DNS filtering and its limits

A DNS filter blocks lookups for known adult or harmful domains [source: www-rfc7754-filtering]. The block happens at the name-resolution step, before the browser opens a connection.

DNS filtering is popular with parents. It is sold as a router-side switch that needs almost no setup. It is also the layer at which the gap between expectation and reality is largest [source: saferinternet-technischer-kinderschutz].

This page explains what a DNS filter can see, what it cannot, and why modern devices make that gap larger every year [source: rfc9490-mten].

Definition

A DNS filter is a resolver that returns a special answer for blocked domain names instead of an address [source: www-rfc7754-filtering].

Common names in the family market are Cloudflare for Families, OpenDNS, AdGuard Family, and NextDNS [source: www-rfc7754-filtering].

The block answer is either a redirect to a block page, or an unreachable address [source: www-rfc7754-filtering].

Scope

This page covers DNS-based blocking as a layer of family protection. It does not cover content classification, age verification, or account-level controls [source: www-rfc7754-filtering].

It does not cover paid security products that combine DNS filtering with other layers. Those belong on the device or the account [source: saferinternet-technischer-kinderschutz].

It does not cover ISP-level content filters such as BT Parental Controls or EE Content Lock; those work on the carrier path, not on the DNS layer.

Why this matters

A DNS resolver translates names like example.com into addresses. A filtering resolver returns a special answer for blocked names, one that points the device to a block page or to nowhere [source: www-rfc7754-filtering].

Three things must all be true for the block to work:

• The device is asking the filtering resolver.
• The query is in cleartext DNS, or the resolver can still classify it.
• The device honours the answer.

Modern devices make all three conditions less likely over time. The IETF workshop report on encrypted networks names the parental- control case as an example of this drift [source: rfc9490-mten].

What a DNS filter does

In its simplest form, a family DNS resolver holds a list of blocked names [source: www-rfc7754-filtering]. For each lookup, it answers with an unreachable address or a redirect to a block page.

The block covers the device, the apps on it, and the browser. It runs on every network the device uses, as long as the resolver is still being asked [source: www-rfc7754-filtering].

A family resolver is configured in one of three places:

• On the router, for every device that joins the home Wi-Fi.
• On the device, for its own DNS setting on the Wi-Fi it joins.
• On the operating system, as a system-wide resolver [source: google-android-android-private-dns].

The first covers the home network. The second covers one device on one network. The third follows the device onto any network it uses [source: google-android-android-private-dns].

What breaks the filter

Three patterns break a DNS-only filter, and none of them needs the child to hack anything.

Encrypted DNS

RFC 8484 defines DNS Queries over HTTPS, also called DoH [source: www-rfc8484-doh]. DoH moves DNS into the same HTTPS stream the rest of the browser already uses.

Once a browser or app uses DoH, the domain name is no longer sent in the clear to the home resolver. The router sees only the encrypted stream to the DoH endpoint [source: rfc9490-mten].

A browser setting of “use secure DNS” is on by default in several current browsers. The setting can be flipped by the child or by an app on the device [source: www-rfc8484-doh].

Alternate resolver

RFC 9490 states the parental-control case directly: a DNS filter becomes ineffective when the device routes DNS to a different resolver [source: rfc9490-mten].

Android exposes this as the Private DNS setting, which lets the device use any DoT or DoH endpoint as the system resolver [source: google-android-android-private-dns].

The setting is one tap from the main network settings. The change does not require developer tools or root access [source: google-android-android-private-dns].

Application-level DNS

Browsers and some apps can run their own resolver, separate from the system one [source: www-rfc8484-doh]. A browser-level DoH setting survives a system DNS reset. A small number of apps ship their own resolver.

The family DNS resolver is not asked. The router cannot redirect the request to a block page [source: rfc9490-mten].

What a router can and cannot do

A home router can require every device on the home Wi-Fi to use the family resolver. That is a router-level enforcement of DNS, and it is the strongest form of DNS filtering the router can offer [source: www-rfc7754-filtering].

The same router cannot enforce DNS for any of the following:

• A device on a cellular data connection.
• A device on a foreign Wi-Fi or a hotspot.
• An app or browser that uses its own resolver.
• Traffic inside a VPN tunnel.
• DNS queries that go out over DoH to an endpoint the router does not block [source: rfc9490-mten].

RFC 9076 documents the underlying reason: a network context is a resolver context, and the home network is one of several [source: www-rfc9076-dns-privacy].

