Privacy-First DNS: Pi-hole, AdGuard Home, and Unbound Setup

Why DNS Privacy Matters

Your ISP sees every domain you visit through DNS queries. Advertisers track you through DNS. Self-hosting DNS gives you privacy, ad-blocking, and faster resolution.

Pi-hole: Network-Wide Ad Blocking

version: "3.8"
services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    environment:
      - TZ=America/New_York
      - WEBPASSWORD=your_secure_password
    volumes:
      - ./pihole/etc:/etc/pihole
      - ./pihole/dnsmasq:/etc/dnsmasq.d
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8080:80/tcp"
    restart: unless-stopped

AdGuard Home: Modern Alternative

services:
  adguard:
    image: adguard/adguardhome:latest
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"  # Setup UI
      - "8080:80/tcp"    # Dashboard

AdGuard Home has a more modern UI and built-in DNS-over-HTTPS/TLS support.

Add Unbound for Recursive DNS

Instead of forwarding to Google or Cloudflare, resolve DNS directly from root servers:

services:
  unbound:
    image: mvance/unbound:latest
    volumes:
      - ./unbound:/opt/unbound/etc/unbound
    ports:
      - "5335:53/tcp"
      - "5335:53/udp"

# Point Pi-hole upstream to Unbound
# Custom DNS: 172.17.0.1#5335

Benefits

• Block ads on ALL devices (including smart TVs)
• No more tracking through DNS
• Faster browsing (cached responses)
• Parental controls and content filtering