. It’s our duty to stop it I think.
That’s it.
@The Commenter,
Since you’re turning it into Communism VS Democracy, the basic way to put this is like this:
With Communism, whatever you say which isn’t good for the Party, you get punished.
With Democracy, whatever you say doesn’t matter, as nobody cares, aka “a lone voice in the wilderness”. Communism sucks, because none of the attempts have ever worked, but Democracy is also illusory as it tricks people to think that they can say what they want as if any of it matters. But instead their voices get ignored so it sucks equally.
But this is not a political blog so I don’t intend to talk about this anymore. I was just saying that the West puts Russia and China in a bad light, like they are the bad guys, but the West are the biggest assholes out on this planet.
The nations that top the world happiness index are mostly social democracies.
Neither communist nor entirely capitalist – Democratic Socialism; It lies somewhere in between. I like the Scandinavian way and think It’s a shame we all can’t meet in the middle and settle our differences – we’d all be happier for it!
(The world happiness index by the way, is determined by the same organisation that calculates national GDP)
@Weilan, what do democracy and communism have to do with The Commenter’s above comment?
Russia existed before the U.S.S.R and carries on after, Russia is no longer communist, anything you want but certainly not communist! I’m sure there are some Americans who still believe Russia is just another name for the USSR in the same way some (the same?!) believed Obama was a Muslim. Communism is over now, finished. Doesn’t mean social aspirations and revolts are buried, but that’s another topic.
Yes, and hasn’t “communist” China become the biggest bunch of capitalists you’ve ever seen? Now if they could just learn to label their junk with real brand names instead of labeling everything CHINA.
Tom, I’d like to add that China, while having one party labeled “Communist” has been more capitalist in their dealings than the West has been for decades. Both Russia and China are more autocratic than most Western countries. I don’t believe either country has free health care, or is taxed to provide the illusion of free health care. But, these days the difference between East and West is soft of like the difference between US Republicans and US. Democrats.
Russia has “free” healthcare, you could have at least try to google it.
Oh! DVDRambo, I entirely agree, basically. Basically because I’m aware of two points,
1- Comparing is a tough challenge : GDP or GDH (Gross Domestic Happiness), domestic and foreign policies, human rights (am I entitled to define a right as universal?) etc etc.
2- What do I know of what, whom I compare? I know what is reported, I try to distinguish clichés from facts then true facts from fake ones, but is this enough to allow me to compare? Not sure.
I know what I live and still, not totally. Objectivity is a tough challenge but even if it is never complete it remains a valuable aim : like the lottery, having the ticket is not enough but required nevertheless to win.
@Tom Hawack: you are absolutely right. Nevertheless, I do not think Weilan meant it strictly as Communism vs Democracy, but rather as the “bad” guys (who used to be the Communists, now the Russians) vs the “good” guys (who always have been the West, the beacon of morality).
There are still “bad” Communists out there: China, and there are even “good” Communists: Vietnam.
@Klaas Vaak, what’s the only day where we can say that yesterday was last year? Ask it to an audience and see who answers first. To make it slightly confusing we can spice it with “Poetry and astronomical digressions apart, what’s the only day where we can say that yesterday was last year”. Obvious, right?! Well, you’ll always have minds to believe that what seems obvious must hide a ruse ;=)
Interpreting a comment is the source of many clashes, misunderstanding or deducting what is not explicit. What I meant when answering @Weilan on his/her answer on @The Commenter’s comment was that, IMO, there was nothing which explicitly nor even implicitly raised a political argument. We may very well as @Weilan trust “Russia and China” and nevertheless agree with @The Commenter’s statement that “Russian operators and websites are required to keep your data, check out the Yarovaya law.” : one one hand a sentiment (trust) and on the other a fact (data logging). The worst in this opposition is to consider that trusting a country which logs users’ data is not compatible with trust, but I perceive no legitimate digression leading to communism and democracy : after all data logging is not specific to Russia and the only difference would be that spying on users in the Western world is led by private companies when it is or may be led by governments elsewhere. Lastly, Big Ears are very much the fact of the Western world and are not really what you could call deployed by private companies…
That’s all what I meant to say : interpreting one’s words is a trending behavior, maybe because of modern life’s speed leading to speedy understanding in a speedy world. We are, i’m afraid, confronted to an increasing lack of fine-tuned ideas and their understanding. That’s when I feel like taking a seat, inviting others to do as well, and to choose between “Peace (& love) bro” or a more academic wording such as “Zen, my friends”. Whatever, let’s take the time to read and listen comfortably, open-minded!
Happy New Year to all :=) Peace ‘n’ Love in a Zen attitude, yeah!
I use Adguard DNS on my Android phone with Blokada and set it in the Wifi settings on my Ipad.
I also use a Raspi with Pihole at home.
Martin, why do you say they are a Russian company? Aren’t they located in Cyprus?
Why don’t you say stress out anything for USA companies? Europe?
In Russia, DNS resolves you.
In Soviet Russia….
It is company founded by three Russians in Russia. Company headquarters were moved, AFAIK, to Cyprus: https://adguard.com/en/contacts.html
Here is the alert pop-up:
https://images2.imgbox.com/73/6a/W2dGNpC9_o.jpg
Only a website with phishing content blocked in my test:
https://www.phishtank.com/phish_search.php?valid=y&active=All&Search=Search