Setting Up Adlist on MikroTik: Blocking Ads at the DNS Level

I set up a network at a new site. An hour later the client messages me: “there’s ads leaking out of every corner of the TV, isn’t the router supposed to protect against this?” There’s no protection, because nobody turned on adlist. Sound familiar?

Adlist on MikroTik is a built-in DNS filtering mechanism in RouterOS that cuts off ad and tracking domains right at the router, no Pi-hole, no containers, no extra hardware. Setting up ad blocking with adlist on MikroTik takes 10-15 minutes if you follow the steps instead of clicking around Winbox at random.

Below is a working recipe with commands you can paste into the terminal line by line. No theory for theory’s sake.

1. Diagnosis: why ads hit every device on the network

You set up the network. DHCP hands out addresses, internet is flying, everything’s stable. Then the smart TV in the kitchen starts playing an ad before every movie, your wife’s phone chokes on banners in the mobile browser, and your son’s console gets a pop-up mid-game. Different devices, same problem: DNS.

Adlist in RouterOS solves this centrally: configure it once on the router, and ad domains get cut off for every client on the network that uses it as a DNS server. Doesn’t matter if it’s a smartphone, a set-top box, or a console with no way to install a blocker.

What you get in the end:

• ad and tracking domain blocking at the network level, with nothing to install on client devices
• automatic list updates with no manual work
• the ability to add your own lists or exceptions
• less junk traffic and lighter load on your bandwidth
• a working troubleshooting process for when something breaks a month from now

Setup time: 10-15 minutes if you have access to the router. You’ll need: RouterOS 7.15 or newer, SSH or Winbox access, and a bit of free memory for the DNS cache.

System requirements

At the time of writing, RouterOS 7.19.x is current. Check the official MikroTik site for the latest release before installing.

2. Why ads get through standard router settings

You’re not the first person to wonder why “just pointing DNS at 8.8.8.8” doesn’t stop ads. Let’s go through what actually breaks the picture.

And there you have it: the ad domain database says one thing, but queries keep resolving around it. Let’s go through each cause separately, starting with the most common one: missing a proper list source.

3. Recipe: setting up adlist on MikroTik step by step

Preparation

Check your RouterOS version. Adlist as a built-in feature works from 7.15 onward.

/system resource print

Look at the version line. If the version is below 7.15, update the router before continuing. See the maintenance section below for a safe update process.

Check the current DNS cache size. Adlist stores its records there, and the default 2048 KiB won’t be enough for a large list.

/ip dns print

Result: you’ll see the current cache-size and cache-used. If you’re planning to use a list of 100,000+ domains, expect to raise the cache to 16-32 MB.

Step 1. Increase the DNS cache size

Without this step a large list simply won’t fit, and you’ll get an error in the logs instead of a working blocklist.

/ip dns set cache-size=32768

Result: cache-size grows to 32 MB. For a mid-size home list (10,000-20,000 domains) 8192-16384 is enough. For aggregated lists like StevenBlack hosts, go with 32768 or higher.

Step 2. Add adlist by URL

This is the main scenario. You point it at a ready-made list, RouterOS downloads it, parses it, and keeps it updated on a schedule.

/ip/dns/adlist add url=https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts ssl-verify=no

Result: the list starts downloading in the background. Check the status with the command below after a couple of minutes.

/ip/dns/adlist/print

Expected output looks like this:

Flags: X - disabled
0 url="https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" ssl-verify=no match-count=0 name-count=164769

name-count shows how many domains actually loaded. If it’s zero, either the list is still loading or the URL is unreachable, check the troubleshooting section.

Step 3. Alternative: a local list from a file

If you want to control the list yourself, without an external URL, build your own file in hosts format and upload it to the router.

0.0.0.0 example1.com
0.0.0.0 eu1.example.com
0.0.0.0 ads.trackernetwork.com

You can upload the file via Winbox drag-and-drop into Files, or create it directly in the router’s terminal:

/file/add name=host.txt
/file/edit host.txt contents

After pasting the content, press Ctrl+O to save. Then connect the file to adlist:

/ip/dns/adlist/add file=host.txt

Result: /ip/dns/adlist/print will show name-count equal to the number of lines in the file. If it’s 0, the file format is broken, check the spacing between the IP and the domain.

