Your DNS filtering is probably being bypassed by devices on your network right now

I set up AdGuard Home, configured my blocklists, and assumed I had DNS under control. I didn't.

Google Home devices were ignoring DHCP and sending DNS straight to 8.8.8.8. Browsers were using DNS-over-HTTPS on port 443, invisible to my resolver. Android apps were connecting to hardcoded DNS IPs, skipping hostname resolution entirely.

The ad query for ads.tracking-nightmare.com? Getting resolved somewhere I don't control. My blocklists never saw it.

There's a whole family of bypass methods happening simultaneously. Hardcoded DNS, DoH on port 443, DoT on port 853, DoQ on UDP 853. Your resolver just sits there with nobody talking to it.

I wrote up the 5 layer defense I built to catch most of it: NAT redirects for port 53, blocking 853, using HaGeZi's DoH/DoT blocklist, and IP-level firewall blocks against known public resolvers. Also covers what you still can't catch. Meta bundles DoH into their CDN infrastructure, so blocking it breaks their apps entirely.

If you're running any kind of DNS filtering and haven't addressed these bypasses, your filtering is more of a suggestion than a rule.

https://blog.dbuglife.com/locking-down-dns-on-your-home-network/