My network-wide DNS blocker stops most ads but video ads still get through — is complete blocking even possible?

It is not achievable with DNS filtering, and the reason is structural rather than a matter of finding a better list.

DNS filtering blocks by hostname. When a page asks for ads.example.com, your resolver answers with nothing and the request never happens. That works because the ads live on a different hostname from the content.

On the large video platforms they do not. The advertisement is served from the same hostname and the same infrastructure as the video itself, stitched into the same stream. There is no name to block that does not also block the thing you came for.

So the list can never exist. Any list that appears to work is either blocking the whole service, or is briefly catching a hostname that will be consolidated within weeks. That is exactly the pattern you observed, and it is the tell.

The general rule worth taking away: DNS filtering can only separate things that are separately named. Where a provider serves everything from one name, it has no purchase at all.

What DNS filtering is genuinely good at, so it does not get written off:

• Third-party trackers and analytics, which are on distinct hostnames by design because they belong to other companies.
• Ads on ordinary websites, same reason.
• Telemetry from devices that have no settings — televisions, appliances, anything that phones home and gives you no switch.
• Covering every device on the network, including ones that cannot run an extension. This is its real advantage over anything in a browser.

What it cannot do, in general: anything served from the same name as the content, anything inside an app that uses its own resolver, and anything over encrypted DNS that bypasses yours entirely — which is increasingly the default in browsers and on phones, and is worth knowing about because it makes filtering look broken when it is simply not being consulted.

If the goal is the video ads specifically rather than filtering in general, the tools that do work operate at a different layer, and it is worth being clear about the trade of each.

In-browser content blockers see the page after it loads and can act on elements and requests, not just names. That is why they manage what DNS cannot — different layer, much more information.

Alternative clients and front ends avoid the delivery path entirely.

Paying for the ad-free tier is the option people skip in these threads and it is a legitimate answer, particularly given the creators on those platforms are funded by exactly the thing being blocked.

I run DNS filtering and a browser blocker, because they cover different things. Expecting either to do the other's job is where the frustration comes from.