🩺 Vitals
- 🟢 Last active: 2026-08-04
- 📦 Latest release: v0.107.78 (2026-07-13)
- 🐞 Open issues: 1269
- 🌟 Stars: 35.9k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: adguard.com/adguard-home
- Source: github.com/AdguardTeam/AdGuardHome
- License: GPL-3.0
- Deployment: Docker | Native Binary
- Data Model: Local YAML config and on-disk query log (no external database)
- Jurisdiction: Cyprus 🇨🇾 / EU 🇪🇺 (AdGuard Software Ltd.)
- Compliance (SaaS): N/A (No Vendor Cloud)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (1/5) - Single Binary or Docker
- Maintenance: Low (2/5) - Block-list and Version Updates
- Enterprise Ready: Low (2/5) - Single Admin, No SSO or Clustering
1. The Executive Summary
What is it? AdGuard Home is a self-hosted network DNS filter. Like a Pi-hole, it sits between your devices and the internet, resolving DNS while refusing the domains on its block lists, so ads, trackers, and malware hosts are stopped for every device with no client software installed. What sets it apart in the category is what ships in the box: native encrypted DNS (DNS-over-HTTPS, DNS-over-TLS, and DNSCrypt) as both the upstream and the served protocol, a built-in DHCP server, and parental controls, all inside a single self-contained Go binary. It is a filtering resolver, not the full authoritative DNS server that Technitium provides; it does one layer of the stack, and does it with the encrypted-transport story built in rather than bolted on. It still forwards to an upstream resolver by default; pairing it with a recursive resolver like Unbound removes that dependency and resolves from the root servers directly.
The Strategic Verdict:
- 🔴 For a Full DNS Platform: Caution. AdGuard Home has no authoritative zone hosting, no DNSSEC signing, no clustering, and no single sign-on. It is a single-admin filtering appliance. When you need DNS as managed infrastructure, Technitium is the fuller server.
- 🟢 For Encrypted, Network-Wide Filtering: Strong Buy. Native DoH, DoT, and DNSCrypt plus DHCP in one binary, self-hosted, with a query stream that never leaves your hardware. The code is GPL-3.0 and auditable, and it collects no usage statistics by default.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | NextDNS (SaaS) | AdGuard Home (Self-Hosted) |
|---|---|---|
| License Fee | Subscription, scales with query volume | $0 (GPL-3.0, every feature) |
| Infrastructure | $0 (vendor resolvers) | ~$5/mo (Raspberry Pi or existing hardware) |
| Query Telemetry | Resolved and logged on vendor infra | Stays on hardware you own |
The third row carries the argument, and it is the same one that applies to every self-hosted resolver: a managed filtering service answers, and therefore records, every DNS lookup your devices make. AdGuard Home keeps that stream on hardware you control. The distinction from a SaaS filter is not the block quality, which is comparable; it is who holds the log of everywhere your network went.
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Go binary via the install script, or the official Docker image, on Linux, macOS, or FreeBSD. There is no runtime stack or external database to manage; configuration is one YAML file and the query log sits on local disk, so a backup is a file copy.
- Scalability: A single instance is a single point of failure, and AdGuard Home has no native clustering. High availability means running a second instance and keeping block lists and configuration in sync yourself. Size the redundancy plan before an entire network depends on one resolver.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction, Heritage, and Why Self-Hosting Answers Both: AdGuard Software Limited is incorporated in Cyprus and bound by EU law and the GDPR, but the lineage deserves plain statement rather than omission: the company was founded in Moscow in 2009, relocated its corporate operations to Cyprus in 2017, and its development team has historically been Russia-based. For a proprietary cloud product that heritage would be a live due-diligence question, because you would be trusting the vendor with your data. AdGuard Home inverts the question. It is GPL-3.0 open source, runs entirely on your own hardware, and by the maintainers' statement and the auditable code it collects no usage statistics and calls no vendor service unless you configure one. The sovereignty guarantee here is architectural, not reputational: a resolver you can inspect and that provably makes no callbacks does not expose you to the vendor's jurisdiction or its origins. Run a build you trust and the guarantee holds regardless of who wrote it.
- The Compliance Shift and the Query Log: As with any DNS filter, the query log is the sharp edge. A record of which device resolved which domain is personal data under the GDPR, so the moment you deploy it you become the processor of that data, responsible for retention limits, access control, and minimisation. Enabling the built-in DHCP server widens that footprint further, since it then also holds the device-to-address mapping. Set the log retention window deliberately instead of accepting the default and forgetting it.
- License and The Single-Purpose Trap: The GPL-3.0 copyleft only engages when you distribute modified binaries, which internal operation never does, so the licence carries no operational risk. The trap is scope, and it is the same one that applies to any sinkhole: AdGuard Home filters and forwards, it does not host authoritative zones, sign DNSSEC, or cluster. Buy it for encrypted, network-wide filtering, and reach for a full server when the network needs authoritative DNS.
4. Market Landscape
🏢 Proprietary Incumbents
- NextDNS: A managed filtering resolver billed by query volume. Zero maintenance, in exchange for every lookup resolved and logged on vendor infrastructure.
- Cloudflare Gateway: The enterprise DNS-filtering layer of Cloudflare's Zero Trust suite. Convenient and globally distributed, but your resolution and policy logs live on Cloudflare's US-headquartered platform.
🤝 Open Source Ecosystem
- Pi-hole: The incumbent peer in the same lane, with the larger community and block-list ecosystem and a longer track record. AdGuard Home counters with native encrypted DNS and a built-in DHCP server where Pi-hole leans on an upstream proxy for encrypted transport.
- Technitium DNS Server: The full-server option. Where AdGuard Home filters and forwards, Technitium adds authoritative zone hosting, DNSSEC signing, and clustering for networks that outgrow pure filtering.