Step 4. Set up a whitelist for important domains

Sooner or later adlist will block something you need: a payment widget, a client’s CRM analytics, a corporate service domain. The ready fix is a static FWD record, which takes priority over adlist.

/ip/dns/static/add name=important-domain.com type=FWD

Result: requests to important-domain.com will bypass the block and resolve through the router’s normal DNS servers.

Step 5. Make sure clients actually use the router as DNS

If the DHCP server isn’t handing out the router’s own address as DNS, none of the setup above will ever be used by clients.

/ip dhcp-server network print

Check the dns-server column. It should show the router’s own address (usually 192.168.88.1 or your gateway), not something else.

Step 6. Block workarounds via third-party DNS

Advanced users and some apps (Chrome, Android) set DNS manually or use DoH directly, bypassing the router. Without blocking outbound DNS traffic, your whole setup turns into a sieve.

/ip firewall filter add chain=forward protocol=udp dst-port=53 action=reject src-address=192.168.88.0/24 dst-address=!192.168.88.1 comment="block external DNS UDP"
/ip firewall filter add chain=forward protocol=tcp dst-port=53 action=reject src-address=192.168.88.0/24 dst-address=!192.168.88.1 comment="block external DNS TCP"

Result: any request on port 53 to an external server gets rejected, except requests to the router itself. Replace 192.168.88.0/24 with your own subnet.

Don’t mess up the rule order in the firewall: if you already have allow rules for forward higher up in the list, add these two right before them, or explicitly check the final order with /ip firewall filter print.

4. Verification: confirming adlist is actually blocking ads

A setup without verification isn’t a setup, it’s wishful thinking. Three commands that show you the real picture.

/ip/dns/adlist/print

Look at the match-count and name-count fields. match-count grows as clients actually hit blocked domains. If match-count is still 0 after a day, either clients aren’t using the router as DNS, or the list is empty.

/ip dns cache print

A list of cached responses. Find a known ad domain in there and check that it resolves to 0.0.0.0.

/ip dns cache flush

Clear the cache before your control test, so you’re not looking at old entries. After flushing, run a resolve for a known ad domain from a client machine:

nslookup doubleclick.net 192.168.88.1

Expected result: 0.0.0.0. If a real IP comes back, the domain isn’t in the list, or the client is resolving around the router.

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'lineColor': '#64748b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'flowchart': {'curve': 'linear', 'nodeSpacing': 50, 'rankSpacing': 50}
}}%%
flowchart TD
    A["Client requests domain"] --> B["MikroTik router DNS"]
    B --> C{"Domain in adlist?"}
    C -->|Yes| D["Response 0.0.0.0"]
    C -->|No| E["Request to upstream DNS"]
    E --> F["Real IP to client"]
    style A fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style D fill:#f8fafc,stroke:#ef4444,stroke-width:2px,color:#b91c1c
    style F fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d

5. Complications: what breaks and how to fix it

It’s not as bad as you think, it’s worse: ad networks keep rotating domains, and the router’s memory isn’t infinite. Here are the typical problems.

Error: adlist read: max cache size reached

Cause: the DNS cache is full, the domain list doesn’t fit entirely.

Fix: increase the cache size, or reduce the number of adlist sources.

/ip dns set cache-size=65536

Error: name-count stays at 0 after adding adlist by URL

Cause: the router can’t reach the list source, either there’s no internet at the time it was added, or there’s an SSL certificate issue.

Fix: check that the URL is reachable and try temporarily disabling certificate verification.

/ip/dns/adlist/set 0 ssl-verify=no
/ip/dns/adlist/reload

Problem: a needed service is blocked (payment page, CRM, client analytics)

Cause: the service’s domain got caught by an overly broad list.

Fix: temporarily disable adlist, find the real IP through an external DNS, then add an exception via an FWD record.

/ip/dns/adlist/set 0 disabled=yes

After diagnosing, re-enable adlist and add a whitelist entry for the specific domain, as shown in step 4 of the recipe.

