AdGuard Home is a network-wide DNS server that blocks ads and trackers for every device on your network at once, the same idea as Pi-hole, but with encrypted DNS, parental controls, and a modern dashboard built in. Point your devices at it and it swallows tracking domains before they resolve: no ad loads, because the request never gets an answer. Built by the team behind the AdGuard ad blockers and public AdGuard DNS, it ships as a single dependency-free binary that runs almost anywhere, from a Raspberry Pi to a full server.
Where AdGuard Home came from
AdGuard has built ad-blocking software since 2009, starting with browser extensions and desktop apps for Windows, Mac, Android, and iOS. AdGuard Home is its self-hosted, open-source sibling: a standalone DNS server built on the same filtering engine as AdGuard’s public DNS servers, so you run it on your own hardware instead of trusting someone else’s resolver. It’s written in Go with a React front end, compiling to one static binary.
License: AdGuard Home is licensed under GPL-3.0 (GNU General Public License v3), confirmed directly from the LICENSE file in the AdguardTeam/AdGuardHome GitHub repo, not assumed from a badge. Unlike Pi-hole’s EUPL-1.2, GPLv3 requires source code to stay available to anyone you convey the software to, though a personal, unmodified install doesn’t trigger that obligation, it only applies once you distribute the software itself.
Quick facts: Official product page adguard.com/adguard-home · GitHub AdguardTeam/AdGuardHome, 35,200+ stars · Current stable release v0.107.77 · Docker image adguard/adguardhome, 100M+ pulls
How AdGuard Home blocks ads and trackers
Same trick as any DNS sinkhole: your devices ask it to resolve a domain, it checks that domain against your blocklists, and a match gets refused instead of resolved. Nothing loads, because the device never gets an address to connect to. Point your router’s DHCP at it and every device is covered automatically, including smart TVs and IoT gadgets that can’t run a browser extension.
Past that basic job, AdGuard Home also runs natively as a DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC server, encrypting traffic end to end with no extra software, and applies per-client rules, SafeSearch, and parental controls from the same dashboard.
AdGuard Home vs Pi-hole
Both projects do the same job, DNS sinkholing, and both have spent years insisting they do it better than the other. Ask five self-hosters which one to run and you’ll get six opinions. AdGuard Home’s own README ships a comparison table making its case; independent threads on Reddit, Level1Techs, and It’s FOSS Community broadly agree on the shape of it, even when they disagree on the winner:
| Category | AdGuard Home | Pi-hole |
|---|---|---|
| License | GPL-3.0 | EUPL-1.2 |
| Core engine | Custom Go DNS proxy | Modified dnsmasq (FTLDNS) |
| Encrypted upstream DNS (DoH/DoT/DoQ) | Built in | Needs added software (cloudflared, unbound) |
| HTTPS admin panel | Built in | Manual lighttpd setup |
| Malware, phishing & parental filters | Built in | Needs non-default blocklists |
| DHCP server | Optional, built in | Optional, built in |
| Root-free operation | Supported | Not supported |
| Native cross-platform builds | Linux, Windows, macOS, FreeBSD, OpenBSD | Linux only (Docker elsewhere) |
| Blocklist ecosystem | Smaller, curated in-app | Larger (Firebog, Gravity), bigger community |
That table leans on AdGuard’s own README, so treat it as the vendor’s case, not a neutral verdict. What holds up independently: AdGuard Home front-loads more built-in protocols and a friendlier wizard, while Pi-hole stays minimal and leans on Gravity’s blocklists and a bigger third-party tooling community. Neither blocks ads sharing a domain with the content itself, a DNS-filtering limit, not either project’s fault. For Pi-hole’s install steps and hardware needs, see our full Pi-hole review.
