Guides

Block ads on Linux with DNS over TLS

Set up systemd-resolved to use Blokada Cloud over encrypted DNS over TLS, and block ads and trackers for every app on your Linux computer.

Updated

Most current Linux distributions, including Ubuntu and Fedora, resolve names through systemd-resolved, which supports DNS over TLS. On Debian, install it first with sudo apt install systemd-resolved. Point it at Blokada Cloud, and ads and trackers are blocked for every app on the computer.

Set up systemd-resolved

  1. Create the folder with sudo mkdir -p /etc/systemd/resolved.conf.d, then the file /etc/systemd/resolved.conf.d/blokada.conf with these settings:
[Resolve]
DNS=193.180.80.10#<your-id>.cloud.blokada.org
DNSOverTLS=yes
Domains=~.
  1. Restart it: sudo systemctl restart systemd-resolved
  2. Check it: resolvectl status shows +DNSOverTLS and the Blokada server.

The part after # is your Blokada DNS name: <your-id>.cloud.blokada.org systemd-resolved checks the server's certificate against it, and Blokada uses it to know which device is asking.

NetworkManager also passes on the DNS servers of your network. Domains=~. sends all lookups to Blokada, but if resolvectl status still lists another server on a connection, turn off automatic DNS for that connection (the Automatic switch next to DNS in its IPv4 and IPv6 settings).

Without systemd-resolved

If resolvectl isn't found, your distribution resolves names another way. Set up secure DNS in your browser instead, as in the browser guide, or set up your router to cover the whole home.

Check that it works

Open a few websites, then look at the Activity page in the dashboard. This computer's lookups show up there.

Want a VPN on this computer too? Blokada Plus includes a WireGuard setup that encrypts all traffic, with the same blocking.

Questions and comments