How to Restrict DNS Changes on a Chromebook

If you’re looking to prevent users from changing DNS settings on a Chromebook, this guide will walk you through methods for both managed and unmanaged devices. Whether you’re an IT admin or a concerned parent, these steps will help you enforce DNS settings effectively.

---

1. For Managed Chromebooks (Using Google Workspace Admin)

If the Chromebook is enrolled in a Google Workspace account, administrators can restrict network changes and enforce DNS policies.

Steps:

1. Log in to Google Admin Console:
   • Visit admin.google.com and log in with your admin credentials.
2. Navigate to Chrome Management:
   • Go to Devices > Chrome > Settings > Users & Browsers.
3. Restrict Network Settings:
   • Scroll to Network settings and disable the Allow user to configure network option. This prevents users from modifying DNS settings.
4. Set Enforced DNS Servers:
   • Configure specific DNS settings under Wi-Fi configurations for the organizational unit (OU).
   • Enforced DNS applies across all devices/users in that OU.
5. Save and Apply Changes:
   • Policies automatically sync to enrolled Chromebooks.

---

2. For Unmanaged Chromebooks (Personal Devices)

Without management tools, direct control over local DNS settings isn’t possible. However, you can enforce DNS restrictions indirectly:

Method 1: Configure Router-Level DNS

1. Log in to Your Router:
   • Access your router’s admin panel (usually at 192.168.1.1 or 192.168.0.1).
2. Set Default DNS Servers:
   • Configure your preferred DNS (e.g., CleanBrowsing).
   • Some routers allow you to redirect all DNS queries to specific servers.
3. Block Unauthorized DNS Traffic:
   • Create firewall rules to block traffic on DNS ports (53 and 853) except for your chosen DNS servers.

Method 2: Force DNS-over-HTTPS (DoH)

If the Chromebook user is tech-savvy, configure your network to allow only DNS-over-HTTPS traffic through approved providers like Google or Cloudflare.

---

3. Using Extensions or Apps

For less technical users, browser extensions or parental control apps can help limit DNS changes. However, these solutions are less secure and can be bypassed by advanced users.

---

Restricting DNS changes on a Chromebook is straightforward for managed devices using Google Workspace policies. For unmanaged Chromebooks, enforcing DNS rules via a router or firewall is the most reliable method. For strict control, enrolling the device in a managed environment is the best long-term solution.