There have been various articles online this week around privacy issues, mostly around cookie notices on websites. Not surprisingly the tools recommended went from Firefox and Linux (Cory Doctorow) to Safari and various extensions (John Gruber). I didn’t actually agree with either one of their lists not only because I thought their choices were poorly thought out but that they didn’t include probably the most impactful thing you can do for your online privacy before anything even hits your web browser: privacy/security-focused DNS.
Intro
This is my opinionated guide to two DNS services after having used both of them for years. No, I do not recommend NextDNS. It is a poorly supported service. For other options and guidance see:
Both of those sites offer a lot of information about online privacy in general.
Both AdGuard and Control D offer multiple options in this space for anyone from the person who just wants some routine ad/tracker filtering for free to the enthusiast who wants full control over DNS blocklists, querying their DNS logs, etc. and is willing to pay for a subscription.
For the super-enthusiast there is pihole and AdGuard Home. These require running services on your own system. I have never used these and have no desire to so I will leave those as an exercise for the reader.
The Options
For the basics in privacy/security-focused DNS, Control D has this good write-up of the options available but DNS boils down to two options:
- Standard DNS where the user configures their system with a pair of DNS servers. This requires no other configuration but from a security standpoint isn’t the best option.
- DNS-over-HTTPS (DoH) which provides encryption between your system and the DNS server so nobody can see your DNS queries. All modern web browsers support this natively but for more robust filtering computer operating systems require additional setup.
Standard/Free
For those that don’t want to mess around with much the easiest thing is just to configure your computer/phone/whatever with one of the following:
- AdGuard Public DNS (see option 2 - plain DNS)
- Control D (see “legacy resolvers” after selecting an option)
These are preconfigured DNS servers that will do a ton to increase your privacy and security online.
DoH/Subscription
For those that want a lot more configuration and other goodies AdGuard and Control D offer subscription-based DNS for personal use:
I personally use/pay for AdGuard DNS after using Control D for several years but both are excellent services. I prefer AdGuard because it is integrated with AdGuard’s other tools that I also use.
DNS Blocklists
Both AdGuard and Control D provide the ability to use various pre-configured blocklists for removing ads/trackers/etc. This is a huge subject itself and I won’t say much more about it but this is the major advantage to these systems.
My recommendation: Hagezi’s DNS blocklists, available for a wide variety of tools. Both AdGuard and Control D support these out of the box as options.
These lists offer various levels of filtering for ads/trackers/malware depending on how heavy-handed you want to get. The more you filter the more likely something will break. I personally use the Multi PRO list but stuff does break on occasion. I have never had an issue with Multi NORMAL or lower.
No matter which of these you choose you’ll be quite happy with the results.
Final Words
The most power here is in the subscription services. Both AdGuard and Control D provide software for just about every platform that allow you to use the configurations you’ve set up: one place to configure all of your devices and get the same protection on all of them. Not only that, this works for any application, not just web browsers, so if you’re concerned about your operating system or other applications “phoning home”, or ads/trackers in your email, this is the best way to block those things. For example: all of the major browsers phone home with telemetry. It can be turned off but it is opt-out, not opt-in. With AdGuard or Control D, and Hagezi’s blocklists, this stuff gets blocked regardless. Less setup and configuration on the user’s part once this is in place.
I can say this: after years of blocking ads and tracking with DNS-based services I have never had ads follow me, or worried if Facebook is listening to my conversations (hint: they aren’t. They don’t need to. They’ve got sophisticated tracking). If you don’t like Big Tech start with this powerful tool.