Explainer
What Is DNS Filtering? How It Works, and What It Can't Do
DNS filtering is a way of blocking websites, ads, trackers and malware by refusing to look up their addresses. Every app on a computer has to ask the Domain Name System (DNS) where a server is before it can connect. A DNS filter sits in the middle of that question, and for names on a blocklist it answers "nowhere". The app never gets an address, so nothing loads. That one trick is why DNS filtering covers every program on a device, not just a browser.
How DNS filtering works, step by step
Here's what happens when an app on your PC wants to load ads.example.com:
- The app asks for an address. Before connecting anywhere, it sends a DNS lookup: "what's the IP address for
ads.example.com?" - The filter checks the name. The DNS resolver handling the lookup compares the name against its blocklists, and against any allow list you've set.
- Blocked names get a dead end. For a match, the resolver replies with an empty address such as
0.0.0.0, or says the name doesn't exist. The app has nowhere to connect. - Everything else is passed on. Names not on a list are looked up normally and the real address goes back to the app.
Nothing is downloaded and then hidden. The blocked request simply never happens, which is also why DNS filtering tends to save bandwidth rather than cost it.
DNS blocking vs. DNS filtering
You'll see both terms. DNS blocking usually means the act of refusing a lookup; DNS filtering is the broader system of lists, categories and exceptions that decides what gets blocked. In practice people use them interchangeably.
What a DNS filter can block
Because it works on names, a DNS filter is good at anything that lives on its own domain:
- Ad networks and trackers, including the analytics and telemetry built into desktop apps.
- Malware, phishing and scam domains, and the command-and-control servers infected machines call home to.
- Crypto-mining scripts that run in a browser tab.
- Whole categories, like gambling, adult content or social networks, when a list exists for them.
- Search and video settings. Some filters can force SafeSearch or YouTube Restricted Mode by steering those services' names to their restricted versions.
Where DNS filtering runs
The same idea is packaged three ways, and the trade-offs are real:
| Where it runs | Examples | Covers | Who sees your lookups |
|---|---|---|---|
| A cloud DNS service | Filtering resolvers from providers like Quad9, NextDNS or Cloudflare | Any device you point at it | The provider |
| Your network | A Pi-hole or router-level filter | Every device on that network | The box on your network |
| The device itself | An app like AdBolish | Every app on that one PC | Stays on the PC |
A network filter is the right tool if you want to cover phones, TVs and consoles. An on-device filter is the right tool if you want one Windows PC covered wherever it goes (home, office, café Wi-Fi) without setting up hardware.
What DNS filtering can't do
Being honest about the limits saves a lot of confusion later:
- It can't split a domain. If the ad comes from the same server as the content, blocking one blocks both. That's why DNS filters generally don't block YouTube's video ads, or ads inside some streaming and social apps.
- It can't see the page. DNS only reveals the name being looked up, not the URL path or the page content. Cosmetic clean-up (hiding empty ad boxes) is a browser extension's job.
- It can be bypassed. A browser using its own encrypted DNS never asks your filter. We cover that in what secure DNS is and why it skips filters.
- It isn't antivirus. Blocking a known-bad domain stops a download or a phishing page from loading, but it doesn't scan files or remove anything already installed. Keep Windows Security on.
- Lists are never complete. New domains appear every day. A filter blocks known domains; no list blocks everything.
DNS filtering on a Windows PC
On Windows, an on-device DNS filter works by running a small resolver on the PC and pointing your network adapters' DNS at it. That's what AdBolish's system-wide blocking does:
- It runs a local resolver at
127.0.0.1with HaGeZi blocklists for ads and trackers, threats, crypto-mining and encrypted-DNS bypass, all on by default. - When you click Restart as administrator and approve the prompt, it routes the PC's DNS through itself, so every app is filtered. Changing adapter DNS is an administrator-only setting in Windows, and the rights don't carry over, so you click it again after each sign-in.
- Blocked names get
0.0.0.0. Everything else goes to your network's DNS, or encrypted to Quad9, Cloudflare, NextDNS or a custom DoH address if you choose one. - It catches CNAME cloaking too: a harmless-looking domain that quietly points at a blocked one is blocked, and the log marks it via CNAME.
When you quit, sign out, update or uninstall, your original DNS settings come back. If its own lookups keep failing, it hands DNS back to your network so you stay online.
The Activity page then shows each blocked request with the app that asked. For a lot of people that is the moment DNS filtering clicks: the list of programs on their PC quietly calling trackers is longer than they expected.
Is DNS filtering worth it?
For most people, yes, as a base layer. It's cheap to run, it covers apps no extension can reach, and it stops bad domains before anything loads. Pair it with a browser extension if you want cosmetic filtering inside web pages, and with antivirus for files. If you're specifically after ads, our guide to DNS ad blocking on Windows goes deeper, including how it compares to editing the hosts file.
AdBolish is a free DNS filter for Windows 10 and 11. It runs on your PC, filters every app once you approve administrator rights, and never records the lookups it allows.
Do it for every app at once — System-wide blocking
AdBolish answers your PC's DNS lookups itself, so ad, tracker and malware domains never load, in your browser, in Windows, in Office, in games and in every other app. Learn more about the System-wide blocking.