Problem: ads still show up on some devices

Cause: the device isn’t using the router as DNS, it’s using DoH baked into an app (typically Chrome, Firefox, Android 10+).

Fix: block third-party DNS traffic via firewall as in step 6, or manually disable DoH inside the apps on client devices.

Problem: the router slows down after adding a large list

Cause: on weaker models (RB750, hAP lite and similar), a large number of DNS cache entries eats up all available memory.

Fix: use a compact list of ad domains only, without trackers and malware domains, instead of an aggregated list of 160,000+ entries.

6. Alternatives: other ways to cut ads on your network

Adlist isn’t the only option. Here’s what’s worth comparing before you decide.

For a home network or small office, adlist on MikroTik covers the job completely without extra moving parts. If you need detailed analytics on blocked domains with graphs, look at Pi-hole or a cloud DNS provider instead, RouterOS won’t give you that kind of dashboard.

7. Maintenance: keeping the blocking from falling apart a month later

Monitoring

Check match-count and name-count via /ip/dns/adlist/print once a week. A sharp drop in name-count means a problem with the list source.

Automatic list updates

RouterOS checks for adlist updates every 4 hours automatically. A manual reload is rarely needed, mostly right after changing the source.

/ip/dns/adlist/reload

Configuration backup

Back up before making any DNS changes. Keep a copy not just on the router itself, but off it too.

/system backup save name=router-backup-before-adlist
/export file=router-config-export

What to back up: a full backup plus a text export of the config. How often: before every significant change, and once a month on schedule. Where to store it: off the router, on a separate server or in the cloud, a local copy won’t save you if the device dies. How to restore:

/system backup load name=router-backup-before-adlist

Security

• restrict access to the router’s DNS server via firewall to the local subnet only
• never enable allow-remote-requests=yes on an interface facing the internet
• use SSH keys instead of a password for router management
• set up a separate user with restricted rights for daily administration instead of constantly working under admin
• enable fail2ban-style protection via the built-in address-list and firewall rules against brute-force attempts on management ports
• restrict Winbox/API access to a list of allowed IP addresses
• disable unused services via /ip service print and /ip service disable

Updating RouterOS

How to update safely: back up first, then update on a test device or during a maintenance window, not on a Friday evening. What to check before updating: release notes for any changes related to DNS and adlist. How to roll back: keep the previous RouterOS image and your config backup on hand, rolling back means loading the old image plus restoring the backup.

Port table

8. FAQ

Why isn’t ad blocking working after setting up adlist?

Most often it’s because client devices are using a third-party DNS or a browser’s built-in DoH instead of the router. Check your DHCP server settings and DNS address distribution, as well as firewall rules blocking external DNS traffic.

How do I verify adlist is working correctly?

Run /ip/dns/adlist/print and check name-count, it should show a nonzero number of domains. Then check resolution of a known ad domain with nslookup from a client, pointed at the router’s address, the response should be 0.0.0.0.

What do I do if adlist blocked a site I need?

Add a static DNS record of type FWD for that specific domain via /ip/dns/static/add name=domain type=FWD. This record takes priority over adlist and lets the request through to normal resolution.

How is adlist on MikroTik different from Pi-hole?

Adlist works natively inside RouterOS with no separate server, but it doesn’t give you visual stats or detailed per-request logs. Pi-hole needs a separate host, but gives you a convenient web interface with graphs and a history of blocked domains.

How many domains can I add to adlist on MikroTik?

The limit depends on the DNS cache size you allocated. Lists of 150,000-160,000 domains (like StevenBlack hosts) need a cache of 32 MB or more. On weaker router models with limited memory, use compact lists instead.

How often does the adlist list update?

RouterOS automatically checks for updates every 4 hours. Forcing a reload via /ip/dns/adlist/reload triggers a check immediately, but normally there’s no need for it.

Outcome

After this setup, ads and trackers get cut off at the DNS level for the entire network at once, with nothing to install on phones, set-top boxes, or smart TVs. The list updates itself every 4 hours, and whitelisting via FWD records handles the rare false positive.

What’s left is checking match-count once a week and remembering to back up before a RouterOS update. If ads are still getting through after all these steps, leave a comment and we’ll figure out what got missed.