I replaced my DNS resolver and the smart home finally shut up
Almost 100 internet connected devices. Every last one trying to phone home to some tracking domain. The fix wasn't buying better gadgets, it was deciding who on my network gets to talk to the outside world.
The shouting match that started it
I'd been running a DNS blocker for a while and it was good enough. Then I added more smart home gear and noticed something: my router's query log was basically one long argument between my own devices and a bunch of ad and telemetry domains. The lightbulb wanted to check in. The vacuum wanted to check in. The thermostat wanted to check in. Sometimes the same domain, dozens of times.
None of that traffic needs to happen. A lightbulb does not need to know what's trending. When you look at your own network and the loudest voice is your toaster, it's time to reassign the phone book.
Why I swapped rather than tuned
The classic tool is Pi-hole, and it's fine. But I wanted a few things it made awkward: per-device allow and block rules without fighting the API, easier lists, and a cleaner local hostname story. So I moved the DNS role over to AdGuard Home running in a container on the rack.
Setup took about ten minutes. Point the router's DHCP at it, watch the client list, start blocking by category. The difference felt immediate.
The isolation map that actually stuck
Blocking domains only gets you so far. The real win was VLANs: separating the smart home gear from the stuff I actually trust. Now the IoT devices sit on their own little network with a strict rule set, and DNS on that segment points straight at AdGuard Home with the heaviest blocking filters enabled. They can talk to each other just enough to be useful and basically nothing else.
The huge learning from the whole exercise: you don't make the untrusted devices behave, you stop letting them vote. Once the smart home was quarantined behind its own rules, the shouty telemetry from the router's log dropped off almost completely. The network got quiet, and quiet is a feature.
What it costs
Worth being honest about downsides. Occasionally a legitimate device gets overzealously blocked and stops working until you whitelist it. A couple of apps that embed their own ad SDKs behave strangely. And if your router hands out DNS settings the hard way, you'll be editing config by hand. But the maintenance is maybe ten minutes a month, most of it just occasionally checking the query log because watching dodgy domains get silently dropped is weirdly satisfying.
Bottom line
You don't need to throw away your smart home or run a corporate firewall to take control back. One DNS resolver, a couple of VLANs, and a rule set that assumes every IoT gadget is guilty until proven otherwise. My lightbulbs still work. They're just not allowed to call home for a status update every five seconds anymore.