Use these for speed + privacy (mix of encrypted and uncensored):
| Provider | DNS over TLS (DoT) | DNS over HTTPS (DoH) |
|----------|--------------------|----------------------|
| Quad9 (secure) | tls://dns.quad9.net | https://dns.quad9.net/dns-query |
| Cloudflare | tls://1.1.1.2 (block malware) | https://security.cloudflare-dns.com/dns-query |
| AdGuard | tls://dns.adguard-dns.com | https://dns.adguard-dns.com/dns-query |
| TBRG Fallback | 94.140.14.14 (plain) | - |
TBRG Parallel Setup (fastest):
In AdGuard Home → Settings → Upstream DNS Servers, enter:
tls://dns.quad9.net
tls://1.1.1.2
tls://dns.adguard-dns.com
94.140.14.14
Enable Parallel requests → Yes.
The most cryptic part of the keyword is TBRG. In the context of AdGuard DNS and filtering logs, "TBRG" typically stands for "Temporary Blocked Request Group" or, in some engineering contexts, a routing tag for "Tracking Blocking Resource Group." tbrg adguardnet
However, based on an analysis of AdGuard’s open-source code and community discussions, the most accepted interpretation is:
TBRG = Traffic-Based Rule Group
As of 2025, the shift toward Encrypted Client Hello (ECH) and HTTP/3 is making traditional DNS blocking slightly harder. However, AdGuardNet is rapidly updating to support DNSCrypt and QUIC.
The TBRG community is currently developing "AI-assisted" blocklists that predict malware domains in real-time. When this merges with AdGuard's infrastructure, "tbrg adguardnet" will likely evolve from a niche setup into a mainstream security protocol. Use these for speed + privacy (mix of
TBRG AdGuardNet positions itself as a hybrid solution—combining DNS-level filtering, local network ad blocking, and encrypted privacy protection. Unlike browser extensions that only clean your own traffic, AdGuardNet claims to protect every device on your network (including smart TVs and IoT devices) without installing software on each one.
Add these URLs in Filters → DNS blocklists:
| List Name | URL | Purpose |
|-----------|-----|---------|
| AdGuard DNS filter | https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt | General ads |
| TBRG Enhanced | https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt | Smart TV telemetry |
| OISD Full | https://big.oisd.nl/ | All-in-one (ads, tracking, malware) |
| NoCoin | https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/nocoin.txt | Crypto miners |
| Phishing Army | https://phishing.army/download/phishing_army_blocklist.txt | Phishing domains |
TBRG Tip: Do not enable more than 5–7 lists to avoid RAM exhaustion. Enable Parallel requests → Yes
Navigate to Filters → DNS Allowlists/Blocklists → Add custom list.
Add this rule to force all behavioral tracking through TBRG inspection:
||*$client=192.168.1.100,important,domain=tracker.com|analytics.js
Then, create a TBRG exception for financial sites:
@@||bankofamerica.com^$important
This ensures your banking traffic bypasses aggressive TBRG filtering while still protecting social media and ad networks.
After setup, you need to verify the filter is active.