How to Install AdGuard Home on a VPS for Private DNS, DoH, and DoT

If you care about your privacy online, your DNS traffic is one of the first things you should lock down. Every website you visit, every app you open, they all start with a DNS query. By default, those queries go to your ISP's servers, completely unencrypted. Running an AdGuard Home private DNS server on a VPS changes that.

With AdGuard Home private DNS server, you get full control over your DNS, ad, and tracker blocking across all your devices, and the ability to serve encrypted DNS (DoH and DoT). This guide will show you how to install AdGuard Home, configure upstream resolvers, get a TLS certificate, enable DoH and DoT, and connect your devices.

If you need a server to get started, a reliable Linux VPS from PerLod gives you a clean Ubuntu server with a dedicated IP.

Before you begin to set up the AdGuard Home private DNS server, make sure you have:

• A Linux VPS running Ubuntu 22.04 or 24.04 with a public IP address.
• A domain name you control.
• Root or sudo access to the server.

If you don't have a domain yet, you can register one with PerLod Domains and point it directly to your VPS IP address.

Once you are done, proceed with the following steps to set up your AdGuard Home private DNS server.

On Ubuntu 22.04 and 24.04, systemd-resolved runs a stub DNS listener that takes port 53 by default. AdGuard Home needs port 53 to serve standard DNS queries, so you have to free it up first.

Check what is using port 53:

If systemd-resolved shows up, run these commands:

Add the following content:

Save the file, then update the symlink so the server still resolves DNS correctly:

Then, verify port 53 is free:

No output means port 53 is available.

You must open the ports AdGuard Home needs before you start the service. To do this, run the following commands:

Security tip: After you finish the initial web setup, remove the 3000 port rule with:

You do not need it after setup is done.

The easiest way to install AdGuard Home is to use the official install script. It downloads the binary, sets it up as a systemd service, and starts it automatically.

The script installs AdGuard Home to /opt/AdGuardHome/. Once done, check that the service is running:

You should see running in the output. Now, create a directory for your certificates:

Open your browser and go to:

The setup wizard will guide you through a few steps. Click Get Started:

Under Admin Web Interface, set the listen interface to All interfaces and port to 80, and under DNS Server, set the listen interface to All interfaces and keep port 53. Click Next:

Then, create an admin username and a strong password:

In the device configuration, simply click Next:

Now click on Open Dashboard:

Sign in with your admin account you have just created:

Your AdGuard Home private DNS server is now running, but it is not yet encrypted. The next steps add TLS so you can use DoH and DoT.

Both DoH and DoT require a valid TLS certificate. For this purpose, you can use free certificates from Let's Encrypt.

Install Certbot with:

If port 80 is being used by AdGuard Home itself, Certbot standalone cannot start until you stop AdGuard Home.

Stop the service:

If the second command shows no output, port 80 is free, and you can run Certbot:

After Certbot succeeds, start AdGuard Home again:

Certbot saves your certificate files at:

Now copy those certificates to AdGuard Home's directory so it can read them:

Let's Encrypt certificates expire every 90 days. You can set up automatic renewal by creating a deploy hook:

Add:

Make it executable and test:

From your AdGuard Home dashboard, navigate to Settings > Encryption settings and configure:

• Enable Encryption: checked
• Enable plain DNS: leave checked for now, you can disable it later after DoH/DoT works.
• Server name: dns.yourdomain.com
• Redirect to HTTPS automatically: checked
• HTTPS port: 443
• DNS-over-TLS port: 853
• DNS-over-QUIC port: leave empty for now, or use 853 only if you also want DoQ and have UDP 853 open.

Under the certificate section, choose Set a certificate file path and enter:

• Certificates path: /opt/AdGuardHome/certs/cert.pem
• Private key path: /opt/AdGuardHome/certs/key.pem

Click Save. AdGuard Home will validate the certificate. If it shows green checkmarks next to the paths, the TLS setup is working.

From this point, your AdGuard Home private DNS server is accessible at:

Your AdGuard Home private DNS server needs to forward queries to upstream resolvers. These are the servers that actually look up domain names on the Internet. You must pick resolvers that also use encryption.

Go to Settings > DNS Settings and add your upstream servers.

Good encrypted upstream options include:

For Bootstrap DNS servers, which are used to resolve the upstream hostnames themselves, you can add:

Also, you can enable these options for better performance and security:

• Parallel requests: queries all upstreams at once, uses the fastest response.
• Enable DNSSEC: validates DNS response signatures.
• Enable EDNS client subnet: improves CDN routing accuracy.

Finally, click Save.

To add the blocklists for AdGuard Home private DNS server, go to Filters > DNS Blocklists and click Add blocklist > Choose from the list.

Recommended blocklists to enable:

• AdGuard DNS filter: the main built-in list.
• AdGuard DNS Popup Hosts filter: blocks pop-up domains.
• Steven Black's Hosts: well-maintained community list.
• OISD Basic: broad coverage without false positives.

Enable the ones you want and click Save. AdGuard Home downloads and applies the lists. You will see the total number of blocked domains displayed on the dashboard.

Once your AdGuard Home private DNS server is running with DoH and DoT enabled, connect your devices to it. The built-in Setup Guide in the dashboard shows you the exact configuration for each platform.

Android 9 and later support DoT natively.

• Go to Settings > Network & internet > Advanced > Private DNS
• Select the Private DNS provider hostname
• Enter: dns.yourdomain.com

iOS 14+ and macOS Big Sur+ support DoH and DoT via configuration profiles.

AdGuard Home generates these profiles for you automatically. Go to Setup Guide > DNS Privacy > iOS in the dashboard, then download and install the profile on your device.

Windows 10 Build 19628 and later support DoH natively.

• Go to Settings > Network & Internet > Wi-Fi (or Ethernet) > DNS server assignment
• Set to Manual and enter your VPS IP
• Enable DNS over HTTPS (DoH) and set the DoH template to: https://dns.yourdomain.com/dns-query

Edit /etc/systemd/resolved.conf and add:

Restart with:

By default, your AdGuard Home private DNS server accepts plain DNS queries from anyone. That is fine if you only use DoH/DoT, but you may want to lock down port 53 to your own IPs only.

Go to Settings > DNS settings > Access settings. You can add an "Allowed clients" list using individual IPs or CIDR ranges. For example, only allow your home IP and VPN IP to use plain port-53 DNS. Everyone else must use DoH or DoT, which requires no allowlisting because your TLS certificate is the authentication.

You can also restrict the admin web UI with a firewall rule:

After everything is configured, test that your AdGuard Home private DNS server is working correctly.

Test plain DNS:

Test DoH:

Test DoT:

If the plain DNS test returns answers, DoH returns JSON with IP addresses, and DoT resolves without errors, your setup is complete.

Also, check the AdGuard Home dashboard query log. You should see queries coming in from your devices.

Setting up an AdGuard Home private DNS server on a VPS is one of the most impactful things you can do for your network privacy. Unlike home setups, a VPS-based deployment works everywhere, because your DNS endpoint is on the public internet with a real domain and a valid TLS certificate.

We hope you enjoy this guide. For more detailed encryption details, check the AdGuard Home Official Documentation.