Secure Your DNS with DNSSEC: AdGuard Home and Pi-Hole Integration with Stubby

Secure Your DNS with DNSSEC: AdGuard Home and Pi-Hole Integration with Stubby

In Uncategorized by dbtech

Stubby for Pi-Hole and AdGuard

We’ve spent a fair amount of time talking about Pi-Hole, AdGuard Home, and other ways to protect yourself online.

In this video I want to show how to add DNSSEC to your Pi-Hole or AdGuard setup by installing and configuring a “stubby” container.

‘Stubby’ is an application that acts as a local DNS privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy.

A stub resolver converts name resolution requests from applications like web browsers into DNS request messages.

For our DNS privacy resolver, we’re going to use a 3rd party DNSSEC provider called NextDNS, but there are other options out there that will accomplish the same goal.

If you’re not interested in using a 3rd party provider, then this video may not be for you and, but hopefully you’ll check out some of my other content instead of this video.

Now, with that said, in order to follow this tutorial, you’ll need an account at You can use the “free tier” for testing or if you’re getting fewer than 300k DNS requests per month.

If you’d like to get their pro plan for $1.99/month of $19.99/year, there’s an affiliate link in the video description. (

DNS issue resolution

If you run into any issues with port 53 being used by something else already, do the following:

cd /etc/systemd
nano resolved.conf

Under the “[Resolve]” section change:



Then save and exit the file. Then run this command to restart systemd:

sudo systemctl restart systemd-resolved

Creating a stubby.yml file

The first thing we need to do is create a file called “stubby.yml”. I’m just going to put this in the home directory just to keep things easy.

Then we’ll paste the following into it:

tls_query_padding_blocksize: 256
dnssec_return_status: GETDNS_EXTENSION_TRUE
tls_min_version: GETDNS_TLS1_3
edns_client_subnet_private : 1
idle_timeout: 10000
 - 0:0:0:0:0:0:0:0
# The following information can be found at and then scroll down to "Stubby" and copy/paste from there to here.
round_robin_upstreams: 1
 - address_data:
   tls_auth_name: ""
 - address_data: 2a07:a8c0::0
   tls_auth_name: ""
 - address_data:
   tls_auth_name: ""
 - address_data: 2a07:a8c1::0
   tls_auth_name: ""

This Stubby can be found here:

Place this file on your server. Make note of the path. You’ll need it in the docker-compose.yml file.

Make the appropriate changes to the upstream_recursive_servers. You can find this information in the setup setup tab in your account. Just scroll down to the setup guide and click “Linux”. Then you should see the Stubby information below that.

Creating Docker Networks

But first, we need to create a docker network to attach our containers to.

We’re going to run the following commands:

First we’ll create a docker network.

Here’s what I would use for the Pi-Hole network:
docker network create pihole_local_network –subnet=

Here’s what I would use for the AdGuard Home network:
docker network create adguard_local_network –subnet=

And then we’ll list the docker networks available on our machine.
docker network ls

Find the network we just created and save that information for later.

We’ll end up putting the created network name in the ‘networks’ in both services and the network declaration at the bottom of the docker-compose.

Creating a docker-compose.yml file

Because we’ve already done videos on both Pi-Hole and AdGuard Home, we’re not going to spend a lot of time digging into the intricacies of either service. But we’ll talk about the docker-compose files and what’s going on in each one. Then you can choose the ad blocker you want to use in your own setup.

Now that we have our network created, we’ll go ahead and create our docker-compose file.

Go back to your home directory and run the command:
nano docker-compose.yml

If you want to use Pi-Hole, here is the docker compose for it:

version: "3"
   container_name: pihole
   image: pihole/pihole:latest
     - "53:53/tcp"
     - "53:53/udp"
     - "67:67/udp"
     - "8082:80/tcp"
     - TZ=${TZ} # change this to your timezone
     - WEBPASSWORD=${WEBPASSWORD} # put in the password you want to use to login to pi-hole
   # Volumes store your data between container upgrades
     - '/opt/pihole/etc/pihole:/etc/pihole'
     - '/opt/pihole/etc/dnsmasq.d:/etc/dnsmasq.d'
     - '/opt/pihole/etc/resolv.conf:/etc/resolv.conf'
   restart: unless-stopped
   image: carterfields/stubby
   restart: unless-stopped
     - '/home/stubby.yml:/usr/local/etc/stubby/stubby.yml'

   external: true

This Pi-Hole / Stubby file can be found here:

If you want to use AdGuard Home, here is the docker compose for it:

version: '3.3'
       container_name: adguardhome
       restart: unless-stopped
           - '/opt/adguard/work:/opt/adguardhome/work'
           - '/opt/adguard/confdir:/opt/adguardhome/conf'
           - '53:53/tcp'
           - '53:53/udp'
           - '67:67/udp'
           - '80:80/tcp'
           - '443:443/tcp'
           - '443:443/udp'
           - '3000:3000/tcp'
           - '853:853/tcp'
           - '784:784/udp'
           - '853:853/udp'
           - '8853:8853/udp'
           - '5443:5443/tcp'
           - '5443:5443/udp'
       image: adguard/adguardhome:latest
       #image: tschaffter/getdns-stubby
       image: carterfields/stubby
       restart: unless-stopped
         - '/home/stubby.yml:/usr/local/etc/stubby/stubby.yml'
           ipv4_address: # this will be your AdGuard Upstream DNS Server. Settings > DNS > Upstream DNS Settings

   external: true

This AdGuard / Stubby file can be found here:

Setting Upstream DNS

Now login to your ad-blocker and set the upstream server to the IP address of the stubby container’s local_network that was defined in the docker-compose files from earlier.

Pi-Hole: /admin/settings.php?tab=dns
AdGuard: /#dns

Special Thanks

Thanks to Mattchis for his help on this!

His socials are the following:
Twitter: mattchis
Mastodon: @[email protected]
Github: mattchis



0:00 Intro

2:01 Pre-emptive DNS Fix

Stubby Setup

3:53 Configuring stubby.yml

5:52 Side Note

Pi-Hole Setup and Config

6:20 Creating Pi-Hole Network

7:22 Creating Pi-Hole Docker-Compose

10:43 Deploying Pi-Hole and stubby

11:43 Troubleshooting

13:52 Logging Into Pi-Hole

14:20 Configuring Upstream DNS

15:05 Changing Local DNS to Point to Pi-Hole

16:51 Testing Ad Blocking

AdGuard Setup and Config

18:59 Getting into AdGuard

19:33 Creating AdGuard Network

20:16 Creating AdGuard Docker-Compose

24:09 Deploying AdGuard and Stubby

25:05 First Configuring of AdGuard

25:38 Logging into AdGuard

25:41 Configuring Upstream DNS

26:46 Changing Local DNS to Point to AdGuard

27:06 Testing Ad Blocking

28:03 Troubleshooting

28:31 Validating Fix