Why this matters:How to recognise this workaround on your side, and what closes it on your side — without telling you how to do the workaround.
How common it is: DoH itself is standardised. Child-specific prevalence of switching browser-level DoH settings not established.
Detection
The device’s system DNS is set to the family resolver, yet a browser-level secure-DNS setting is on and points elsewhere; the browser reaches blocked destinations while the router sees only an HTTPS stream to the browser’s DoH endpoint.
Fix (technical)
On managed devices, lock the browser’s secure-DNS setting through enterprise policy or supervised configuration where the browser supports it. Do not assume that configuring the system resolver covers every browser on the device; verify each browser’s setting individually.
Fix (relational)
A child who enables browser-managed DoH is exercising a privacy default that several browsers ship with. Treat the choice as a sign that the family DNS rule needs to be explained, not just enforced.
Residual risk
Browsers that ship without a managed setting, or browsers updated after the lock, may restore a default. The lock is per-browser, not per-device.
Sources
-
www-rfc8484-doh
-
rfc9490-mten
Why trust this page?
Belief-disclosure in plain language. Everything the page claims is sourced; instructions are tested against the software version stated above; nothing is bought or affiliate-linked.
- Standing of evidence
- Primary (first-hand or regulatory source)
- Last verified
- 2026-08-20
Sources used on this page, in the order they appear:
- No external sources were cited.