DNS Blocking, VPNs, and Network-Level Privacy

Network-layer defenses protect every device on your network — phones, smart TVs, IoT gadgets — that can’t run a browser extension. This is the layer most people skip and the one with the broadest reach.

DNS sinkholing (block trackers for the whole house)

A blocking DNS resolver refuses to resolve known ad and tracker domains, so those requests never leave your network.

• Pi-hole — the classic self-hosted option. Runs on a Raspberry Pi, a small VM, or a container; point your router’s DNS at it and every device is filtered. Gives you query logs, per-client rules, and blocklist management. (If you run a Proxmox or home-lab setup, Pi-hole or AdGuard Home in a container/LXC is the natural home for this.)
• AdGuard Home — similar to Pi-hole, single-binary, with a cleaner UI, built-in encrypted-DNS upstream, and per-client filtering. Easier first setup for many people.
• NextDNS — a hosted resolver if you don’t want to self-host. Configurable blocklists, per-device profiles, encrypted DNS, and logs, with a generous free tier. Works on mobile data too via its profiles.

Point your router at the resolver to cover everything, or configure devices individually if you can’t change the router.

• googleapis.com 57.4%
  Infrastructure — blocking this breaks pages
• gstatic.com 55.2%
  Infrastructure — blocking this breaks pages
• googletagmanager.com 51.2%
  Tracking / advertising — safe to sinkhole
• google.com 40.9%
  Tracking / advertising — safe to sinkhole
• google-analytics.com 39.7%
  Tracking / advertising — safe to sinkhole
• doubleclick.net 29.7%
  Tracking / advertising — safe to sinkhole
• facebook.net 18.9%
  Tracking / advertising — safe to sinkhole
• cloudflare.com 15.8%
  Infrastructure — blocking this breaks pages
• cloudflareinsights.com 12.9%
  Infrastructure — blocking this breaks pages
• jsdelivr.net 10.2%
  Infrastructure — blocking this breaks pages
• googlesyndication.com 8.1%
  Tracking / advertising — safe to sinkhole
• youtube.com 6.7%
  Tracking / advertising — safe to sinkhole

The twelve third-party domains seen on the most pages. A DNS resolver decides by hostname alone, and the two with the widest reach of all are Google's font and static-asset CDNs — sinkhole those and you break layout and functionality across most of the web. This is the entire reason blocklists are curated rather than generated: the top of this list is where over-blocking happens.

Our data The State of Web Tracking — reach across 15.7M pages in the June 2026 crawl The “breaks pages” marking is our editorial classification of domains whose function is fonts, CDN, or static assets.

Encrypted DNS

Whatever resolver you use, use DNS over HTTPS (DoH) or DNS over TLS (DoT) so your ISP can’t read or log which domains you look up. Browsers (Firefox, Chrome) can do DoH directly; AdGuard Home and NextDNS support encrypted upstreams for the whole network.

VPNs: what they actually do

A VPN encrypts your traffic to the VPN server and replaces your IP address, so sites and your ISP see the VPN’s IP, not yours, and your ISP can’t see which sites you visit. That is real and useful — especially on untrusted Wi-Fi and against IP-based tracking and geolocation.

What a VPN does not do, despite the marketing:

• It does not stop cookies, login-based tracking, or browser fingerprinting. Logged into Google or Facebook over a VPN? Still you.
• It does not block ads or trackers (unless the VPN bundles a blocker).
• It moves your trust from your ISP to the VPN provider — so the provider matters. Choose an audited, no-logs provider with a clear ownership story; Mullvad, Proton VPN, and IVPN are the commonly cited privacy-respecting choices. Avoid “free” VPNs, which often monetize your traffic.

Network-layer tool	Blocks tracker requests	Covers every device	Hides your IP from sites	Hides browsing from your ISP	Stops cookies & fingerprinting
Pi-hole / AdGuard Home self-hosted, router-wide	● Yes	● Yes	○ No	○ No	○ No
NextDNS hosted, per-device profiles	● Yes	● Yes	○ No	◐ Partly	○ No
Encrypted DNS alone DoH / DoT, no blocklist	○ No	◐ Partly	○ No	◐ Partly	○ No
VPN the layer most people overrate	○ No	◐ Partly	● Yes	● Yes	○ No

●Yes○No◐Partly

Read the last column first: it is empty. Cookies, logins, and fingerprints are decided inside the browser, and nothing you install on the network can reach them. A VPN and a DNS blocker solve genuinely different problems — the VPN column and the blocking column barely overlap — which is why “I use a VPN” is not an answer to “am I being tracked”.

Source webtracking.org analysis of documented resolver and VPN behavior Assumes a VPN without a bundled blocker; several providers add one, which effectively gives them the DNS-blocking row too.

Encrypted DNS earns only a “partly” against your ISP for a reason worth stating plainly: it hides the lookup, but your ISP still sees the destination IP address you then connect to. For most sites that is enough to infer where you went.

Sensible setup

DNS blocking (Pi-hole/AdGuard Home/NextDNS) + encrypted DNS gives the widest tracker reduction. Add a reputable VPN for IP privacy on the move and on shared networks. Together they cover the network layer; combine with browser and extension layers for depth.