How to add AdGuard DNS via TLS

[Terepin]

This GUI is very confusing, because I can add it via DNS server setting, but the TLS setting is optional and can coexist with the regular DNS. So, how to do it properly?

 

[jacklul]

DNS Server field is the DNS server router's system will use, it's should be set to a reliable one.
It is used for time sync, DDNS and few other things.
So setting AdGuard's DoT server details in the DoT list is the way.

As far as I can tell it works like this:

WAN->DoT is disabled, no custom servers set in LAN->DHCP:
Router will advertise itself as DNS server and forward all DNS queries to servers set in WAN->DNS Server

WAN->DoT is disabled, custom servers are set in LAN->DHCP:
Router will advertise DNS servers specified in LAN->DHCP

WAN->DoT is enabled, no custom servers set in LAN->DHCP:
Router will advertise itself as DNS server and forward all DNS queries to servers set in WAN->DNS-over-TLS servers through Stubby
If servers set on that list are not IP addresses then they will first be resolved to IPs using a DNS server set in WAN->DNS Server

WAN->DoT is enabled, custom servers are set in LAN->DHCP:
Router will advertise DNS servers specified in LAN->DHCP
While Stubby is configured and launched in this case - the clients will never know about it

 

[OzarkEdge]

So, how to do it properly?

AdGuard Public DNS (DoT)
AdGuard Public DNS Setup
AdGuard Status
DNS Check

As I understand it, the DNS Server setting applies initially during boot until DoT takes over.

Last I knew, DoT interferes with initial Wyze cam setup, so I disable DoT (DNS Privacy Protocol none), complete the cam setup, and then re-enable DoT.

It's all very easy and a relief from ads and potential malvertising.

The AdGuard knowledgebase implies malicious website/URL blocking as is done by Cloudflare or Quad9, but I found the kb to be inconclusive on this point. AiProtection hits dropped to zero here after implementing AdGuard Public DNS, suggesting all past AiP activity was ad-related (looked like it).

Other DNSPs
1.1.1.2, 1.0.0.2, security.cloudflare-dns.com
9.9.9.9, 149.112.112.112, dns.quad9.net

The above information is adapted from my signature below.

OE

 

[Terepin]

I assume this is correct then?

 

[OzarkEdge]

I'd say so although I'm no expert with that DNS Check tool. Are the ads on this site being blocked?

OE

 

[bbunge]

Disable "Forward local domain querries to upstream DNS"

 

[OzarkEdge]

Disable "Forward local domain querries to upstream DNS"

Thanks, I missed that... it was not enabled in @Terepin's first post.

OE

 

[Terepin]

Disable "Forward local domain querries to upstream DNS"

Done.

I'd say so although I'm no expert with that DNS Check tool. Are the ads on this site being blocked?

OE

I already use AdGuard app, this is for other devices on my network to block as much tracking as possible.