Labthrift Labthrift What to buy. What to skip. Why.

Written 5 Sep 2026. This is a how-to, not a product card.

When one laptop still shows ads

Everyone else's ads dropped. One laptop (or one browser) still shows banners. Check Chrome, Edge, or Firefox Secure DNS, Windows encrypted DNS, Mac Private Relay, then a VPN. You don't need a new router.

Haven't installed Pi-hole yet? Start with the first useful thing. Ads back on every device? Start with when ads come back. Stubborn phone, not a laptop? That is when one phone still shows ads. This note is only the laptop (or one browser on it) that skips the house ad block.

Skip until the house already works

If a phone on house Wi-Fi still shows the same ads, fix the house first. The computer may be asleep, Pi-hole may have stopped, or the router may have forgotten DNS: when ads come back. This note assumes the rest of the house is clean and one laptop is the odd one out.

What is going on

The router tells the laptop to ask the computer for names. That laptop (or one browser) may ignore the router. Chrome, Edge, and Firefox can turn on Secure DNS (DNS over HTTPS) to Google, Cloudflare, or another public book. Windows can do the same under encrypted DNS. A Mac with iCloud+ Private Relay can hide lookups. A VPN app can too. Ads then load on that laptop only. The computer looks fine. The router looks fine. The laptop is the bypass.

1. Try a second browser first

Open the same ad-heavy page in another browser on that laptop (Chrome vs Firefox vs Edge vs Safari). If ads drop in the second browser, the first browser's Secure DNS is the usual culprit. Stay in that dirty browser for the next step. If every browser on that laptop is dirty, jump to Windows encrypted DNS, Mac Private Relay, or the VPN section.

2. Chrome or Edge Secure DNS

In Chrome or Edge on the laptop, open Settings → Privacy and security → Use secure DNS (wording moves by version). Turn it off while you test, or set it to “use your current service provider” so the house router still picks the book. Do not leave “Google (Public DNS)”, “Cloudflare (1.1.1.1)”, or a custom DoH URL filled in for house Wi-Fi. Reload a site that used to show ads.

Edge often mirrors Chrome here. Same idea: Secure DNS off for the house test.

3. Firefox Secure DNS

In Firefox, open Settings → Privacy & Security → DNS over HTTPS (Enable DNS over HTTPS on some builds). Set it to Off, or to “Default Protection” / “Max Protection” off for this test so Firefox asks the system DNS again. Save. Reload the page. Skip building your own DoH resolver on the old PC tonight.

4. Windows encrypted DNS

On Windows 11, open Settings → Network & internet → Wi-Fi (or Ethernet) → the connection → DNS server assignment → Edit. If DNS over HTTPS is On with a template to Google or Cloudflare, set it to Off, or to “unencrypted only,” for this house network. Preferred DNS can stay Automatic so the router still hands out the Pi-hole address. Save. Browse again.

Windows 10 menus differ; search Settings for DNS if you do not see the toggle. The goal is the same: stop the OS from talking past the house book.

5. Mac Private Relay and Limit IP Address Tracking

On a Mac with iCloud+, open System Settings → [your name] → iCloud → Private Relay (or iCloud+ features). Turn Private Relay off for the house test, or open the house Wi-Fi detail and turn Limit IP Address Tracking off for that network only if you want Relay elsewhere.

Private Relay can hide the Mac's path, including name lookups, from the house router. Useful on a coffee-shop network. At home it means the Mac may never ask the computer. Browse again on house Wi-Fi after you change it.

6. A VPN or “ad block” app

Any VPN, “secure DNS” helper, or browser extension that routes DNS elsewhere can bypass the house. Disconnect the VPN. Quit the helper. Test without it first. Add it back later only if you still want it off-house. Company VPN that must stay on is a different problem: use a browser with Secure DNS off, or set that browser's DNS by hand only if your work policy allows it.

Check from the couch

On a phone or other device that already blocks ads, open the Pi-hole query log (or see what Pi-hole blocked). Use the stubborn laptop for a minute. You should see that laptop's lookups. If the log stays quiet while the laptop loads pages, the laptop is still asking someone else. Go back to Secure DNS, encrypted DNS, Private Relay, or the VPN.

What this is not

This is not a reason to buy a mesh kit, a new router, or a Raspberry Pi. It is not a reason to open Pi-hole to the internet. It is not homework to run DNS-over-HTTPS on the computer tonight. Fix the laptop so it uses the house book first.

What next

Router will not take custom DNS at all? Set this laptop only: point a phone or laptop at Pi-hole when the router won't.

If the dirty device was a phone, that is when one phone still shows ads. If it was on the guest SSID, that is when guest Wi-Fi still shows ads. If ads are gone on this laptop but one site still dies, that is when a site won't load after Pi-hole. If every device broke, walk when ads come back. Confirm the router still points at the computer: point common home routers at Pi-hole. Leave the ad block alone for a week when that laptop is clean.

Optional: jot that one laptop was bypassing with Secure DNS in Lab plan — username + passkey, no email. Skip if you just want to keep reading.

Skip

Sources

Pi-hole docs. Pi-hole userspace threads on browser Secure DNS and DoH. Google: manage Chrome settings (Secure DNS). Mozilla: DNS over HTTPS in Firefox. Microsoft: change DNS server settings. Apple: About iCloud Private Relay. Official pages only. Menus move by OS and browser version. For install, see the first useful thing. For the whole-house walk, see when ads come back. For a stubborn phone, see when one phone still shows ads.

Also on this topic

When one phone still shows adsEveryone else's ads dropped. One phone still shows banners. Check Private DNS, Private Relay, a VPN, then the Wi-Fi lease. You don't need a new router. When ads come backAds are back, sites won't load, or a phone still shows banners. Check the computer, Pi-hole, router DNS, then the phone. Point a phone or laptop at Pi-hole when the router won'tWhen Nest, Google Wifi, or an ISP gateway will not take custom DNS, set DNS on one phone or laptop so it asks Pi-hole. You don't need a new router for this device. When a site won't load after Pi-holeA bank, streamer, or login page breaks after Pi-hole. Pause blocking for five minutes, then allow the domain you need. You don't need a new router. Point common home routers at Pi-holeWhere to set DNS on TP-Link, ASUS, eero, Netgear, Nest, and ISP gateways so the house asks Pi-hole. Prefer LAN DHCP DNS. You don't need a new router. When guest Wi-Fi still shows adsGuest Wi-Fi is a separate network on purpose. Leave guests on ISP DNS, put a visitor on the main house Wi-Fi, or point guest DNS at Pi-hole only if they can reach the computer. You don't need a new router. See what Pi-hole blockedOpen the query log (or watch it over SSH) so you can tell ads are dying, which device asked, and which name to allow later. You don't need a new router. The first useful thingPut a house-wide ad block on the old PC. The rest of the house keeps using the internet as usual. You don't need a Raspberry Pi.