We rely on the Domain Name System (DNS) to provide valid IP addresses or requested websites won’t load. However, some DNS services can return a fake IP address on purpose. This is useful when you want to block certain domains, such as those serving adverts or other content. There are several free DNS services able to do that.
Here is a selection of nine free DNS services that are able to block a range of content, including ads, trackers, adult content, and other undesirable/malicious content. For help with adding DNS servers to Windows and related software, read the article “How to change DNS settings in Windows”.
1. AdGuard Public DNS
In recent times, AdGuard has branched out from its ad blocking apps into VPNs and DNS based services. AdGuard Home provides local DNS blocking and customization and AdGuard DNS is more of an advanced version of the free public DNS, with a limited free version available.
The public DNS is the simpler option and can be used on any device where you can change its default DNS servers. In addition to plain DNS servers, AdGuard also has support for DNSCrypt, DNS over HTTPS, DNS over TLS, and DNS over QUIC.
AdGuard Default DNS
This will block advertisements, trackers, and malicious websites which is ideal for average adult users.
- IPv4 – 94.140.14.14, 94.140.15.15
- IPv6 – 2a10:50c0::ad1:ff, 2a10:50c0::ad2:ff
- DNS over HTTPS – https://dns.adguard-dns.com/dns-query
- DNS over TLS – tls://dns.adguard-dns.com
AdGuard Family Protection DNS
In addition to blocking ads, trackers, and bad websites in the default DNS, this option also blocks adult content and sets search engines to safe search and safe mode.
- IPv4 – 94.140.14.15, 94.140.15.16
- IPv6 – 2a10:50c0::bad1:ff, 2a10:50c0::bad2:ff
- DNS over HTTPS – https://family.adguard-dns.com/dns-query
- DNS over TLS – tls://family.adguard-dns.com
There is also a completely unfiltered DNS for more advanced users. For those addresses or others not listed here (DNSCrypt), visit the AdGuard Public DNS webpage. There are also helpful guides for adding a different DNS to several devices.
2. Control D
Control D is a newer Canadian DNS service that started in 2021. The founders of this project are also the same founders of the popular WindScribe VPN. In terms of the free DNS servers on offer, the selection is huge and dwarves any of the other free services.
The standard DNS servers range from malware only blocking to a full family friendly filter. There is also an “Uncensored” filter that removes certain geo restrictions although I won’t list it here as it’s unrelated to the article.
Control D Malware
Simply blocks malicious and phishing domains.
- IPv4 – 76.76.2.1, 76.76.10.1
- IPv6 – 2606:1a40::1, 2606:1a40:1::1
- DNS over HTTPS – https://freedns.controld.com/p1
- DNS over TLS – tls://p1.freedns.controld.com
Control D Ads and Tracking
Blocks malware, ads, and trackers.
- IPv4 – 76.76.2.2, 76.76.10.2
- IPv6 – 2606:1a40::2, 2606:1a40:1::2
- DNS over HTTPS – https://freedns.controld.com/p2
- DNS over TLS – tls://p2.freedns.controld.com
Control D Social
This filter adds social networks to the ads and tracking filter.
- IPv4 – 76.76.2.3, 76.76.10.3
- IPv6 – 2606:1a40::3, 2606:1a40:1::3
- DNS over HTTPS – https://freedns.controld.com/p3
- DNS over TLS – tls://p3.freedns.controld.com
Control D Family Friendly
Instead of blocking social networks, this filter blocks adult content and drug related websites in addition to malware, ads, and trackers.
- IPv4 – 76.76.2.4, 76.76.10.4
- IPv6 – 2606:1a40::4, 2606:1a40:1::4
- DNS over HTTPS – https://freedns.controld.com/family
- DNS over TLS – tls://family.freedns.controld.com
Control D Third Party Filters
The third-party filters consist of 14 different sets of DNS servers, one for each available filter. The included filters are OISD Full/Basic, Steven Black Unified, Dev Dan, NoTracking, 1Hosts Mini/Lite/Pro, Hagezi Normal/Pro/Pro Plus/Ultimate, GoodByeAds, and AdGuard.
Click on Configure next to whichever filter you want to use and the servers will pop up at the bottom. The OISD lists would be a good place to start as they aim to block as much as possible while trying not to break web pages or entire sites.
Control D Custom Configuration
The last free option from Control D is the custom configuration. These servers are only available for DNS over HTTPS and DNS over TLS, not IPv4/v6. They will work in Chrome, Firefox, Windows 11, or other software that accepts DOH. You have a selection of nine different filters to mix and match for more focused blocking.
Just click on one or more of Ads and tracking, adult content, dating, drugs, gambling, government sites, malware, phishing, and social networks. The relevant URL will appear to add to your device or software at the bottom.
