Home Page » News » How To » How to Set Up a Local DNS Sinkhole on Android Using AdGuard Home (No Root)

How to Set Up a Local DNS Sinkhole on Android Using AdGuard Home (No Root)

19 min read Turn your Android phone into a local DNS sinkhole with AdGuard Home running in Termux. Block ads, trackers, and malware without rooting. October 13, 2026 12:00

Why a Local DNS Sinkhole?

Every time your phone queries a domain, the request travels to your ISP’s DNS resolver. That resolver often returns ads, trackers, or even malicious hosts that have been flagged by community blocklists. A DNS sinkhole intercepts those queries and returns a harmless address (usually 0.0.0.0) for any domain that matches a blocklist. The result is fewer ads, reduced data usage, and a modest privacy boost.

Running AdGuard Home on your Android device gives you a full‑featured sinkhole without needing root access. Because it runs inside Termux, the installation is portable, reversible, and works on most Android 7+ devices.

Before You Start

Device requirements: Android 7 (Nougat) or newer, at least 1 GB of free storage, and a stable Wi‑Fi connection.
Battery: Keep the phone plugged in during the initial setup. The sinkhole will stay active as long as the Termux session runs.
Network: You need a Wi‑Fi network that allows you to change the DNS settings on the device. Some public hotspots lock DNS to their own servers; in that case the sinkhole cannot be used.
Permissions: Termux will request storage access the first time you run it. Grant it when prompted.

If you plan to keep the sinkhole running 24/7, consider using a cheap USB‑C power bank or a dedicated Android device that stays on all the time.

Step 1 – Install Termux and Required Packages

Open the Google Play Store (or F-Droid for the open‑source build) and install Termux.
Launch Termux. The first launch will download additional data – wait until the prompt Welcome to Termux! appears.
Update the package repository and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
Install the tools needed for AdGuard Home:
```
pkg install wget curl tar proot -y
```
Optional but useful: install nano for quick file edits:
```
pkg install nano -y
```

These commands work on all Android devices that support Termux. If pkg fails, make sure you have a working internet connection and that the Play Store version of Termux is up‑to‑date.

Step 2 – Download and Extract AdGuard Home

Navigate to a convenient folder. We’ll use the home directory:
```
cd $HOME
```
Download the latest Linux‑ARM version of AdGuard Home. At the time of writing the URL is stable, but you can always fetch the most recent release from the GitHub releases page.
```
wget -O adguardhome.tar.gz https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.23/AdGuardHome_linux_arm.tar.gz
```
Extract the archive:
```
tar -xzf adguardhome.tar.gz
```
Move the extracted folder to a permanent location and clean up the archive:
```
mv AdGuardHome $HOME/adguardhome && rm adguardhome.tar.gz
```
Make the binary executable (Termux sometimes strips execute bits):
```
chmod +x $HOME/adguardhome/AdGuardHome
```

If the wget command fails with a 404, the version number in the URL has changed. Visit the GitHub releases page from a desktop, copy the latest linux_arm URL, and replace it in the command.

Step 3 – Run the Initial Setup Wizard

Start AdGuard Home for the first time:

$HOME/adguardhome/AdGuardHome -s install

The wizard will launch a temporary web server on http://127.0.0.1:3000. Open Android’s Chrome (or any browser) and navigate to that address.
Follow the on‑screen prompts:
- Admin password: Choose a strong password; you’ll need it to change blocklists later.
- Listen address: Keep the default 0.0.0.0 so the server listens on all interfaces.
- Port: Default 53 (standard DNS). If another app already uses port 53, change it to an unused port like 5353 and note the number for later.
Finish the wizard. The UI will redirect to http://127.0.0.1:3000/dashboard where you can see the status screen.

At this point AdGuard Home is running, but your Android system is still using the ISP’s DNS. The next steps point the device to the local resolver.

Step 4 – Configure Android to Use the Local DNS

Android provides two ways to set a custom DNS: the system‑wide Private DNS (DNS‑over‑TLS) and the per‑network DNS entry in the Wi‑Fi settings. Because our sinkhole works over plain DNS, we’ll use the Wi‑Fi method.

Open Settings → Network & internet → Wi‑Fi.
Long‑press (or tap the gear icon) on the network you are currently connected to and choose Modify network.
Expand Advanced options. Change IP settings from DHCP to Static.
- Leave the existing IP address, gateway, and network prefix as they are.
- In the DNS 1 field, enter 127.0.0.1 (or localhost).
- If you changed the AdGuard Home listening port to something other than 53, add :port after the address, e.g., 127.0.0.1:5353. Note that the Android UI only accepts a plain IP, so for non‑standard ports you’ll need to use the Private DNS method described below.
Save the changes and reconnect to the network.
If the Wi‑Fi network refuses the static configuration (some routers enforce DHCP only), switch to the Private DNS method instead.

After applying the settings, all DNS queries from apps on the device are sent to the AdGuard Home instance running in Termux.

Step 5 – Verify the Sinkhole Is Working

Open the AdGuard Home dashboard (still at http://127.0.0.1:3000/dashboard) and sign in with the admin password you set earlier.
Navigate to Queries. You should see a live list of domain lookups.
- Open Chrome and visit a site known for serving ads, such as example.com (replace with any ad‑heavy site you trust).
- Return to the dashboard; you should see entries like ads.google.com marked as blocked.
For a quick command‑line test, run:
```
dig +short @127.0.0.1 ad.doubleclick.net
```
The output should be 0.0.0.0 or an empty line, indicating the request was sinkholed.

