Verify Server Network Configuration
The most common reason AdGuard Home does not receive queries is that the device hosting it has lost its static IP address or is on a different subnet than expected. If you are running AdGuard Home on Docker within Ubuntu 22.04, the container inherits network settings from the host. You must ensure the host machine itself has a reserved static IP in your router’s DHCP lease table or is configured with a static IP via netplan. This prevents the IP from changing after a reboot, which would break the router’s DNS configuration.
Check your current IP configuration by running ip addr show in the terminal. Look for the interface connected to your LAN (often eth0 or ens33). Note the IPv4 address. Compare this with the IP address you entered into your router’s DNS settings. If they do not match exactly, the router will send packets to the wrong destination. Additionally, verify that the Docker container is mapped correctly. In your docker-compose.yml file, ensure the ports are exposed as 53:53/tcp and 53:53/udp. If the container is using host networking, ensure the host’s firewall allows incoming connections on these ports.
Router DNS Settings and DHCP Leases
Configuring the router to point to AdGuard Home is only half the battle; you must also ensure clients actually use those settings. Many routers have two DNS fields: one for WAN/DNS forwarding and another for LAN/DHCP options. If you only update the WAN DNS, clients may still receive the ISP’s default DNS servers via DHCP. You need to locate the DHCP server settings within your router’s admin panel. Look for options labeled "DNS Server," "Primary DNS," and "Secondary DNS" under the LAN or DHCP section.
Enter the static IP of your AdGuard Home server in both fields. For example, if your server is at 192.168.1.3, set Primary DNS to 192.168.1.3 and Secondary DNS to 192.168.1.3 or a fallback like 1.1.1.1. After saving, restart your router. Some routers require a full power cycle to push new DHCP leases to connected devices. Without this step, existing devices will continue using the old DNS servers until their lease expires, which can take 24 hours or more. If you want immediate effect, manually renew the DHCP lease on your client devices or disconnect and reconnect them to the Wi-Fi network.
Firewall and Port Blocking Issues
Ubuntu’s default firewall, UFW (Uncomplicated Firewall), often blocks incoming DNS traffic even if the service is running. By default, UFW denies all incoming connections unless explicitly allowed. Since DNS relies heavily on UDP port 53, any block here will cause silent failures where queries are dropped before reaching AdGuard Home. Check the status of UFW by running sudo ufw status. If it is active, look for rules allowing SSH or HTTP, but likely missing DNS.
To fix this, allow DNS traffic specifically. Run the following commands to permit both TCP and UDP on port 53:
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
If you are using Docker, ensure that the Docker daemon is not interfering with iptables rules. Sometimes Docker flushes firewall rules upon restart. You can verify if ports are open by running sudo ss -tulpn | grep :53. This command lists all listening sockets. You should see processes bound to :53. If nothing appears, AdGuard Home is not listening, or the firewall is blocking it. Additionally, check if your router has a built-in firewall or parental control feature that might be filtering outbound DNS requests from specific MAC addresses.
Docker Network and Container Health
Docker networks can sometimes isolate containers from the host’s network stack, especially if you are using custom bridge networks. If AdGuard Home is running in a custom network, it might not be accessible directly via the host’s IP from other devices on the LAN. Ensure your Docker network mode is set to host or that the container is on the default bridge network with proper port mappings. The host network mode is often recommended for AdGuard Home because it eliminates NAT overhead and simplifies firewall management.
Check the health of your container using docker ps. Look for the status column. If it says "Up," it is running, but you should also check logs for errors. Run docker logs adguardhome (replace with your container name) to see if there are startup errors. Common issues include permission denied errors on the data directory or conflicts if another service on the host is already using port 53. If another service is using port 53, AdGuard Home will fail to bind. Use sudo lsof -i :53 to identify any conflicting processes. Stop or reconfigure the conflicting service before restarting AdGuard Home.
Testing and Validation
Once configurations are updated, test connectivity from multiple devices. Do not rely solely on the AdGuard Home dashboard, as it may show queries from itself or cached results. Use a separate device, such as a smartphone or laptop, to perform manual DNS lookups. On Linux or macOS, use nslookup google.com 192.168.1.3 (replacing with your server IP). On Windows, use nslookup google.com 192.168.1.3. If this times out, the network path is broken. If it returns an answer, the DNS is working, but your browser might still be using cached records.
Clear your DNS cache on the client device. On Windows, run ipconfig /flushdns. On macOS, run dscacheutil -flushcache. On Linux, depending on your resolver, you might need to restart systemd-resolved or clear Chrome’s internal DNS cache by visiting chrome://net-internals/#dns and clicking "Clear host cache." If queries still do not appear in AdGuard Home’s query log, check the "Blocked Queries" tab. Sometimes queries are blocked silently due to filter lists, making it seem like they never arrived. If you suspect intermediate devices like switches or APs are caching DNS, reboot them as well. For deeper troubleshooting, refer to guides on Troubleshooting DNS Servers Not Getting Client-Initiated Queries to understand packet flow.
Frequently Asked Questions
Why do I see queries in AdGuard Home but not on my router?
Routers typically do not log individual DNS queries made by clients unless they have advanced logging features enabled. AdGuard Home handles the resolution locally, so the router sees only encrypted or standard traffic passing through. To monitor queries, you must check the AdGuard Home dashboard directly, not the router’s status page.
Can I use AdGuard Home with a dynamic IP address?
While possible, it is highly discouraged. If your server’s IP changes, your router’s DNS settings will point to a dead end until you manually update them. Always assign a static IP reservation in your router’s DHCP settings for the device running AdGuard Home to ensure stability.
What if nslookup works but websites still won’t load?
This usually indicates a caching issue on the client device or a problem with HTTPS/TLS filtering in AdGuard Home. Clear your browser and OS DNS caches. Additionally, check if AdGuard Home’s TLS inspection is causing certificate errors, which browsers may block entirely.
How do I check if port 53 is blocked by my ISP?
Most ISPs do not block port 53 on local networks, but some restrict external access. Since AdGuard Home runs locally, ISP blocks are unlikely. However, if you are trying to access AdGuard Home from outside your home network, ensure your router forwards port 53 to your server and that your ISP does not block inbound traffic on that port.
Why are some domains still resolving to public IPs instead of being blocked?
AdGuard Home uses filter lists to block domains. If a domain is not in the list, it passes through. Ensure your filter lists are updated by clicking "Update Lists" in the dashboard. Also, check if the domain is whitelisted in AdGuard Home’s settings or if your client device is bypassing AdGuard Home due to a misconfigured proxy or VPN.