Installing AdGuard Home with Docker
AdGuard Home ships its own official Docker image, maintained by the AdGuard team, with over 100 million pulls. A minimal compose file:
services:
adguardhome:
container_name: adguardhome
image: adguard/adguardhome:latest
restart: unless-stopped
volumes:
- './work:/opt/adguardhome/work'
- './conf:/opt/adguardhome/conf'
ports:
- "53:53/tcp"
- "53:53/udp"
- "3000:3000/tcp"docker compose up -dThat covers DNS blocking plus the setup wizard. Per AdGuard’s getting-started guide, three ports must be reachable: 3000/tcp for the first-run wizard, 80/tcp for the admin panel, 53/udp for DNS. Want DHCP too? Add 67:67/udp and 68:68/udp. Want DNS-over-TLS, DNS-over-QUIC, or DNSCrypt? Docker Hub’s instructions list the full port set. First launch opens a browser wizard for choosing listening interfaces and creating an admin account directly, no environment variable to remember, unlike Pi-hole’s password step.
Hardware: AdGuard Home compiles to one Go binary with official builds for Linux, Windows, macOS, FreeBSD, and OpenBSD across amd64, arm, arm64, and more, plus a dedicated Raspberry Pi install guide. No database engine, no GPU requirement, a lightweight image in the tens of megabytes. Anything already running Pi-hole, a Pi Zero 2 W or an old NAS, runs AdGuard Home just as easily. Our homelab setup guide for beginners covers the trade-offs.
We rate AdGuard Home Easy, same as Pi-hole, checked against independent write-ups, not assumed: It’s FOSS Community and Level1Techs both call it the easier of the two to get running, largely thanks to its interactive wizard replacing Pi-hole’s environment-variable password step. The base Docker install is one container either way. The optional complexity: which encrypted-DNS protocols to expose, and whether to hand it DHCP duties.
Don’t expose port 53 (or 853, or 3000) to the public internet. AdGuard Home is a DNS resolver, and any open resolver is a target for DNS amplification and reflection attacks: an attacker spoofs a victim’s address, fires small queries at open resolvers, and each fires back a much bigger reply. That’s as true of AdGuard Home as of Pi-hole: neither belongs on the open internet. Keep it on your LAN and reach it remotely over a VPN or Tailscale instead. We make the same case for Vaultwarden and Nextcloud.
AdGuard Home: pros and cons
- Blocks ads, trackers, phishing, and malware domains, plus parental controls, out of the box with no extra software
- Native DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC, encrypted upstream DNS without bolting on cloudflared or unbound
- Free and open source under GPL-3.0, single static binary, official builds for five platforms including Raspberry Pi
- Only blocks what DNS can see, so ads sharing a domain with the content itself, YouTube being the classic example, still get through
- Smaller blocklist ecosystem and third-party tooling community than Pi-hole’s
- A crash or reboot takes DNS down for every device pointed at it, the same single-point-of-failure trade-off as Pi-hole
Alternatives worth knowing about
Pi-hole is AdGuard Home’s closest competitor and gets the full comparison above, not repeated here. NextDNS runs the same idea as a cloud service, no hardware required. Technitium DNS Server is another self-hosted option gaining ground with people who want more direct control over DNS itself, since it runs a full recursive resolver rather than just forwarding filtered queries.
Browse our Network & Security archive, or our Docker & Containers archive, for more homelab tooling.
FAQ
Is AdGuard Home really free?
Yes. The self-hosted server is free and open source under GPL-3.0. AdGuard sells separate paid products (ad blockers, VPN, hosted DNS), but AdGuard Home itself needs no license.
Can I run AdGuard Home and Pi-hole together?
You can, but it’s rarely useful since both do the same job. The one combination that makes sense is chaining one to forward upstream through the other for encrypted DNS, though picking one is simpler to operate.
Does AdGuard Home need a Raspberry Pi?
No. Neither project requires one despite Pi-hole’s name. AdGuard Home runs on any always-on Linux box, NAS, or Docker host, a Raspberry Pi is just a cheap, low-power option.