OpenSourceVerdict

Pi-hole vs AdGuard Home vs Technitium

Pi-hole vs AdGuard Home vs Technitium: six gates, one Pick

What we found

Pi-hole 2026.10.0, AdGuard Home 0.107.79 and Technitium DNS Server 15.6.2 through the same six gates, each scored 0 to 10 (Rubric 1.1).

Scores (Install, Resources, Real use, Resilience, Health, Security):

  • Pi-hole: 6, 10, 10, 10, 8, 8. Overall 8.7, Use it; the Pick, the only one without a cap.
  • AdGuard Home: 8, 10, 10, 8, 7, 6. Overall 8.2, Use with care (capped: a crash lost a confirmed change).
  • Technitium: 9, 10, 10, 8, 8, 6. Overall 8.5, Use with care (capped: crash losses, built-in admin login).

What we found:

  • Install: Pi-hole's Caddy example needed two changes (-4), AdGuard Home's run line maps a port the VM's DHCP client held (-2), and Technitium's resolver step fails (-1).
  • Resources (2 CPUs each; rate limits off on Pi-hole and AdGuard Home, our generator exempt on Technitium): idle 9.7, 45.9 and 75.1 MB; all 15,000 queries answered at the steady load; Break Point (losses over 1 %) about 30,500, 46,500 and 24,400 queries a second.
  • Real use: all three passed ad blocking, a second household member, a local name.
  • Resilience: five machine crashes each, seconds after we began adding local DNS records: Pi-hole lost no confirmed change; in every crash, AdGuard Home lost the last one and Technitium all 400. Backups taken 30 s after the last change passed.
  • Upstream DNS cut, each as installed (reported, not scored): of 100 cached sites, Technitium answered 100 for 99 minutes (by the end, most after a wait of about 1.8 s), Pi-hole 100 for 59, AdGuard Home 14 after 9 and none from minute 20 to 46.
  • Security: AdGuard Home's setup wizard answers anyone until it is done; Technitium starts with admin / admin. None runs with only the rights it needs, as shipped. AdGuard Home's login is a password only. An older AdGuard Home advisory (CVE-2024-36586, high) waited 112 days by AdGuard's changelog (GitHub lists no fixed version); our check counts only the two years up to each release.

For: Pi-hole, homes, small teams and businesses (use your own password, drop unused capabilities). AdGuard Home, encrypted upstream DNS out of the box (finish its setup wizard right after the first start). Technitium, a full DNS server with its own recursion and single sign-on; set its admin password in the Compose file first.

Lab: isolated test VM, Debian 13, 4 vCPU, 8 GiB RAM. Scored tests 2026-10-21 to 22, outage test 2026-10-23. Not affiliated with Pi-hole, AdGuard or Technitium. Synthetic (AI) narration.

Chapters

  1. 0:00 Pi-hole vs AdGuard Home vs Technitium DNS outage test
  2. 1:07 What Pi-hole, AdGuard Home and Technitium are
  3. 2:18 Pi-hole, AdGuard Home and Technitium install
  4. 4:59 DNS server RAM usage and load test
  5. 7:47 Ad blocking use cases
  6. 9:29 DNS server crash test, backups and outage
  7. 14:51 Project health and GitHub stars
  8. 16:39 Pi-hole, AdGuard Home and Technitium security
  9. 19:20 Caveats
  10. 20:34 Verdict: Pi-hole vs AdGuard Home vs Technitium

The full narration

What the video says, word for word, by chapter.

Opening

Ads blocked for your whole network, with nothing to install on your devices: that's what Pi-hole, AdGuard Home and Technitium do. But when your blocker stops answering, the devices that use it can't look up websites. Which one can you trust? Welcome to OpenSourceVerdict. We stress-tested all three on an isolated test machine and scored them in six gates.

We pushed each one to its breaking point and crashed the machine running it. But first: if the internet's DNS goes down, how long does your ad blocker keep answering?

Cold open

We cut three blockers, each as installed, off from all outside DNS, right after each had looked up the same 100 popular sites, and asked for them again every minute.

Technitium still answered all 100 after 99 minutes. Pi-hole answered all 100 for 59 minutes; ten minutes later, only 19. AdGuard Home was down to 14 after nine minutes, and from minute 20 it answered nothing for 27 minutes, not even names it still had cached.

The tools

All three are DNS servers you run yourself: your devices ask them for addresses, and they block ad and tracker domains from lists.

Pi-hole calls itself network-wide ad blocking via your own Linux hardware, and it is licensed under the European Union Public License. We tested its Docker image 2026.10.0, which bundles Core 6.5, FTL 6.8 and the web interface 6.6.1.

AdGuard Home is network-wide software for blocking ads and tracking, under the GPL version 3. We tested version 0.107.79, its latest stable release on our test day.

