Block ads on every device
Change one setting and most adverts, trackers and known malicious sites stop loading — on your phone, your laptop, your smart TV, even devices that cannot run an ad blocker. It is free, and it takes about five minutes.
What DNS is, and why changing it blocks ads
Computers do not know what google.com means. They only understand numbers like
142.250.184.14. DNS is the phone book that turns the name into
the number. Every single time your device loads anything — a page, an image, an advert — it
asks a DNS server "what is the number for this name?"
Normally you use your internet provider's phone book. If you use ours instead, then whenever a page asks for the number of a known advertising or tracking domain, our server answers "that address does not exist" — and the advert never loads. The rest of the page loads completely normally.
What you actually gain
- Fewer ads everywhere — including inside mobile apps and on smart TVs, where browser extensions cannot reach.
- Less tracking — the analytics and profiling domains that follow you between sites simply fail to resolve.
- Some protection from malware and phishing — known bad domains are blocked before your browser ever contacts them.
- Pages load a little faster — every blocked request is a request that never had to travel anywhere.
- Less mobile data used — ads are often the heaviest thing on a page.
What it does not do
- It is not a VPN and does not hide your traffic or change your apparent location.
- It cannot remove YouTube's own adverts, because those come from the same domain as the videos themselves.
- It does not block ads baked into a video stream, or sponsored posts inside apps like Instagram.
- It is not a substitute for an antivirus or for common sense about what you click.
Using someone's DNS means they can see which domain names you look up. We run this resolver with query logging kept to what is needed to keep it working, we do not build profiles, and we do not sell or share anything. But you should apply that scepticism to every DNS provider, including your own ISP — who logs the same thing and often for longer. If you would rather not, that is a completely reasonable choice.
The addresses you will need
Keep this section open in another tab while you follow the steps. Which one you need depends on the device — each set of instructions below says exactly which.
| Use this | Where |
|---|---|
62.197.221.140 | Routers, Windows, macOS, Linux, games consoles — anywhere that asks for a numeric DNS server. |
dns.karafa.net | Android "Private DNS", and the iPhone/iPad profile below. Port 853. This version is encrypted, so nobody on the network between you and the server can read or tamper with your lookups. |
Plain DNS travels in the open — anyone operating the network you are on (a café, a hotel, your provider) can read every name you look up. DNS over TLS wraps it in encryption. If a device offers a hostname field rather than an IP field, that is the better option.
Set it up on your device
Choose your device below. The tab matching what you are reading this on is already selected. If you only do one of these, do the router — it covers everything in the house at once, including devices you cannot configure individually.
Setting DNS on the router protects every device that connects to your Wi-Fi — phones, tablets, TVs, consoles, visitors — without touching any of them individually. Every router looks slightly different, but the sequence is always the same.
In a browser, go to 192.168.1.1 or 192.168.0.1. If neither
opens, the correct address is usually printed on a sticker on the underside of the
router, next to the Wi-Fi password.
Also on that sticker. If it was changed and nobody remembers it, a pin-hole reset button held for ten seconds restores the factory login — but be aware that this also erases your Wi-Fi name and password, so you would have to set those up again.
They live under DHCP Settings, LAN, WAN or Internet depending on the brand. You are looking for two boxes labelled Primary DNS and Secondary DNS, sometimes hidden behind an "Advanced" toggle.
Put 62.197.221.140 in Primary DNS. Leave Secondary empty if
the router allows it. Save, then reboot the router. Devices pick up the change when they
next reconnect — turning Wi-Fi off and on again on a phone forces it.
Do not put a public unfiltered server such as 8.8.8.8 in the secondary
box. Devices use whichever answers first, so ads would get through unpredictably and
you would never know why. Leave it blank — the resolver already has its own backup
servers behind that address, so a single machine failing does not take your name
lookups with it.
Windows 11
- Open Settings (the cog in the Start menu, or
Win+I). - Go to Network & internet.
- Click your active connection — Wi-Fi or Ethernet.
- Click Hardware properties (on Wi-Fi you may first need to click the network's own name).
- Next to DNS server assignment, click Edit.
- Change the drop-down from Automatic (DHCP) to Manual.
- Switch IPv4 on.
- In Preferred DNS, type
62.197.221.140. Leave the alternate blank. - Set DNS over HTTPS to Off if it is offered — this server uses TLS, not HTTPS, for encryption.
- Click Save.
Windows 10
- Press
Win+R, typencpa.cpland press Enter. - Right-click your active adapter → Properties.
- Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
- Choose Use the following DNS server addresses and enter
62.197.221.140. - Click OK twice.
Windows remembers previous answers for a while. Open Command Prompt and run
ipconfig /flushdns so the change takes effect immediately instead of
trickling in over the next hour.
There are two ways on a Mac. The profile is easier and gives you encryption; the manual route is quicker if you just want it done.
Option A — install the profile (encrypted, recommended)
- Download the configuration profile using the button at the end of this section.
- Open System Settings → General → Device Management (on older macOS: System Preferences → Profiles).
- Double-click the downloaded profile and choose Install.
- Enter your Mac password to confirm. A warning that the profile is unsigned is expected and safe to accept.
Option B — set it manually
- Open System Settings → Network.
- Select your active connection (Wi-Fi or Ethernet) and click Details….
- Go to the DNS tab.
- Click + under DNS Servers and type
62.197.221.140. - Remove any other entries with the − button, then click OK and Apply.
