DNS Ad Blocking on Windows: Block Ads in Every App

DNS ad blocking stops ads before they load by refusing to look up the addresses of ad servers. Every program on your PC (Chrome, Edge, Office, a chat app, a game launcher, Windows itself) asks the Domain Name System where a server lives before connecting. Answer "nowhere" for ad and tracker domains, and those requests never happen, in every app at once. That's the big difference from a browser extension, and it's why DNS blocking is the usual answer to "how do I block ads in apps on Windows?"

How DNS ad blocking works

A DNS ad blocker is a DNS resolver with a blocklist:

1. An app asks for the address of, say, ads.example.com.
2. The blocker checks the name against lists of known ad, tracker and malware domains.
3. If it's listed, the blocker replies 0.0.0.0 (nowhere). If not, it looks the name up normally.

Because the ad is never downloaded, there's nothing to hide afterwards, and less data used. For the bigger picture, including category and malware filtering, see what DNS filtering is.

DNS ad blocking vs. a browser extension

They're good at different things:

The honest summary: DNS blocking is the wide net, an extension is the fine comb. They pair well rather than replacing each other everywhere.

DNS ad blocking vs. the hosts file

Before DNS blockers were easy to run, the classic Windows trick was the hosts file at C:\Windows\System32\drivers\etc\hosts. Add a line like 0.0.0.0 ads.example.com and Windows treats that name as unreachable for every app.

It works, and it's free. The catches:

• You need administrator rights to edit it, and you maintain it by hand. Ad lists change daily.
• No wildcards. You have to list every subdomain individually.
• No visibility. There's no log of what was blocked or which app asked, so when a site breaks you're guessing which of thousands of lines did it.
• Undo is manual. Allowing one domain means finding and deleting its line.
• Very large files can make lookups sluggish on some setups.

A DNS blocker does the same job with lists that update themselves, subdomain matching, a log, and a one-click allow. For a handful of domains you want gone forever, the hosts file is still fine.

The three ways to run DNS ad blocking

• A network blocker such as Pi-hole, or filtering DNS set in your router. Covers every device on that network: the right choice for phones and TVs. Needs hardware or router access, and doesn't follow a laptop out the door.
• A cloud DNS service you point your device at. Easy, works anywhere, but the provider sees every name you look up.
• An app on the PC. Covers every app on that one computer wherever it goes, and the lookups stay on the machine. This is where AdBolish sits.

How to set up DNS ad blocking on Windows with AdBolish

1. Install AdBolish. It installs for your Windows account and starts with the blocklists it ships with, so there's nothing to download first.
2. Wait for Protection on. The first run compiles the lists, which takes a moment.
3. Click Restart as administrator and approve the Windows prompt. Pointing your network adapters' DNS at AdBolish is a system setting, so Windows requires administrator rights. The header then reads Filtering every app on this PC.
4. Close the window. It keeps filtering from the tray, and lists update once a day.

Two things to know up front. Administrator rights don't carry over to the next start, so after each Windows sign-in you click Restart as administrator again to filter every app. And a browser set to always use its own secure DNS skips any DNS blocker; AdBolish shows a banner naming it, and our explainer on secure DNS covers the fix.

Out of the box AdBolish uses HaGeZi lists (GPL-3.0) for Ads & trackers, Threats, Crypto-mining and Encrypted DNS bypass. Optional lists add Device & app telemetry (see our guide to disabling telemetry in Windows 11), Newly registered domains and content filters. The details are on the system-wide blocking page.

What DNS ad blocking won't block

• YouTube video ads, and other ads served from the same servers as the content. DNS works per domain and can't split them off.
• Ads baked into an app's own interface that come with its normal content.
• A browser using its own secure DNS, until that setting is off.
• Anything on a domain no list knows about yet. No blocklist catches 100% of ads.

When something breaks

Any blocker eventually catches a domain a site needs: a checkout, a sign-in, a video player. In AdBolish, click Site broken?, pick the domain blocked in the last minute, and choose Allow for 1 hour or Always allow. Our guide on turning off an ad blocker for one site walks through it, along with the extension equivalents.

AdBolish blocks ads, trackers and malware at the DNS level for every app on your Windows PC. It's free, needs no account, never records the lookups it allows, and puts your original DNS back when you quit or uninstall.