What the family DNS resolver can do

The family resolver is a useful layer for the home network. It is not a useful layer for everywhere else.

Two behaviours are documented and worth keeping:

• Block categories that the family has agreed on.
• Force SafeSearch on Google, where the family resolver still receives the query [source: www-rfc7754-filtering].

Two behaviours are documented as fragile:

• Subdomain classification. A block on example.com does not always cover cdn.example.com or a.b.c.example.com.
• New domain names. A new adult site appears faster than any commercial blocklist updates [source: www-rfc7754-filtering].

A DNS filter is also not a content classifier. It returns the same block answer whether the site is adult content, a phishing page, or a misclassified news article.

What the device does that the filter cannot see

Once the device uses a different resolver, or once the DNS request is encrypted, the router no longer sees the domain name. The router sees the IP address of the resolver endpoint [source: rfc9490-mten].

For a typical DoH endpoint, that IP belongs to a large content delivery network. Blocking the IP would break more than the filter wants to block [source: www-rfc7754-filtering].

The honest limit: the router can see that the device is using DoH, and it can see the IP it is going to. It cannot see what is being asked, and it cannot redirect the request to a block page.

What belongs on the device instead

DNS filtering that travels with the child belongs on the device:

• On Android, the system Private DNS setting, configured and locked by the supervised account [source: google-android-android-private-dns].
• On iOS and iPadOS, the system DNS setting, locked through configuration profiles or through the family-managed account.
• In the browser, the secure DNS option, locked through group policy where the browser supports it [source: www-rfc8484-doh].

A DNS-only family plan is not enough. A family plan with no DNS at all is not enough either. Both belong on the same list as the device-side controls [source: saferinternet-technischer-kinderschutz].

How to notice it stopped working

A DNS filter that has stopped working does not announce itself. The page the parent thought was blocked simply loads.

Three signals mean the family resolver is no longer being asked:

• The router’s DNS log shows traffic to an unfamiliar resolver.
• The blocked domain resolves through a tool that asks the configured resolver, but the page loads on the device.
• A DNS-over-HTTPS endpoint appears in the device’s network activity [source: rfc9490-mten].

To distinguish these from a configuration mistake:

• Test from a known device on the home Wi-Fi, with mobile data off. If the block holds here, the family resolver is working on this network.
• Test with mobile data on. If the page loads, the gap is the cellular path, not the DNS filter.
• Test with a DoH endpoint configured on the device. If the page loads through DoH, the family resolver is no longer being asked [source: www-rfc8484-doh].

Talking about it

A DNS filter the child does not understand looks like a hidden hand. A DNS filter the family cannot explain becomes a contradiction.

State the rule in plain language. “This rule is the family DNS resolver. It covers this network. It does not cover your mobile data, your friend’s Wi-Fi, or a VPN app on your phone.”

State what the rule is not. “It is not a content classifier for every site. It is not a guarantee that nothing upsetting will appear. It is one layer.”

Invite the report. A child who can say “the school research page is blocked by mistake” is a child who will also say “something worse than the filter caught me”. Both reports are useful.

Re-check the family resolver once a year. New devices join the network. New apps ship their own resolver. The filter drifts the same way every other setting drifts [source: www-rfc7754-filtering].

Related wiki pages

The next-but-one page in this package, Why router rules miss the phone, covers the network boundaries a router cannot cross.

The limits page, What the network layer cannot do, lists the gaps the router and the DNS resolver leave open, even together.

Sources

• rfc9490-mten — IETF, RFC 9490, IAB M-TEN workshop. Primary source for the parental-control and alternate-resolver example [source: rfc9490-mten].
• www-rfc8484-doh — IETF, RFC 8484. Definition of DoH.
• www-rfc9076-dns-privacy — IETF, RFC 9076. Network contexts and DNS privacy [source: www-rfc9076-dns-privacy].
• www-rfc7754-filtering — IETF, RFC 7754. Scope and efficacy of blocking [source: www-rfc7754-filtering].
• google-android-android-private-dns — Google Android Help, Private DNS. First-party Android documentation [source: google-android-android-private-dns].
• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre. Documented layered-defense guidance [source: saferinternet-technischer-kinderschutz].

[source: rfc9490-mten] [source: www-rfc8484-doh] [source: www-rfc9076-dns-privacy] [source: www-rfc7754-filtering] [source: google-android-android-private-dns] [source: saferinternet-technischer-kinderschutz]