Android has built-in encrypted DNS called Private DNS, available on Android 9 and newer. It is the best option on this whole page: it works on mobile data as well as Wi-Fi, so you stay protected when you leave the house.
- Open Settings.
- Go to Network & internet (Samsung calls it Connections).
- Tap Private DNS. On Samsung it is under More connection settings. If you cannot find it, search "Private DNS" in the Settings search box.
- Select Private DNS provider hostname.
- Type the hostname exactly — no
https://, no spaces:
- Tap Save. If it says "Couldn't connect", check the spelling — that message almost always means a typo.
Private DNS applies to every network the phone joins, including 4G/5G and other people's Wi-Fi. Set it once and forget it.
Apple devices use a small configuration file to set encrypted DNS system-wide. It applies to every app and every network, mobile data included.
This must be Safari — profiles downloaded in Chrome or Firefox on iOS will not install.
Confirm when Safari asks whether you want to allow the download.
Download the DNS profile (.mobileconfig)Open Settings. Near the very top, above your name, a new Profile Downloaded entry appears. Tap it, then Install at the top right, enter your passcode, and confirm Install again.
If the entry is not there, look in General → VPN & Device Management.
Go to Settings → General → VPN & Device Management → DNS and make sure Karafa DNS is the selected resolver rather than Automatic.
That warning is normal. Signing a profile requires a paid Apple certificate; the file itself contains nothing but the DNS hostname, and you can delete it at any time from the same screen.
Most desktop distributions use NetworkManager, so the graphical route works on Ubuntu, Fedora, Mint and friends.
Graphical
- Open Settings → Network (or Wi-Fi).
- Click the cog next to your connection.
- Go to the IPv4 tab.
- Turn Automatic off for DNS only, and enter
62.197.221.140. - Apply, then turn the connection off and on again.
Terminal, with encryption (systemd-resolved)
Edit /etc/systemd/resolved.conf and set:
Then apply and verify:
Check that it actually worked
Do not just assume it took effect. Two quick checks:
Visit a news site that you know is heavy with adverts. Where banners used to be you should now see blank space or a small "cannot be reached" placeholder. That gap is the point — the advert was never fetched.
On Windows open Command Prompt; on macOS or Linux open Terminal. Run this against a known advertising domain:
If filtering is active, the answer comes back as 0.0.0.0, as an empty result, or
as "can't find". If you get a normal-looking public address instead, the change has not taken
effect yet — reboot the device, or check that you edited the connection you are actually
using rather than a different adapter.
Devices cache old answers for anywhere between a few minutes and a day. If nothing seems different, restart the device — that clears the cache more reliably than waiting.
When a site breaks
Occasionally a filter list is too aggressive and blocks something you actually wanted — a payment page, a delivery tracker, a login button that does nothing. This is the one real downside of DNS filtering, and it is easy to diagnose.
| Symptom | What to do |
|---|---|
| A button does nothing, or part of a page is missing | Likely a blocked domain. Send us the address of the page and we will allow the domain it needs — usually within a day. |
| No website loads at all | The resolver is unreachable, or there is a typo in the address. Undo the change (below), confirm the internet works, then try again carefully. |
| Works on Wi-Fi, not on mobile data | Expected if you configured the router only. Use Android Private DNS or the iOS profile to cover mobile data too. |
| A captive portal (hotel, airport Wi-Fi) will not open | These hijack DNS by design, so encrypted DNS blocks them. Turn Private DNS off, sign in to the network, then turn it back on. |
How to undo it
Nothing here is permanent, and you should know the way back before you start.
- Router, Windows, macOS, Linux: go back to the same screen and set DNS to Automatic or Obtain automatically.
- Android: Settings → Private DNS → Off (or Automatic).
- iPhone / iPad / macOS profile: Settings → General → VPN & Device Management → tap the Karafa DNS profile → Remove Profile.
Any of these takes effect immediately — no reboot required, though clearing the cache does not hurt.
Common questions
Do I need a Karafa.net account for this?
No. The resolver is open to anyone. You do not need to tell us you are using it.
Will it slow my internet down?
A DNS lookup takes a few milliseconds, and there may be a very slight extra delay compared with your provider's server because ours is one location rather than dozens. In practice the blocked adverts save far more time than the lookup costs, so most people find pages load faster.
Will it break Netflix, banking or work systems?
It should not — filtering targets advertising and tracking domains, not services. Corporate VPNs are the exception: they often require their employer's internal DNS, so a work laptop may need this left alone or configured only for the home Wi-Fi profile.
What if your server goes down?
There is more resilience here than the single IP address suggests. The service runs on redundant resolvers, so one failing does not stop your lookups, and the whole rack sits behind a UPS — a battery large enough to ride out the local power cuts that occasionally hit the area, which has already been tested in practice more than once. It is also monitored continuously on the status page. It is still a small, self-run setup rather than a global company, so if you ever do want out, the undo section above takes half a minute.
Do you support DNS over HTTPS (DoH)?
Currently the encrypted endpoint is DNS over TLS on port 853, which is what Android and Apple devices use natively. If you specifically need DoH for a browser-level setting, email us and we will tell you where it stands.
Can it block adult content for a child's device?
The default lists cover ads, trackers and malware, not adult content. If you want a stricter profile for a specific household, ask — it is straightforward to arrange.