HostuxDNS

AdGuard Home is a self-hosted DNS server that acts as a resolver for your entire local network. By setting HostuxDNS as its upstream, every DNS query AdGuard Home forwards is sent encrypted, regardless of which device on your network made the request.

This guide covers the upstream configuration only. AdGuard Home's own filtering rules and blocklists are separate from HostuxDNS and are not affected by this setup.

1. Open the AdGuard Home web interface and go to Settings > DNS settings.
2. Clear the Upstream DNS servers field and enter one of the following:

Protocol	Upstream	Note
DoQ (recommended)	quic://dns.hostux.net	Fastest, lowest overhead
DoH	https://dns.hostux.net/dns-query	Works on port 443
DoT	tls://dns.hostux.net	Port 853

3. In Bootstrap DNS resolvers, add:
   • 46.226.108.173
   • 46.226.109.82
   Bootstrap resolvers are used only to look up the upstream hostname at startup. They are not used for regular queries.
4. Click Apply.
5. Use the DNS test field at the top of the page to confirm everything resolves.

AdGuard Home configuration documentation

HostuxDNS has a filtering endpoint that blocks known ad and tracker domains at the DNS level. The filtering endpoint is only available over DoH. To use it, switch the upstream to:

https://dns.hostux.net/ads

DoQ does not support a path suffix, so ad filtering via DoQ is not available. If you need server-side filtering, use DoH with the /ads endpoint.

This runs alongside AdGuard Home's own blocklists and does not replace them.

Fallback DNS

AdGuard Home supports a Fallback DNS servers field. You can add 46.226.109.82 there to use the second HostuxDNS resolver if the primary is unreachable.

Private reverse DNS

For local network reverse lookups (192.168.x.x, 10.x.x.x), AdGuard Home handles those internally. They are not forwarded to HostuxDNS.

DNSSEC

HostuxDNS validates DNSSEC. AdGuard Home can be configured to require DNSSEC validation as well; both work correctly together.