3. OpenDNS
OpenDNS is perhaps the longest running of all these free DNS services although it is these days owned by Cisco. There are two options when choosing to use OpenDNS servers. You can just add the Family Shield DNS servers into your software or device and receive adult content blocking by default.
If you choose to create a free account, you can customize OpenDNS to block a full range of content on your network. There are around 60 categories in total, ranging from ads, adult content, and file sharing, to social media, gambling, and forums. You can also custom block or allow individual domains.
OpenDNS Family Shield
Blocks adult content only.
- IPv4 – 208.67.222.123, 208.67.220.123
- IPv6 – 2620:119:35::123, 2620:119:53::123
- DNS over HTTPS – https://doh.familyshield.opendns.com/dns-query
OpenDNS Standard
These DNS servers are used with the free account to block whatever you select from the account settings.
- IPv4 – 208.67.222.222, 208.67.220.220
- IPv6 – 2620:119:35::35, 2620:119:53::53
- DNS over HTTPS – https://doh.opendns.com/dns-query
Moreover, the online account also offers other features like a custom block page, logs and statistics, and botnet/phishing protection. One thing you need to make sure is to keep a dynamic IP address up to date if you have one. This can be logging into the account and updating the address or running the updater tool on a PC.
4. NextDNS
NextDNS is like a more advanced version of OpenDNS that is also included in Firefox’s DNS over HTTPS list by default. A free account gives you the ability to block a range of content, including ads/tracking, adult content, social networks, online gaming, and streaming. Browser and Youtube searches are optionally set to safe mode.
The only drawback is the free tier of NextDNS is limited to 300,000 queries per month. Content blocking is disabled if you go over the limit and it behaves like a standard DNS. This is fine for average or light users, but heavy web users would probably exceed this limit well before the month is up.
- IPv4 – 45.90.28.180, 45.90.30.180
- IPv6 – 2a07:a8c0::a6:c37a, 2a07:a8c1::a6:c37a
- DNS over HTTPS – https://dns.nextdns.io/[your ID]
- DNS over TLS/QUIC – [your ID].dns.nextdns.io
When you create an account, a unique ID is generated that needs to be inserted into DNS over HTTPS/TLS/QUIC URLs. With IPv4 addresses, you will need to link your external IP address, which the website details can be done in various ways.
In addition, NextDNS has dedicated apps for Windows, Android, iOS, MacOS, and Linux. Click on your account at the top to see how many queries have been made and how many are left. NextDNS is packed full of interesting and advanced features, which is great for geeks, advanced users, and those that like to experiment.
5. CleanBrowsing
While CleanBrowsing offers paid services of its DNS filtering, they are not required and the free DNS filters are enough for most users. CleanBrowsing is a well known and highly respected service. It is one of only four services that are included by default in the Chrome/Chromium secure DNS option in settings.
There are three options for which DNS filter to use. They range from a simple malware blocker up to a full family filter that blocks several child unfriendly websites. Sadly, ads are not blocked by the free CleanBrowsing DNS servers.
CleanBrowsing Security Filter
The security filter blocks malicious content including phishing and spam.
- IPv4 – 185.228.168.9, 185.228.169.9
- IPv6 – 2a0d:2a00:1::2, 2a0d:2a00:2::2
- DNS over HTTPS – https://doh.cleanbrowsing.org/doh/security-filter/
- DNS over TLS – tls://security-filter-dns.cleanbrowsing.org
CleanBrowsing Adult Filter
This filter adds adult and explicit website blocking to the Security Filter. The Google and Bing search engines are set to safe mode.
- IPv4 – 185.228.168.10, 185.228.169.11
- IPv6 – 2a0d:2a00:1::1, 2a0d:2a00:2::1
- DNS over HTTPS – https://doh.cleanbrowsing.org/doh/adult-filter/
- DNS over TLS – tls://adult-filter-dns.cleanbrowsing.org
CleanBrowsing Family Filter
Family Filter is the one that is included in Chrome’s secure DNS feature and it has the highest level of protection. In addition to the adult filter, proxy/VPN and mixed content websites are also blocked, and YouTube search is set to safe mode.
- IPv4 – 185.228.168.168, 185.228.169.168
- IPv6 – 2a0d:2a00:1::, 2a0d:2a00:2::
- DNS over HTTPS – https://doh.cleanbrowsing.org/doh/family-filter/
- DNS over TLS – tls://family-filter-dns.cleanbrowsing.org
If you are more concerned about keeping your kids safe from unsavory content and are not so worried about ads and trackers, CleanBrowsing is a good choice.
6. CloudFlare
DNS wise, most people associate Cloudflare with its 1.1.1.1 DNS service because it’s been heavily promoted for its no selling data policy and fast speed. However, Cloudflare does also offer a couple of other servers geared more toward family usage and blocking malicious/inappropriate content.