If you still see the ads, double‑check the DNS settings in step 4 and make sure the AdGuard Home service is running (you’ll see a green “Running” badge on the dashboard).

Step 6 – Add Custom Blocklists (Optional but Recommended)

AdGuard Home ships with a default set of blocklists, but you can improve coverage by adding community‑maintained lists.

In the dashboard, go to Filters → Blocklists.
Click Add blocklist and paste one of the following URLs:
- https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts – a comprehensive hosts file.
- https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt – AdGuard’s own curated list.
- Any other URL that returns a plain‑text list of domains, one per line.
After adding, click Update now. The dashboard will show a progress bar.
Once the update finishes, repeat the verification step (open a site with known trackers) to confirm the new entries are blocked.

Remember that each additional list consumes memory and CPU. On low‑end devices keep the total number of entries below ~150 k to avoid lag.

Step 7 – Keep the Service Running After Closing Termux

Termux sessions stop when you close the app or when Android kills the process to reclaim memory. To keep AdGuard Home alive you can use the termux-wake-lock and termux-notification utilities, or simply run the service in the background with nohup.

Install the extra Termux utilities:
```
pkg install termux-api -y
```

Create a small wrapper script that starts AdGuard Home and holds a wake lock:

cat > $HOME/start-adguard.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/bash
# Acquire a partial wake lock so the CPU stays on
termux-wake-lock
# Start AdGuard Home in the background, redirect output to a log file
$HOME/adguardhome/AdGuardHome -c $HOME/adguardhome/AdGuardHome.yaml &> $HOME/adguard.log &
# Show a persistent notification so you know it’s running
termux-notification --title "AdGuard Home" --content "DNS sinkhole is active" --button1 "Stop" --button1-action "pkill -f AdGuardHome; termux-wake-unlock; termux-notification --remove" &
EOF
chmod +x $HOME/start-adguard.sh

Run the script:
```
bash $HOME/start-adguard.sh
```
Close the Termux UI (swipe away) – the wake lock keeps the CPU awake and the background process continues.
If your device aggressively kills background processes, enable Battery optimization → Don’t optimize for Termux.

To stop the sinkhole later, pull down the notification and tap the “Stop” button, or run pkill -f AdGuardHome from a new Termux session.

Troubleshooting Common Issues

Problem	Likely Cause	Solution
No DNS queries appear in the dashboard	Device still using ISP DNS	Re‑check Wi‑Fi static DNS entry; ensure you saved the changes and re‑connected.
AdGuard Home fails to start (error about port 53)	Another app (e.g., system DNS resolver) occupies port 53	Change the listening port in `AdGuardHome.yaml` (look for `bind_port`) and update Android DNS settings accordingly.
Ads still load after adding blocklists	Blocklist format mismatch or outdated list	Verify the URL returns plain text. Use the “Update now” button and watch the log ( `cat $HOME/adguard.log` ) for errors.
Termux process killed after screen off	Battery optimization or aggressive RAM cleaning	Disable optimization for Termux (Settings → Apps → Termux → Battery → “Don’t optimize”). Enable the wake lock script as shown in Step 7.
Cannot access `http://127.0.0.1:3000` from Chrome	AdGuard Home not running or firewall blocking loopback	Run `ps aux \| grep AdGuardHome` to confirm. If missing, start it with `$HOME/adguardhome/AdGuardHome -c $HOME/adguardhome/AdGuardHome.yaml`.

Advanced: Using Private DNS (DoH) with a Local Resolver

If your Wi‑Fi network forces DHCP DNS and you cannot set a static address, Android’s Private DNS feature can forward encrypted DNS to a local DoH endpoint. AdGuard Home supports DoH out of the box.

Enable DoH in AdGuard Home:

sed -i 's/^#\s*doH:/doH:/; s/^#\s*doH_port:/doH_port:/' $HOME/adguardhome/AdGuardHome.yaml

This uncomment lines and sets the default DoH port (443).

Restart AdGuard Home:

pkill -f AdGuardHome && $HOME/adguardhome/AdGuardHome -c $HOME/adguardhome/AdGuardHome.yaml &

Open Android Settings → Network & internet → Private DNS.
- Select “Private DNS provider hostname”.
- Enter 127.0.0.1 (Android accepts an IP as a hostname for DoH).
Confirm the connection by opening https://dns.google/resolve?name=example.com – you should get a JSON response from your local DoH server.

Note: Not all Android skins allow an IP address in the Private DNS field. If you encounter a validation error, you can create a local hostname by editing /etc/hosts via Termux (requires root) or use the Wi‑Fi static method instead.

Cleaning Up

If you decide the sinkhole is no longer needed, removal is straightforward:

Stop the service: pkill -f AdGuardHome
Delete the folder: rm -rf $HOME/adguardhome
Re‑enable the original DNS settings on your Wi‑Fi network (switch back to DHCP or restore the previous DNS IPs).

All your personal data remains on the device; AdGuard Home does not store any user‑identifying information unless you enable the optional statistics feature.

Wrap‑Up

By following this tutorial you have turned an ordinary Android phone into a lightweight, local DNS sinkhole that blocks ads, trackers, and known malicious domains without requiring root access. The approach is portable – you can copy the adguardhome folder to another device, run the same script, and be up and running in minutes.

Remember to keep your blocklists refreshed (AdGuard Home can auto‑update them daily) and to monitor the service if you notice any connectivity hiccups. With the optional wake‑lock script, the sinkhole can stay active even when the screen is off, giving you continuous protection on the go.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.