Alternate DNS resolver
How common it is: child-specific prevalence not established. The bypass condition itself is explicitly documented in RFC 9490 for parental-control networks.
Detection
The family DNS resolver stops receiving queries from a device while the device still reaches Internet destinations. Network telemetry may instead show traffic to a different resolver.
Fix (technical)
Do not rely on DNS filtering as the only enforcement layer. On managed endpoints, configure and lock the intended resolver where the platform permits this. At the network layer, unauthorized resolver …
Fix (relational)
If the child is deliberately changing resolver behavior, ask which sites are being blocked incorrectly as well as which restrictions are being challenged. False positives are a common reason users see…
Residual risk
DoH, DoT, VPNs and networks outside the home can move DNS outside the expected resolver path.
Sources
-
rfc9490-mten
-
rfc8484-doh
-
android-private-dns