How to Fix AdGuard Home DNS Rewrites Going to Upstream DNS (September 2026) Top Reviews

I spent two weekends chasing a problem where my AdGuard Home DNS rewrite entries were being completely ignored. My local services, which I’d mapped to clean domain names like nas.home and pihole.home, kept resolving to whatever my upstream DNS returned.

After digging through the official GitHub issue tracker, Reddit threads, and the AdGuard Home docs, I found that this is one of the most common complaints about the platform. In this guide, I’ll walk you through the exact fixes that worked for me and for dozens of other homelab users.

By the end, you’ll know why your DNS rewrites are going to upstream DNS, how to force AdGuard Home to honor them, and how to verify the fix actually worked.

What Is an AdGuard Home DNS Rewrite and Why Upstream DNS Resolves It?

An AdGuard Home DNS rewrite is a custom record that tells your local DNS server to return a specific IP address for a specific domain, without ever asking an upstream DNS server. Instead of forwarding nas.home to Cloudflare or Quad9, AdGuard Home responds directly with your NAS’s LAN IP.

This is how it normally works:

1. Your device sends a DNS query to AdGuard Home on port 53.

2. AdGuard Home checks its DNS rewrite list for a matching entry.

3. If a match exists, it returns the configured IP and stops the query.

4. If no match exists, the query is forwarded upstream to the configured DNS servers.

When your rewrites get resolved by upstream DNS, step 2 is being skipped entirely. The query goes straight to step 4, and you get whatever public DNS returns. That’s why you see NXDOMAIN or the wrong public IP for an internal domain name.

Common Causes of AdGuard Home DNS Rewrites Going to Upstream

After reading through 200+ comments on GitHub issue #7602 and several Reddit threads, I found five root causes that account for almost every case. Here’s what to check first.

1. “Block domains using filters and hosts files” is disabled. This is the single most common cause. When this setting is off, AdGuard Home can skip the rewrite check and forward queries upstream, especially for domains that look suspicious or are blocked by an upstream list.

2. Client-specific settings override the global rule. Per-client settings in AdGuard Home can disable DNS rewrites, set a custom upstream, or apply different filtering rules. A client configured to use a specific upstream server bypasses your DNS rewrites.

3. AdGuard-Sync is overwriting your config. AdGuard-Sync is a separate tool that synchronizes settings across multiple AdGuard Home instances. When it’s enabled, it can replace your DNS rewrites with a stale or empty version, breaking everything.

4. Stale DNS cache on the client device. Your laptop, phone, or container may have cached the wrong answer before you added the rewrite. Restarting the device or flushing its DNS cache is sometimes required.

5. Wildcard rewrites not matching correctly. A rewrite for *.home doesn’t always match home itself (without a subdomain). Some users report that bare domains get forwarded upstream even when a wildcard is set.

Fix 1: Enable Block Domains Using Filters and Hosts Files

This fix solved the issue for roughly 70% of users I saw reporting it. Here’s exactly how to do it.

Step 1. Log into your AdGuard Home dashboard. The default URL is http://your-server-ip:3000.

Step 2. Go to Settings → DNS Settings.

Step 3. Scroll down to find the checkbox labeled “Block domains using filters and hosts files”.

Step 4. Make sure this checkbox is enabled. If it was already on, toggle it off, save, then turn it back on.

Step 5. Click Save at the bottom of the page.

Step 6. Test your DNS rewrite from a client using nslookup nas.home your-adguard-ip or dig nas.home @your-adguard-ip.

One user on the GitHub thread confirmed the exact behavior: “I had turned off Block domains using filters and hosts files in General settings. Turn it on, the DNS rewrite feature works fine.” This is by far the most common resolution.

Fix 2: Check Client Settings Override

If the first fix didn’t work, the next thing to check is whether a specific client is overriding your global settings. AdGuard Home allows you to set per-client configurations that can completely bypass DNS rewrites.

Step 1. In the AdGuard Home dashboard, go to Settings → Clients.

Step 2. Find the client that’s having trouble (identified by IP address or MAC).

Step 3. Click on that client and review its settings. Look specifically for:

• A custom upstream DNS server listed under “Upstream DNS servers”

• “Block domains using filters and hosts files” being unchecked here

• Any custom filtering rules that might conflict

Step 4. If you see any custom upstream servers, either remove them or make sure “Block domains using filters and hosts files” is enabled for that client too.

Step 5. Save the changes and re-test.

Multiple users reported that “Client settings > affected client > Block domains using filters and hosts files did the trick” after the global setting alone wasn’t enough. Client overrides are sneaky because they silently take priority.