Technitium DNS Server is an authoritative and a recursive DNS server, also under the GPL version 3, and it blocks ads with block lists too. We tested version 15.6.2.

All three ship an official Docker image, and that is what we installed. Each went on a clean, isolated test VM with Debian 13, four virtual CPUs and 8 GiB of memory.

Gate 1: Install

Gate one: Install.

All three hit the same first obstacle: on our Debian 13 VM, the system's own resolver already listens on port 53, the DNS port. All three document a fix for it, so the busy port itself cost none of them a point.

One more snag hit all three: a container whose first start failed on that busy port came back without a network. A plain Alpine image did exactly the same, so that is Docker, not the tools.

Pi-hole's own example for running it behind the Caddy proxy returned an error, 502, as written.

It needed two changes: putting Pi-hole on Caddy's network, and pointing Caddy at the container's port 80 instead of 8081.

The web interface worked behind the proxy only after both, and each change costs two points: Pi-hole installs at six.

AdGuard Home's docker run line also maps port 68, which the same page lists as required for running a DHCP server.

On our VM, the system's own DHCP client holds that port, so the container did not start until we removed the mapping.

A documented install that does not start costs two points: AdGuard Home installs at eight. Its setup wizard then sets the admin login and the ports.

Until you finish AdGuard Home's setup wizard, anyone who can reach it can fill it in.

Technitium's fix for the busy port, in its install guide, deletes the system's resolver file and then writes a new one with sudo echo. That cannot work as written: it fails with permission denied and leaves the machine with no resolver file.

The project's own build guide has the working form, with sudo tee.

A documented step that fails while the tool still works costs one point: Technitium installs at nine. Its docs give no ready-made proxy setup, so we used a generic Caddy one, and the console worked through it.

From the first command to a working admin page, image download included, AdGuard Home took 3.3 seconds, Pi-hole 5.1 and Technitium 5.6. For AdGuard Home, that first page is its setup wizard. In short: Pi-hole worked behind the proxy only after two fixes of ours, so it loses four points and scores six. AdGuard Home would not start until we removed one port setting, so it loses two and scores eight. Technitium loses one point for a broken command in its guide and scores nine.

Gate 2: Resources

Gate two: Resources.

Idle, ten to fifteen minutes after start, Pi-hole used 9.7 megabytes of memory, AdGuard Home 45.9 and Technitium 75.1.

For the steady load, a script sent 25 queries a second for ten minutes, which we chose to stand for the busy hour of an office with about fifty devices. By default, all three limit how many queries one client, or one client network, may send. Our load generator stands in for many devices, so on Pi-hole and AdGuard Home we switched the limit off, and on Technitium we exempted the generator, each the way its docs describe. Each one answered all 15,000 queries, none with a wrong answer, and half of them in 0.2 milliseconds or less. Memory peaked at 14.7 megabytes for Pi-hole, 66 for AdGuard Home and 100.9 for Technitium.

Then we raised the load until each one started to drop queries. Measured over the seconds after that point, Technitium answered about 24,400 queries a second, Pi-hole about 30,500, and AdGuard Home about 46,500.

For Pi-hole, that point came after about a million queries, when its DNS process ran out of shared memory, 64 megabytes in its container, and restarted. That memory holds its query history; we did not test how long it lasts at our steady load.

Each tool was limited to two of the VM's four CPUs, and Technitium was using both. At every Break Point, our load generator was still sending every query on its schedule, so the limit was the tool, not our test machine. Past its Break Point, Technitium was still answering about 43,500 a second when the ramp ended, losing 2.82 percent. Even the lowest is over 900 times our steady load.

AdGuard Home's limit is 20 queries a second for a whole client network, and it drops the rest.

One surprise: we put our load generator on AdGuard Home's documented allowlist, and version 0.107.79 ignored it: it answered 20 queries a second and dropped the rest. It is a known bug, and AdGuard says its beta releases fix it. So for AdGuard Home's load tests we switched the limit off, which its docs say is safe on a server the internet cannot reach.

In short: with the limits lifted, none of them made a mistake at our busy-hour load, and each could take over 900 times more. No errors at the steady load, and Break Points far above it: resources score ten for all three.

Gate 3: Real use

Gate three: Real use.

Use case one: no ads on any device in the house, with the block list each install turns on, or the first one it offers.

Pi-hole's install turns on one list, and AdGuard Home's wizard leaves one on. Technitium starts with none, so we added the first list its console offers. All three blocked a known ad domain, and ten ordinary sites we checked still got through.

On a neutral set of 131 ad and tracker domains, which we report but do not score, Pi-hole blocked 89, and AdGuard Home and Technitium 102 each. Pi-hole and Technitium used the same list; Technitium also blocks every name under a listed domain, which is where its 13 extra come from.

