Block ads at the DNS level

Where ads actually come from

When a page or an app shows you an ad, that ad almost never comes from the site you're visiting. It comes from a separate ad network: a company whose entire business is serving ads into slots on other people's pages and apps. Your browser or app loads the page, sees an ad slot, and then makes a separate request to the ad network's servers to fetch whatever ad wins the split-second auction for that slot.

That separate request is the key detail. Before your device can fetch the ad, it has to look up the ad network's domain name through DNS, the same translation step that turns every web address into a server location. If that lookup never gets an answer, the ad request can never be made, and the ad can never load. The page renders as if the ad slot was never there.

DNS-level ad blocking exploits exactly this. A filtering DNS server keeps lists of known ad-serving domains, maintained from public blocklists and updated continuously as new ad networks appear. When your device asks for one of those domains, the server refuses to resolve it. No resolution, no connection, no ad. The same mechanism also catches the tracking domains that build advertising profiles of your browsing, since most trackers live on dedicated domains too.

Why this beats a browser extension

Browser ad blockers are good tools, but they have structural limits that DNS-level blocking doesn't share. The biggest one is scope. An extension only runs inside the browser it's installed in, and only on the pages you visit there. It does nothing for the ads inside your phone's apps: the banner in a free game, the video ad in a news app, the sponsored slot in a social feed. Those all fetch from ad networks over connections the browser extension never sees. DNS filtering sits underneath all of it, so one setting covers Safari, Chrome, and every app on the device at once.

The second advantage is that DNS blocking is invisible to the page. Many sites now run anti-adblock scripts that detect when a browser extension hides or removes ad elements, and then nag you to disable your blocker or refuse to show content. Those scripts work by checking whether the ad elements they expected actually rendered. With DNS-level blocking, the ad request fails at the network layer before the page's JavaScript ever runs, so there's nothing for the detection script to find. From the page's perspective, the ad network simply didn't respond, which looks identical to a network hiccup.

Then there's performance. A browser extension has to inspect every page as it loads, match elements against filter rules, and modify the page in real time. That work costs CPU cycles and memory on every single page load. DNS blocking does its work once per domain lookup, in milliseconds, on a remote server, before any content downloads. Your device does less work, pages load faster because they're not downloading ad payloads in the first place, and on mobile that translates directly into less data usage and measurably better battery life.

Finally, DNS blocking needs no per-browser setup and no maintenance. You configure it once per device, or once per router for the whole household, and it protects every browser and app from then on, including browsers you install later and apps that don't support extensions at all. There is no extension to update, no filter list to refresh manually, and nothing that breaks when a browser vendor changes its extension platform, which has happened more than once in recent years.

What DNS blocking can't do

Honest accounting matters here, because DNS blocking has real limits. It works by domain name, so it can only block ads that are served from a separate, identifiable ad domain. Ads that a site serves from its own domain, sometimes called first-party ads, look like ordinary content to the DNS server and will still load. Sponsored posts inside a social feed usually fall into this category too, since they come from the platform's own servers.

Video ads baked into a stream are another edge case. If a video platform serves its ads from the same domains as its content, which the largest ones increasingly do, DNS filtering can't separate the ad from the video without blocking the video too. Browser extensions with cosmetic filtering can sometimes handle these cases better, because they can inspect and modify the page after it loads. This is the one area where the two approaches genuinely complement each other rather than compete.

The practical takeaway: DNS-level blocking eliminates the large majority of display ads, banners, popups, and trackers across your whole device, and a browser extension can mop up the first-party remainder inside the browser if you want both. Most people find that DNS blocking alone gets them far enough that they stop noticing ads at all.

How Koru Shield does it

Koru Shield's ad blocking is a category you toggle on in your dashboard, not a separate product to install. When enabled, your DNS queries are checked against curated ad and tracker blocklists in addition to the security lists that block phishing and malware. The lists update automatically, so new ad networks get picked up without you doing anything.

Because the filtering is tied to your personal profile, you control it per device. You can turn ad blocking on for the whole household from the router, keep it strict on the kids' tablets, and leave it off on a work laptop if your employer's tools need the ad domains for some reason. The dashboard shows you what's being blocked, so if a site ever breaks because something it needs got caught by a list, you can allowlist that domain in a few clicks instead of disabling everything.

All of this runs over DNS-over-HTTPS, so your lookups are encrypted between your device and Koru Shield's servers. That means your ISP can't see which ad domains you're blocking, or build its own profile from your DNS traffic while you're busy blocking everyone else's trackers. Privacy tools should not leak the very data they're protecting.

Turning it on

If you already use Koru Shield, ad blocking is one toggle in your dashboard under filtering categories. If you don't, create a free account and follow the setup guide for your devices. Each one takes about a minute: iPhone and iPad use an encrypted configuration profile, Android uses Private DNS, and computers and routers use a simple settings change. Once any device is pointed at Koru Shield, enabling the ad category starts blocking immediately, no restart required.

To confirm it's working, visit an ad-heavy news site you know well and compare before and after. The difference is usually obvious within seconds: faster loads, no banners, no autoplay video ads, no cookie-consent popups that were themselves loaded from tracking domains. Then check your dashboard, which will show the blocked ad and tracker queries rolling in.