Written 3 Sep 2026. This is a how-to, not a product card.

When one phone still shows ads

Everyone else's ads dropped. One phone still shows banners. Check Private DNS, Private Relay, a VPN, then the Wi-Fi lease. You don't need a new router.

Haven't installed Pi-hole yet? Start with the first useful thing. Ads back on every device? Start with when ads come back. This note is only the stubborn phone (or tablet) that refuses the house ad block.

Skip until the house already works

If a laptop on house Wi-Fi still shows the same ads, fix the house first. The computer may be asleep, Pi-hole may have stopped, or the router may have forgotten DNS: when ads come back. This note assumes the rest of the house is clean and one phone is the odd one out.

What is going on

The router tells phones to ask the computer for names. That phone may ignore the router. Android Private DNS, iCloud Private Relay, a VPN app, or Chrome Secure DNS can send lookups somewhere else. Ads then load on that phone only. The computer looks fine. The router looks fine. The phone is the bypass.

1. Android Private DNS

On many Androids, open Settings, search for Private DNS, and open it. On a Pixel it often sits under Network & internet. On a Samsung, Connections → More connection settings → Private DNS.

Set Private DNS to Off, or to Automatic if Off is not offered and Automatic still uses the router. Do not leave a hostname like dns.google or one.one.one.one filled in for house Wi-Fi. That path skips Pi-hole on purpose. Browse a site that used to show ads. Skip building a DNS-over-TLS proxy on day one.

2. iPhone Private Relay

On an iPhone or iPad with iCloud+, open Settings → [your name] → iCloud → Private Relay. Turn Private Relay off, or use the Wi-Fi detail for the house network and turn Limit IP Address Tracking off for that network only if you want Relay elsewhere.

Private Relay can hide the phone's traffic path, including name lookups, from the house router. That is useful on a coffee-shop network. At home it means the phone may never ask the computer. Browse again on house Wi-Fi after you change it.

3. A VPN or “secure DNS” app

Any VPN, “ad block” VPN, or browser Secure DNS setting can bypass the house. Disconnect the VPN. In Chrome on the phone, open Settings → Privacy and security → Use secure DNS (wording moves), and turn it off while you test. Same idea in Firefox if Secure DNS is on. Test without the VPN first. Add it back later only if you still want it off-house.

4. Sticky Wi-Fi lease

If Private DNS and Relay are already off, the phone may still hold an old lease from before you pointed the router at the computer. Forget the house Wi-Fi, join again, or toggle airplane mode for ten seconds. Then open a site that used to show ads. Same short check as in when ads come back.

Check from the couch

On another device that already blocks ads, open the Pi-hole query log. Use that stubborn phone for a minute. You should see that phone's lookups. If the log stays quiet while the phone loads pages, the phone is still asking someone else. Go back to Private DNS, Private Relay, or the VPN.

What this is not

This is not a reason to buy a mesh kit, a new router, or a Raspberry Pi. It is not a reason to open Pi-hole to the internet. It is not homework to run DNS-over-TLS on the computer tonight. Fix the phone so it uses the house book first.

What next

If every device broke, walk when ads come back. Confirm the router still points at the computer: point the house at the ad block. Leave the ad block alone for a week when that phone is clean.

Skip

• Skip buying a new router for one phone.
• Skip a mesh kit for ad block.
• Skip exposing Pi-hole to the internet.
• Skip DNS-over-TLS homework on day one.
• Skip this if every device still shows ads. Fix the house first.