Use case two: different rules for different people, say TikTok blocked on a child's tablet but not on a parent's phone.

Pi-hole does it with groups, AdGuard Home with its client settings, and Technitium with its Advanced Blocking app, from its own app store. On all three, the tablet got the block and the phone did not.

Use case three: give a home server a name, nas dot home dot arpa, so nobody has to remember its IP address.

All three found it, and still did after a restart. In short: all three blocked ads for the whole house, kept the tablet's rule off the phone, and found the home server by name. Every check passed with no workaround: real use scores ten for all three.

Gate 4: Resilience

Gate four: Resilience.

First, we killed each one five times, seconds after we began adding local DNS records; none lost a record it had confirmed.

Then the hard test: about four seconds after we began adding local DNS records, we crashed the whole machine with no time to save to disk, five times per tool. Before each run, the fresh install's own files went to disk, so the crash tested your changes, not the first seconds of an install. Pi-hole kept every confirmed change in all five crashes.

AdGuard Home lost one of about seventy each time: the last change it had confirmed.

Technitium lost all 400 changes it had confirmed in each run.

We checked our lab too: a small test program writing to SQLite with its strictest setting went through five crashes and lost nothing.

Why the difference? All three save a change by writing a new file and swapping it in for the old one. Pi-hole and AdGuard Home both force the new file onto the disk, but neither forces the swap itself.

For a local record, Pi-hole then forces a second file, its hosts list, onto the disk before it confirms. AdGuard Home does nothing more after its swap, so a crash right after the last change can undo it.

Technitium waits up to five seconds before it writes your changes to a file, and it never forces that file onto the disk. In our kill test, that write came just before each kill; a kill a moment earlier would have lost the newest changes too.

We found nothing in their docs that warns about this.

Technitium's delay showed up again in our backup test: a backup taken right after a change missed it.

So we took every backup thirty seconds after the last change, and all three backups brought every record back. We also upgraded each one from the release that was current a year before, with our records stored, and all three kept them. Your local records are not locked in: Pi-hole and AdGuard Home keep them in plain text files. Technitium exports a zone as a standard zone file.

One more Pi-hole detail: when we crashed the machine seconds after Pi-hole's very first start, its web interface did not come back. Its web server then could not load the certificate it made at that first start; in a separate diagnostic crash, every confirmed record was still on disk.

In short: all three passed the restore, upgrade and export checks, so the crash made the difference. Pi-hole kept every change it had confirmed; AdGuard Home lost the last one in each crash, and Technitium lost all of them, so AdGuard Home and Technitium lose two points each. Those first-start crashes are not scored: Pi-hole passed all five scored checks and scores ten; AdGuard Home and Technitium lost confirmed changes and score eight.

A lost confirmed change also holds a verdict at use with care, whatever the average.

One more test, reported but not scored: what happens when the internet's DNS goes away. Right after each blocker had looked up the same 100 popular sites, we cut all three off from all outside DNS and asked for those sites every minute, 100 times.

Technitium's docs say that when it cannot reach its upstream, it keeps answering from expired records for up to three days, and that this is on by default. Pi-hole's docs say it keeps answering a name for up to an hour past its expiry while it tries to refresh it. AdGuard Home has an option for answers past expiry, its optimistic cache; as installed, it is off.

Each line shows how many of the 100 sites one blocker still answered, minute by minute after the cut. Technitium answered all 100 in every round; by the end, most of them came after a wait of about 1.8 seconds, the time its settings give the upstream before it answers from an expired record. Pi-hole answered all 100 for 59 minutes, most of them past their expiry; ten minutes later it answered 19, and at the end, 7. AdGuard Home answered a name only while it was within its expiry: 38 after four minutes, 14 after nine. At minute 20 it stopped answering even those, and for 27 minutes none of the names still in its cache got an answer.

Its log and its code show why: from minute 16, each question for an expired name waited while it retried, one attempt at a time, to reach its upstream. As installed, it handles at most 300 questions at once. When we repeated the test and looked inside, all 300 were waiting, and it had stopped reading new questions, even for names still in its cache.

AdGuard Home has had an open bug report since 2022 that describes the same thing: cached answers not served after the network is lost. If you run AdGuard Home, its optimistic cache gives answers past expiry; we did not test whether it avoids this stall.

Gate 5: Health

Gate five: Health.

We looked at the twelve months before our test day. Pi-hole, counted across its four repositories, had 277 new issues; maintainers replied to 248, after a median of 0.2 days. AdGuard Home had 320, with maintainer replies on 199, after a median of 1.2 days. Technitium had 509, with replies on 493, after a median of half a day.

AdGuard Home's weak spot: in those twelve months, 104 pull requests were opened, and 31 were closed, older ones included. One account opened 46 of the 104, 45 of them in two days in August, and all 46 were still open on our test day.

