Point the LAN at the router's resolver#

You will end up with the router answering DNS for the LAN, sending what it does not know to servers you chose, and refusing everyone else. Every client already uses the router as its gateway, so making it the resolver too is one DHCP option and no client configuration.

Before you start#

The operator role and a licence.
The upstream servers you want to use, if not your provider's.

Step 1 — Turn on the resolver#

Services → DNS, Forwarding tab. On a router without a resolver, Turn on DNS forwarding opens a form already filled in from the router's networks: it answers on the router's LAN address, for the LAN's network, and forwards to the router's own DNS servers. On a router that has one, Edit opens the same form with its settings.

Under Upstream servers, Add server for each server you want — 9.9.9.9, 1.1.1.1. A port is needed only for a server that does not listen on 53.
Turn Use the router’s own DNS servers off if the upstream servers should be the only ones.
Check Listen addresses holds the router's inside address and Allowed networks every network you serve, one entry each.
Choose DNSSEC → Validate every answer if you want signed answers checked.
Save changes, and apply the pending changes.

Step 2 — Hand it out with DHCP#

Services → DHCP, click the LAN's scope, and under Handed to clients put the router's LAN address in DNS servers. Save and apply. Clients pick it up at their next renewal.

Step 3 — Watch the cache#

The Forwarding tab's tiles show how many answers the cache holds and how much memory it takes, read from the running resolver. A cache that stays nearly empty is a resolver nothing is using. 10000 entries is the default size, and the number to raise if a busy network misses often.

Check it worked#

From a client:

bash

dig @192.0.2.1 example.com

And confirm it is closed from outside:

bash

dig @203.0.113.2 example.com

The second should time out. If it answers, the allowed networks or the listen addresses are wrong, and the router is an open resolver.

Names for DHCP clients#

Services → DHCP → Server settings → Edit → Add client names to DNS makes a device that sends its name when it takes a lease resolvable by that name. For a device that should always answer to a name, a reservation and a host name are steadier.

Filtering#

If what you want is ad and tracker filtering for every client, Network-wide filtering with AdGuard Home is the guide: it forwards from this resolver rather than replacing it.

Undoing it#

Edit → Turn off removes the resolver, and the records and forwarded domains inside it. Change the scope's DNS servers back to an upstream resolver in the same apply, or the LAN loses DNS at its next renewal.