Written 3 Sep 2026. This is a how-to, not a product card.

When one phone still shows ads

Everyone else's ads dropped. One phone still shows banners. Check Private DNS, Private Relay, a VPN, then the Wi-Fi lease. You don't need a new router.

Haven't installed Pi-hole yet? Start with the first useful thing. Ads back on every device? Start with when ads come back. Stubborn laptop or browser, not a phone? That is when one laptop still shows ads. This note is only the stubborn phone (or tablet) that refuses the house ad block.

Skip until the house already works

If a laptop on house Wi-Fi still shows the same ads, fix the house first. The computer may be asleep, Pi-hole may have stopped, or the router may have forgotten DNS: when ads come back. This note assumes the rest of the house is clean and one phone is the odd one out.

What is going on

The router tells phones to ask the computer for names. That phone may ignore the router. Android Private DNS, iCloud Private Relay, a VPN app, or Chrome Secure DNS can send lookups somewhere else. Ads then load on that phone only. The computer looks fine. The router looks fine. The phone is the bypass.

1. Android Private DNS

On many Androids, open Settings, search for Private DNS, and open it. On a Pixel it often sits under Network & internet. On a Samsung, Connections → More connection settings → Private DNS.

Set Private DNS to Off, or to Automatic if Off is not offered and Automatic still uses the router. Do not leave a hostname like dns.google or one.one.one.one filled in for house Wi-Fi. That path skips Pi-hole on purpose. Browse a site that used to show ads. Skip building a DNS-over-TLS proxy on day one.

2. iPhone Private Relay

On an iPhone or iPad with iCloud+, open Settings → [your name] → iCloud → Private Relay. Turn Private Relay off, or use the Wi-Fi detail for the house network and turn Limit IP Address Tracking off for that network only if you want Relay elsewhere.

Private Relay can hide the phone's traffic path, including name lookups, from the house router. That is useful on a coffee-shop network. At home it means the phone may never ask the computer. Browse again on house Wi-Fi after you change it.

3. A VPN or “secure DNS” app

Any VPN, “ad block” VPN, or browser Secure DNS setting can bypass the house. Disconnect the VPN. In Chrome on the phone, open Settings → Privacy and security → Use secure DNS (wording moves), and turn it off while you test. Same idea in Firefox if Secure DNS is on. Test without the VPN first. Add it back later only if you still want it off-house.

4. Sticky Wi-Fi lease

If Private DNS and Relay are already off, the phone may still hold an old lease from before you pointed the router at the computer. Forget the house Wi-Fi, join again, or toggle airplane mode for ten seconds. Fuller flush walk (phones and laptops): flush old DNS on phones and laptops. Then open a site that used to show ads. Same short check as in when ads come back.

Check from the couch

On another device that already blocks ads, open the Pi-hole query log. Use that stubborn phone for a minute. You should see that phone's lookups. If the log stays quiet while the phone loads pages, the phone is still asking someone else. Go back to Private DNS, Private Relay, or the VPN.

What this is not

This is not a reason to buy a mesh kit, a new router, or a Raspberry Pi. It is not a reason to open Pi-hole to the internet. It is not homework to run DNS-over-TLS on the computer tonight. Fix the phone so it uses the house book first.

What next

Stubborn laptop instead? When one laptop still shows ads. Router will not take custom DNS at all? Set this phone only: point a phone or laptop at Pi-hole when the router won't. Still dirty with Private DNS and VPNs off, and IPv4 DNS looks right? Try when ads sneak past on IPv6.

If the phone was on the guest SSID the whole time, that is when guest Wi-Fi still shows ads. If ads are gone on this phone but one site still dies, that is when a site won't load after Pi-hole. If every device broke, walk when ads come back. Confirm the router still points at the computer: point the house at the ad block. Leave the ad block alone for a week when that phone is clean.

Skip

Skip buying a new router for one phone.
Skip a mesh kit for ad block.
Skip exposing Pi-hole to the internet.
Skip DNS-over-TLS homework on day one.
Skip this if every device still shows ads. Fix the house first.

Sources

Pi-hole docs. Pi-hole userspace threads on Android Private DNS and browser Secure DNS. Apple: About iCloud Private Relay. Official pages only. For install, see the first useful thing. For the whole-house walk, see when ads come back. For router DNS, see point the house at the ad block.

Also on this topic

Flush old DNS on phones and laptopsAfter you point the router at Pi-hole, phones and laptops may still use the old DNS. Renew the Wi-Fi lease or flush the cache so ads drop. You don't need a new router. Point a phone or laptop at Pi-hole when the router won'tWhen Nest, Google Wifi, or an ISP gateway will not take custom DNS, set DNS on one phone or laptop so it asks Pi-hole. You don't need a new router for this device. When a site won't load after Pi-holeA bank, streamer, or login page breaks after Pi-hole. Pause blocking for five minutes, then allow the domain you need. You don't need a new router. Point common home routers at Pi-holeWhere to set DNS on TP-Link, ASUS, eero, Netgear, Nest, and ISP gateways so the house asks Pi-hole. Prefer LAN DHCP DNS. You don't need a new router. When ads come backAds are back, sites won't load, or a phone still shows banners. Check the computer, Pi-hole, router DNS, then the phone. When ads sneak past on IPv6Pi-hole looks fine on IPv4, but phones still show banners. Check IPv6 DNS on the router, or turn that path off for now. You don't need a new router. When one laptop still shows adsEveryone else's ads dropped. One laptop (or one browser) still shows banners. Check Chrome, Edge, or Firefox Secure DNS, Windows encrypted DNS, Mac Private Relay, then a VPN. You don't need a new router. When guest Wi-Fi still shows adsGuest Wi-Fi is a separate network on purpose. Leave guests on ISP DNS, put a visitor on the main house Wi-Fi, or point guest DNS at Pi-hole only if they can reach the computer. You don't need a new router. The first useful thingPut a house-wide ad block on the old PC. The rest of the house keeps using the internet as usual. You don't need a Raspberry Pi. Point the house at the ad blockAfter Pi-hole is installed, point the house router at the computer for DNS. Phones and laptops need no app. Sites still load. A lot of ads don't. When ads come back, check the ad blockThe computer is awake, but banners are back. Check that Pi-hole is still answering before you buy a mesh kit or blame the router. Is the computer still on?You left the computer on. This morning ads are back, or SSH hangs. Check if it is awake before you buy anything.