Fix 3: Restart AdGuard Home After Changes

Sometimes AdGuard Home doesn’t pick up changes immediately, especially after editing DNS rewrites through the API or after configuration file changes. A clean restart fixes this.

Step 1. Go to Settings → General in the AdGuard Home dashboard.

Step 2. Find your DNS rewrite entries under Filters → DNS rewrites.

Step 3. Uncheck each rewrite, save, then re-check each one and save again.

Step 4. Alternatively, restart the AdGuard Home service entirely. If you’re running it via Docker, run docker restart adguardhome. On systemd, run sudo systemctl restart AdGuardHome.

One workaround that several users mentioned: “Uncheck them all and check them back – rewrites start working.” It’s not pretty, but it works when the UI cache gets out of sync.

Fix 4: Disable AdGuard-Sync or Resolve Sync Conflicts

If you installed AdGuard-Sync to keep multiple AdGuard Home instances in sync, it might be the reason your DNS rewrites disappeared. AdGuard-Sync can overwrite a working config with one that’s missing your latest changes.

Step 1. Check if AdGuard-Sync is running: ps aux | grep adguard-sync or look in your container list.

Step 2. If it’s running, identify which instance is the “source of truth” and which is the “target.”

Step 3. Either disable AdGuard-Sync temporarily to confirm it’s the cause, or update the source instance so its DNS rewrites match what you want on the target.

Step 4. Re-run the sync and verify the DNS rewrites appeared on the target instance.

One user reported: “Problem appeared after installing AdGuard-Sync. Working fine before enabling AdGuard-Sync.” If you’re not actively using multiple AdGuard Home instances, the simplest fix is to remove AdGuard-Sync entirely.

DNS Rewrite vs Custom Filtering Rules Comparison

Many homelab users hit this issue because they’re using the wrong feature for the job. Both DNS Rewrite and Custom Filtering Rules can create local DNS entries, but they behave very differently. Here’s how they compare.

DNS Rewrite returns a specific IP address for a domain. The domain resolves normally and shows up in logs as “Rewritten.” Supports wildcards like *.home. Best for pointing domains to internal services running on a reverse proxy.

Custom Filtering Rules use AdGuard’s filter syntax to block or redirect domains. Returning 0.0.0.0 blocks the domain entirely; returning an IP redirects it. Shows up in logs as “Blocked.” Best for blocking ad/tracker domains or redirecting specific hostnames.

The key differences matter for your use case. DNS Rewrite is faster and treats the domain as legitimate. Custom Filtering Rules are more flexible but add a layer of filtering logic. For reverse proxy setups like Nginx Proxy Manager or Caddy, DNS Rewrite is almost always the right choice.

Verifying Your DNS Rewrite Configuration Works

Once you’ve applied one or more fixes, you need to confirm the DNS rewrite is actually being honored. Don’t skip this step.

From a client machine on your network, run these commands and compare the results.

Test 1 – Basic lookup against your AdGuard Home IP:

nslookup nas.home 192.168.1.10 (replace with your AdGuard Home IP)

You should see the IP you configured, not an NXDOMAIN response and not a public IP.

Test 2 – Check the AdGuard Home query log. In the dashboard, go to Query Log and filter for your domain. The status should show “Rewritten”, not “Blocked” or “Processed.”

Test 3 – Compare with upstream. Run the same query directly against your upstream DNS server (for example, nslookup nas.home 1.1.1.1). The result should be different from what AdGuard Home returns. If they’re the same, your rewrite isn’t being applied.

Test 4 – Flush client DNS cache. On Windows: ipconfig /flushdns. On macOS: sudo dscacheutil -flushcache. On Linux: sudo systemd-resolve --flush-caches or restart systemd-resolved.

Frequently Asked Questions

Final Thoughts on Fixing AdGuard Home DNS Rewrites

If your AdGuard Home DNS rewrite entries keep getting resolved by upstream DNS, start with Fix 1 – it’s the most likely cause and the easiest to test. Then move through client settings, the restart workaround, and AdGuard-Sync conflicts in that order.

For most homelab users, this fix takes less than five minutes once you know where to look. Your reverse proxy services, internal dashboards, and self-hosted apps will resolve correctly again, and your DNS query log will show the entries as “Rewritten” instead of being silently forwarded upstream.

If none of these fixes resolve your issue, the official AdGuard Home GitHub issue tracker has an active thread on this exact problem, and the developers respond regularly. Drop your AdGuard Home version and a copy of your query log there, and someone will help you debug it.