Technitium's: one author made at least half of the commits. That matters: the project then leans heavily on one person, and if that person steps away, fixes and updates could slow down or stop. Stars, shown but never scored: Pi-hole about 61,400, AdGuard Home about 37,600, Technitium about 10,200. In short: all three release often, and when maintainers reply to a new issue, they do it quickly. Pi-hole loses points for two ratings of fair: a median of 19.9 days to close an issue, and two main authors. AdGuard Home leaves most proposed code changes waiting and also leans on two main authors. Technitium rests mostly on one author.

Health scores eight for Pi-hole, seven for AdGuard Home and eight for Technitium.

Gate 6: Security

Gate six: Security.

On Pi-hole, and on AdGuard Home once its setup wizard is done, nobody can read or change your settings without the password you set at install.

Technitium starts with a built-in login: admin, with the password admin. Its console asks you to change it after you sign in, and its API docs recommend it. Until you do, anyone who can reach its console can sign in as admin.

That fails our secure-by-default check, which on its own holds Technitium's verdict at use with care.

None of the three runs with only the rights it needs, as shipped. Pi-hole's server runs as a normal user, but its Compose example switches on three system capabilities.

Its own comments call them needed only for its DHCP server or for setting the clock, or simply optional. AdGuard Home and Technitium run as root, the all-powerful user, inside their containers.

Then we watched the network for 24 hours. We recorded every outside server each one contacted, to catch anything its docs do not mention, like hidden telemetry. The result: every one of them was named in its docs or shown in its settings. Pi-hole sends your queries to Google's DNS unless you pick another server, checks GitHub for new versions, and asks pool.ntp.org for the time. AdGuard Home sends them to Quad9 over HTTPS, and Technitium asks the root servers itself. Technitium also checks its own website for updates after someone signs in, at most once an hour.

Pi-hole offers two-factor login, and Technitium offers two-factor login and single sign-on. AdGuard Home's login is a password, nothing more.

All three take security reports privately. Of the advisories published in the two years up to each tested release, none of medium severity or higher waited more than sixty days for a fix. Pi-hole had by far the most advisories: 53, from three of its repositories, six of them for the dnsmasq code its DNS engine bundles.

Every one we counted was fixed by the day it was published. In short: none of the three ships with only the rights it needs, which costs each of them two points. AdGuard Home also has no two-factor login, and Technitium starts with a password anyone can guess, and each of those costs two more. Security scores eight for Pi-hole, and six for AdGuard Home and for Technitium.

Caveats

A few things that did not change a score.

By its docs, AdGuard Home's limit of 20 queries a second counts a whole /24 network as one client. By those docs, fifty devices on one such network, sending our steady load of 25 queries a second, would go over it; we did not test that.

AdGuard Home and Technitium can encrypt the lookups they pass on to the internet out of the box, AdGuard Home even by default. Pi-hole's docs use a separate helper for that. Technitium checks DNSSEC signatures itself out of the box; we switched that off for its load tests, since our test server signs nothing. All three publish images for arm64 as well as x86.

One older AdGuard Home advisory, rated high, waited 112 days for its fix in 2024, by AdGuard's changelog. GitHub's record lists versions up to 0.107.51 as affected, while the CVE's own text says 0.93 to the latest; neither names a fixed version. Our check counts only advisories published in the two years up to each tested release, so it did not count that one.

Verdict

Install: Pi-hole six, AdGuard Home eight, Technitium nine. Resources and real use: ten for all three.

Resilience: ten, eight and eight. Health: eight, seven and eight. Security: eight, six and six.

Pi-hole averages 8.7 out of ten: use it. In our test, Pi-hole suits a home, a small team or a business, and it kept every confirmed local record through our crashes. Put your own password in its Compose file, and switch off the capabilities you do not use.

AdGuard Home averages 8.2, but it lost a confirmed change in our crash test, which holds it at use with care. It suits you if you want encrypted upstream DNS out of the box. Finish its setup wizard right after the first start, and know that a power cut right after a change can undo it.

Technitium averages 8.5, and it lost confirmed changes too; its admin login alone would also hold it at use with care. It suits you if you want a full DNS server with its own recursion and single sign-on. Set its admin password in the Compose file before the first start, and know that a crash or a power cut can undo your latest changes.

So the Pick is Pi-hole, the only one of the three without a cap.

Outro

That's the verdict on Pi-hole, AdGuard Home and Technitium DNS Server. We read the docs. Then we measured.

Sources

Snapshots of 2026-10-21 to 22, pinned to the commit we tested.

How this was checked

174 claims, each checked against its cited source by a verifier that did not write them; every number recomputed from the raw lab data by a second verifier. How we test: the method.

Corrections

None so far. Found a mistake? Tell us.