Pi-hole
Network-Wide DNS Ad Blocker
Ad blocking for your whole house, from one small box. Pi-hole filters ads and trackers at the DNS level, so every device — phones, TVs, consoles, smart gadgets — is covered without installing anything on them.
Pi-hole is free, open-source software that blocks ads and trackers for an entire network by acting as a DNS sinkhole. You run it on an always-on device — famously a Raspberry Pi, though any small server works — and point your router's DNS at it. From then on, every device on the network filters automatically, including the ones that cannot run a browser ad blocker, like smart TVs, consoles, and IoT gadgets.
How the DNS sinkhole works
The mechanism is elegantly simple. Pi-hole keeps blocklists of known advertising and tracking domains. When a device on your network asks to resolve a domain:
- If the domain is on a blocklist, Pi-hole returns a non-answer — so the device never connects to the ad/tracker server and nothing loads.
- If the domain is legitimate, Pi-hole forwards the query to an upstream resolver (which can itself be encrypted with DoT or DoH) and returns the real answer.
Because blocked requests are simply refused, the ads are stopped before they ever download — which can also slightly speed up page loads and save data.
Why people run it
| Benefit | Detail |
|---|---|
| Whole-network coverage | One install protects every device, no per-device apps |
| Blocks on unblockable devices | Smart TVs, consoles, and IoT that can't run ad blockers |
| Privacy | Cuts off many trackers at the domain level |
| Insight | A dashboard shows exactly what your devices are querying |
That dashboard is often an eye-opener — it reveals just how many tracking and telemetry requests a typical home generates in the background.
The limitations to know
Pi-hole blocks by domain, which sets natural limits. It cannot strip ads served from the same domain as the content (which is why some platforms' in-stream ads survive), and aggressive blocklists occasionally break legitimate sites, requiring a domain to be whitelisted. It also won't catch apps that hardcode their own DNS or use DoH to bypass your resolver. Pi-hole is a powerful, network-wide tracker-and-ad reducer — not a complete content filter, and best treated as one strong layer rather than the whole solution.
Pi-hole and encrypted DNS
A common, robust setup pairs Pi-hole with encrypted upstream DNS: your devices send plain queries to the Pi-hole on your LAN, and Pi-hole forwards the allowed ones to a public resolver over DNS over TLS or DoH. That gives you network-wide ad blocking and encrypted, private lookups beyond your network — combining filtering with the privacy that plain DNS lacks.