What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can build DNS-based ad blocking on Android, iPhone, and a home router without NextDNS, but no single setting works the same way on all three. Android offers a system Private DNS field that accepts a provider hostname, plus app-based options such as RethinkDNS. iPhone uses an encrypted DNS configuration profile rather than an app, and Apple’s current documentation for that route lists iOS 27 as its baseline. A router filters the devices that send their DNS queries to it, which is not the same as filtering every query on the network. The sections below take each layer in turn and then show where each one stops.
What DNS blocking can and cannot cover
DNS filtering decides whether a device gets an address for a hostname. Ad and tracker domains can be refused that way, but DNS filtering does not block every ad embedded in content served from the same site, and it does nothing for traffic that never performs a DNS lookup. Google states the boundary for its own feature:
As an Amazon Associate I earn from qualifying purchases.
“Private DNS helps secure only DNS questions and answers. It can’t protect anything else.”
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Source: Google Android Help, “Manage advanced network settings on your Android phone”.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Three consequences follow for every setup in this guide:
- First-party ads, served from the same domain as the page you are reading, can get through.
- Apps that use their own encrypted DNS resolver may never send their lookups to your filtering resolver.
- A resolver only blocks what its lists and rules cover, so filtering quality depends on that configuration.
What the evidence does not establish
The platform documentation cited in this guide explains how each DNS feature is configured. None of it compares these options with NextDNS on blocking coverage, speed, battery use, or privacy, and none of it reports measured results. This guide therefore makes no parity claim. The one figure that appears is a feature count published by the provider: RethinkDNS’s documentation describes more than 190 predefined blocklists. That page does not state a date, and the number is the provider’s own rather than an independent audit.
Android: the built-in setting and an app route
Android gives you two routes. The built-in setting changes only the resolver. An app such as RethinkDNS adds a firewall alongside DNS filtering.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Built-in Private DNS
Google’s help page lists three choices: Off, Automatic, and Private DNS provider hostname. Automatic does not name a filtering provider of your choosing, so the steps below use the hostname option. Google’s guidance is to keep the setting enabled once it is configured, and it describes the setting as working on networks that support it, so test it on each network you use. Menu locations vary by manufacturer. Google’s page does not specify which protocol Private DNS uses, so this guide does not assert one.
- Open Settings and search for “Private DNS.” On many phones the setting sits under Network & internet or Connections; the exact label differs by manufacturer.
- Select “Private DNS provider hostname” rather than Off or Automatic.
- Enter the hostname your filtering provider publishes for Android. Use the exact string the provider gives you; this guide does not supply one.
- Save, then load a page known for heavy advertising. Expected result: normal pages still load, blocked hostnames fail to resolve, and the lookups appear in the provider’s query log if it offers one.
RethinkDNS: DNS and firewall in one app
RethinkDNS describes itself as private DNS plus firewall for Android. Its DNS documentation covers configurable rules and more than 190 predefined blocklists, and it can be used through its own app or through compatible DoH clients. The difference from the built-in setting is the firewall, which controls which apps can use the network; the built-in option only selects a resolver. Check the current feature list in the RethinkDNS DNS documentation before setup, because service details change. The product overview is at RethinkDNS’s “Rethink DNS + Firewall” page.
If you need a particular transport, AdGuard’s “Encryption” wiki page lists DoH, DoT, DNSCrypt, and DoQ among the options for its Android and iOS apps. That page is part of AdGuard Home documentation, so it shows protocol coverage rather than comparing the apps. Confirm current app features inside the app itself.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Running the built-in setting and an app together
It is tempting to stack the two, with the built-in setting beneath RethinkDNS or another app. No cited documentation explains how the two interact, and none validates a formal “dual-engine” architecture. Treat any such combination as untested. If you try one, pick a single primary resolver, change one thing at a time, and reverse the change if pages stop loading or blocking disappears.
iPhone: an encrypted DNS profile instead of an app
On iPhone, the counterpart to the Android setting is a configuration profile that tells the system to send DNS queries to an encrypted resolver. No app runs on the phone. The profile is only as useful as the filtering it points to, and it is not a universal toggle.
What Apple’s DNS configuration can do
Apple’s DNS settings declarative configuration page, published September 17, 2026, describes a configuration that can:
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
- Route DNS queries through an encrypted server using DNS over HTTPS or DNS over TLS.
- Apply to selected domains rather than every query.
- Use on-demand rules to control when the configuration is active.
- Fall back to the default resolver through a failover option.
The same page lists iOS 27 and iPadOS 27 as its baseline platforms. It does not establish support for earlier releases, so do not assume the profile route works on iOS 26 or older. Confirm your version under Settings > General > About before you start.
Installing a profile
- Obtain a DNS configuration profile from your filtering provider that targets iOS and the encrypted transport it supports. If the provider publishes no iPhone profile, this route does not apply to that provider.
