AdGuard Home Configuration: Blocklists, Rules, and Fine-Tuning

Blocklist Selection Strategy

Navigate to Filters → DNS Blocklists in AdGuard UI.

Philosophy

Two approaches:

1. Start slow, add lists gradually and monitor your query logs and whitelist false positives.
2. Alternatively, enable all lists and then constantly troubleshoot when things don’t work. And they won’t!

I highly recommend the first approach, the second one leads to many unhappy family members.

The lists below are what I currently use alongside my custom filtering rules. My setup changes regularly, so don’t blindly copy it. Figure out what lists work best for your own use case and network.

Essential Blocklists

Most of these are available directly through Add Blocklist → Choose from the list in AdGuard. For any that aren’t, use Add a custom list and paste the URL.

HaGeZi Device Tracker Lists

HaGeZi maintains device-specific tracker lists that block telemetry without breaking functionality:

HaGeZi Security Lists

HaGeZi also provides an Allowlist Referral list (~912 domains) that prevents false positives from aggressive blocklists. Worth enabling if you’re running Pro++ or multiple lists.

Other Security Lists

Custom Filtering Rules

Navigate to Filters → Custom Filtering Rules.

Rule Syntax

||example.com^          # Block domain and all subdomains
||ads.example.com^      # Block specific subdomain
@@||example.com^        # Whitelist/unblock domain

Whitelisting False Positives

Aggressive lists block legitimate services. Whitelist as needed:

@@||cdn.jsdelivr.net^
@@||fonts.googleapis.com^
@@||ajax.googleapis.com^

Finding what to whitelist:

1. Navigate to Query Log
2. Filter by client IP having issues
3. Look for blocked domains during failure
4. If domain looks legitimate, whitelist it

DNS Configuration Optimization

Disable DNS Caching

Navigate to Settings → DNS Settings → DNS Cache Configuration.

Set everything to zero:

cache_size: 0
cache_ttl_min: 0
cache_ttl_max: 0

Disable AdGuard’s cache if you have an upstream resolver (like Unbound) that already handles caching. Two cache layers cause stale entries, inconsistent results, and harder debugging.

DNS Server Settings

Navigate to Settings → DNS Settings → DNS Server Configuration.

Query Logging

Navigate to Settings → General Settings → Query Log.

Retention Settings

Query log retention: 90 days
Statistics retention: 90 days

I use 90 days for historical troubleshooting. Longer retention uses more disk space, so adjust based on what you have available.

Client IP Anonymization

Anonymize client IPs: Disable

I disable this for per-device visibility. Enable if multiple people share your network and you want privacy.

Client Settings and Parental Controls

Navigate to Settings → Client Settings.

AdGuard supports per-client blocking levels and client tags for bulk management. Tags like kids-devices, iot-devices, or work-devices let you apply different filtering policies without configuring each device individually.

Settings → Parental Control offers Safe Browsing (Google Safe Browsing API) and Safe Search (forced safe search on Google, Bing, DuckDuckGo). Both send data to Google, so consider the privacy trade-off. I don’t use either since blocklists already cover malware protection and all traffic goes through VPN.

Monitoring and Maintenance

Dashboard Metrics

Navigate to Dashboard in AdGuard UI.

Using Query Log

Navigate to Query Log.

Filters:

• Blocked: Show only blocked queries
• Client: Filter by device IP
• Domain: Search specific domain

Troubleshooting workflow when user reports broken site:

1. Filter query log by client IP
2. Look for blocked queries during failure
3. Match blocked domain to broken service
4. Whitelist if false positive

Backups and Updates

Back up your config at Settings → General Settings → Backup and Restore before making major changes. Blocklists auto-update every 24 hours.

General Advice

Avoid enabling too many blocklists at once. Lists overlap, and stacking them blindly makes it harder to trace what blocked what when something breaks. Add lists one at a time and give each a few days before adding the next.

Regularly review your query logs and whitelist anything that shouldn’t be blocked. False positives are inevitable with any blocklist, and catching them early saves you from chasing down “why doesn’t this site work” later.

Disclaimer

Use the information provided here at your own risk, but if you find errors or issues in this guide, leave a comment and I’ll try to address them ASAP.