DNS ad blockers vs a VPN with ad blocking

Before your phone can load anything, it has to turn a name into an address. That's a DNS lookup, short for Domain Name System, and it works like a phone book: you give it a name, and it gives you a number to ring. A single page can involve dozens of these lookups, one for each domain it pulls something from.

A DNS blocker is a phone book with some pages torn out. Ask it for a known advertising or tracking domain and it says there's no such number. With no address, your phone never makes that connection, so the advert or the tracker never loads. That saves data and battery as well as clutter.

It works in every app that uses the device's normal lookups, not just the browser. It also has a built-in limit: it judges by domain name alone. It never reads the page, so an ad served from the same domain as the content gets through, and it isn't antivirus.

Let's follow one page. You're on café Wi-Fi, opening a recipe site that, alongside the recipe, calls on a dozen ad and tracker domains.

With a DNS filter, set on your phone or through an app, your lookups go to the filter service. It refuses the dozen, answers the rest, and the page loads lighter. Everything else travels over the café's network as usual. The site's own encryption protects the recipe and anything you type, but the café's network can still see which sites you connect to, and the site sees your real address.

With Clean Web, the same dozen lookups are refused. The difference is the road. Everything else goes through WrapVPN's encrypted tunnel to our exit server, and on to the site from there. The café's network sees one encrypted connection to our server, and the site sees the exit server's address, which everyone on that server shares.

Same ads blocked, same lighter page. A very different picture for anyone watching the café's network. In the first case, they can't read the recipe, but they can tell you're on a recipe site at eleven in the morning, and which site you open next. In the second, they can tell you're using a VPN, and that's about it.

A DNS filter can hide your lookups, and only when the connection to the filter is encrypted. Where your connections go next, and the address websites see, stay as they were. That isn't its job.

A VPN moves your whole connection out of sight of the local network. That matters most on networks you don't control: cafés, hotels, airports, a friend's flat. It also swaps your address for the exit server's, so the trackers that do slip through, such as those served from a site's own domain, see that shared address rather than the one belonging to your home or the café you're sitting in.

Either way, someone answers your lookups: the filter service in one case, us in the other. We keep connection records and hourly usage summaries that include the amount of data and the addresses and domain names reached, which can be linked to your account, and our privacy policy has the details. Choose the company you're happier to trust with that list.

A standalone DNS filter is often the more flexible blocker. Many let you choose categories to block, keep an allow list for a site that breaks, or set a stricter profile for a child's tablet. Some chart everything they've blocked, which is genuinely fascinating for about a week.

It also works without a VPN, which suits people who mostly browse from home and simply want fewer ads.

Clean Web is simpler: a switch in the WrapVPN app that blocks known ad and tracker domains while you're connected, and also turns on the major search engines' safe search and YouTube's Restricted Mode. It's on by default on Android and off by default on iPhone, iPad and Mac, so turn it on there. On Windows, check the switch.

You can run both, but they don't stack the way you might hope. Whichever service answers your device's lookups is the one doing the blocking, so two blockers rarely block more than one would.

Browsers add a twist. Many have their own 'secure DNS' setting, which sends lookups to a service of the browser's choosing. That goes around Clean Web, and it can go around a filter set on the device too. If one browser still shows ads while your apps don't, that setting is the first thing to check.

The tidy approach is to pick one blocker for each device and let it get on with the job.

If ads are your only concern and you're mostly on your own Wi-Fi, a DNS filter can be all you need. If you're often on networks you don't control, or you'd rather websites didn't see your address, a VPN covers that, and Clean Web blocks the ads at the same time. Install WrapVPN, open its settings and check that Clean Web is on.