- Download the profile to the iPhone, for example by opening the file link in Safari. When the download completes, iOS shows a “Profile Downloaded” entry in Settings; open it and follow the prompts to install.
- Check that the profile is listed under Settings > General > VPN & Device Management. Labels can change between iOS releases, so verify the path on your version.
- Test on an ad-heavy page. Expected result: pages load and blocked hostnames fail to resolve. If the provider offers a query log, lookups from the phone should appear there.
Failover changes what gets filtered
Failover keeps lookups working when the encrypted resolver cannot be reached, but those fallback queries go to the default resolver and are not filtered by your profile. If your profile lets you choose, keep failover on when working DNS matters more than strict blocking. Turn it off when strict blocking matters more, and accept that lookups can fail while the resolver is unreachable. Check how your profile sets failover before you install it.
Work-managed iPhones
Apple’s guidance “Filter content for Apple devices” says a DNS Settings payload deployed through device management applies only to managed Wi-Fi networks, and that it can apply to selected queries or to all of them. A managed payload is therefore scoped differently from a personal profile. Do not treat a company-deployed payload as evidence of how your own profile will behave.
Best Value
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Router: a household baseline with limits
Apple’s guidance on recommended settings for Wi-Fi routers and access points explains that connected devices generally use the DNS server configured in the router. That makes the router the one place you can set a resolver for a whole household without touching each device. It is a baseline, not a guarantee.
Where a router setup helps and where it stops
- It covers devices that accept the DNS server the router provides, including guest devices and gadgets you cannot configure directly.
- It does not cover devices that use their own encrypted DNS, such as an Android phone with Private DNS enabled, an iPhone with a DNS profile, or an app with its own DoH setting. Those devices send lookups to the resolver they have chosen.
OpenWrt with AdGuard Home
OpenWrt’s AdGuard Home guide covers installing and configuring AdGuard Home on OpenWrt, and its example redirects IPv4 DNS traffic on port 53 to AdGuard Home. Your router must run OpenWrt, so check your exact model against OpenWrt’s hardware support before buying or flashing. Follow the installation steps for your firmware; the guide does not validate any particular device.
Quick Recap
Plan for these limits:
- The example is IPv4-specific. IPv6 DNS needs its own handling and is not covered by it.
- Firmware and ISP-supplied gear may expose fewer DNS controls than OpenWrt does.
- After OpenWrt or AdGuard Home upgrades, re-check the redirect rule and the DNS server the router hands to clients.
Checking what the router actually covers
- On a test device, confirm in its Wi-Fi network settings that the DNS server is the router’s address.
- Open AdGuard Home’s query log and load a page with heavy advertising from that device.
- Expected result: the page’s lookups appear in the log, and ad domains show as blocked.
- Turn on Private DNS (Android) or install an iPhone DNS profile on the same network, then load the page again. Expected result: those lookups no longer appear in the router’s log, which confirms the bypass described above.
- If the device reaches the internet over IPv6 and its lookups never appear in the log, IPv6 DNS is bypassing the router.
Which layer to start with
| Option | Scope | Platform and version | Filtering controls | Transport | Maintenance |
|---|---|---|---|---|---|
| Android Private DNS (built in) | The Android phone, on networks that support it | Android; menu location varies by manufacturer | Set by the provider hostname you enter | Provider hostname; protocol not specified on Google’s page | Keep the hostname current with your provider |
| RethinkDNS | The Android phone; DNS plus firewall | Android app; DNS through the app or compatible DoH clients | Configurable rules; more than 190 predefined blocklists (provider count, date not stated) | DoH clients | App updates; check service details in the documentation |
| iPhone configuration profile | This iPhone; selected domains or all queries, depending on the configuration | iOS 27 or iPadOS 27 baseline per Apple’s page; earlier versions not stated | Set by the profile’s provider | DNS over HTTPS or DNS over TLS | Reinstall or update the profile when the provider changes it; managed payloads apply only to managed Wi-Fi |
| Router with AdGuard Home on OpenWrt | Every device that uses the router’s DNS | OpenWrt-supported router; depends on model and firmware | Configured in AdGuard Home | Port 53 redirect in the guide’s IPv4 example; IPv6 not covered | Re-check the redirect and DNS server after firmware or AdGuard Home upgrades |
Pick your starting point by what you own:
- One Android phone and no router access: start with the built-in Private DNS hostname. Add RethinkDNS only if you want the firewall, and test any combination.
- An iPhone on iOS 27 or iPadOS 27: use a provider profile and decide on failover before installing. On earlier versions, Apple’s page does not cover this route.
- A household with an OpenWrt-capable router: start with the router layer as a baseline, then check which devices use encrypted DNS on their own.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