Contrary to some information online, Cloudflare’s DNS servers do not block ads or trackers in general, unless they specifically fall into the malicious category. DNS over HTTPS and DNS over TLS addresses are also available.
CloudFlare Malware DNS
This simply blocks malicious content.
- IPv4 – 1.1.1.2, 1.0.0.2
- IPv6 – 2606:4700:4700::1112, 2606:4700:4700::1002
- DNS over HTTPS – https://security.cloudflare-dns.com/dns-query
- DNS over TLS – tls://security.cloudflare-dns.com
CloudFlare Malware and Adult Content
Blocking adult content is added to the malware blocking DNS service.
- IPv4 – 1.1.1.3, 1.0.0.3
- IPv6 – 2606:4700:4700::1113, 2606:4700:4700::1003
- DNS over HTTPS – https://family.cloudflare-dns.com/dns-query
- DNS over TLS – tls://family.cloudflare-dns.com
A number of setup guides are available for smartphones, game consoles, and computers. There is also a dedicated 1.1.1.1 app for Android and Apple iOS.
7. Neustar UltraDNS Public
UltraDNS Public by Neustar, is quite similar to CleanBrowsing. It concentrates more on being family friendly by blocking adult related websites and other content you wouldn’t want your youngsters to see.
Privacy intruding trackers and ads are not blocked, which is unfortunate. There is a standard unfiltered DNS available for anyone that wants to use it.
Neustar UltraDNS Threat Protection
Websites that contain malware, ransomware, spyware, and phishing are blocked.
- IPv4 – 156.154.70.2, 156.154.71.2
- IPv6 – 2610:a1:1018::2, 2610:a1:1019::2
Neustar UltraDNS Family Secure
Additional websites that get blocked by the Family Secure filter include gambling, pornography, violence, and hate/discrimination.
- IPv4 – 156.154.70.3, 156.154.71.3
- IPv6 – 2610:a1:1018::3, 2610:a1:1019::3
There are several guides on the website for setting up your router, computer, or mobile device to use Neustar UltraDNS Public.
8. DNS for Family
In regards to blocking as much as possible, DNS for Family is one of the most comprehensive out of the box. It blocks pornographic websites and other related adult content, dating websites, advertising, malware and ransomware, scams and phishing, drugs and gambling, and proxies and VPNs.
It also turns on safe search for Google, YouTube, Bing, DuckDuckGo, and Yandex. Safe search blocks search results for adult content in those search engines.
DNS for Family
- IPv4 – 94.130.180.225, 78.47.64.161
- IPv6 – 2a01:4f8:1c0c:40db::1, 2a01:4f8:1c17:4df8::1
- DNS over HTTPS – https://dns-doh.dnsforfamily.com/dns-query
- DNS over TLS – tls://dns-dot.dnsforfamily.com
DNS for Family without Safe Search
If you don’t want to have safe search enabled in Google, YouTube, Bing, DuckDuckGo, and Yandex, then use this. Other than that, it’s exactly the same as the main DNS.
- IPv4 – 135.181.193.222
- IPv6 – 2a01:4f9:c011:d11::1
- DNS over HTTPS – https://dns-doh-no-safe-search.dnsforfamily.com/dns-query
- DNS over TLS – tls://dns-dot-no-safe-search.dnsforfamily.com
DNSSEC is supported along with DNSCrypt, there are also configuration files available for Apple devices on the website.
9. AhaDNS Blitz
This service was previously called pi-dns.com until 2020. AhaDNS is actually going through a bit of a transition from its standard DNS servers to a new service. This is called Blitz and is quite interesting. The downside is Blitz is DNS over HTTPS only and will not work in standard IPv4/v6 scenarios.
It will work in web browsers and devices where you can use the DNS over HTTPS (DOH) protocol. They offer a no logs policy and traffic is encrypted but the best feature is the blocklists. These are manually selectable from ads, privacy, malware, piracy, torrents, dating, drugs, gambling, social media, anti Google, and more.
Once you choose what to block, the Blitz page will display a DOH address for you to add to your device or software. Although adult content blocking is not specifically listed anywhere, it is part of some lists, like OISD or 1HOSTS.
Do note that some software, such as Chrome and Chromium-based browsers, will complain that the Blitz URL is invalid. However, the URL should still work and it still blocked content using Chromium during testing.
Alternative Free DNS Servers with Content Blocking
Besides the DNS services mentioned, there are others that might be worth a look. Yandex DNS has malware and family filters while Mullvad offers ad blocking for DNS over HTTPS/TLS. Quad9 is another DNS service that offers malware blocking. Norton DNS is a well-known name with security and adult content blocking DNS servers.