Parent's Guide to Protecting Kids Online with DNS Filtering

Step 1: Set Up DNS Filtering

The first step is getting DNS filtering running on your home network. CleanBrowsing offers both free and paid options — either one protects your family. The best starting point for most families is to configure DNS on your home router, which protects every device on your Wi-Fi automatically — phones, tablets, laptops, gaming consoles, and smart TVs.

Free vs Paid — Which Should You Choose?

Our free filters are a great starting point and work immediately with no account needed. Paid plans give you a dashboard with 26+ content categories you can toggle individually (gaming, social media, streaming, etc.), activity reporting, custom allow/block lists, and per-device profiles. See Free vs Paid Plans for a full comparison.

Free Filter DNS IPs

Paid accounts get custom DNS IPs assigned in your dashboard under Settings → Network.

Important: Router DNS Is Your Foundation, Not the Whole Solution

Configuring your router protects every device on your home Wi-Fi — but it can be bypassed. Modern browsers have built-in settings (like Secure DNS) that ignore your router's DNS, phones on cellular data bypass your router entirely, and anyone with access to a device can change its DNS settings. Router DNS is the safety net — Step 3 covers how to lock down individual devices so filtering can't be undone.

Detailed Instructions

• Setup Guide — Step-by-step instructions for every platform: routers, Windows, Mac, iOS, Android, Linux, and more.
• Set Up Free DNS Filters — Full walkthrough for router, Windows, Mac, and mobile.
• Set Up a Paid Account — Dashboard setup, custom DNS IPs, and category configuration.
• Router vs Device Setup — Should you configure DNS on your router or on each device? (Router is usually better for families.)
• Router Won't Allow DNS Changes? — Workarounds if your ISP router locks DNS settings.
• Services That Conflict with DNS Filtering — Comcast xFi, Avast, and other services that can override your DNS settings.

Step 2: Enforce SafeSearch on Search Engines

DNS filtering blocks adult websites, but search engines can still show explicit images and text in search results. SafeSearch enforcement filters these results at the search engine level.

What to Do

CleanBrowsing's Family Filter automatically enforces SafeSearch on Google, Bing, and YouTube. If you're using the Family Filter, this step is already done. If you want to enforce SafeSearch even without CleanBrowsing (or want to understand how it works), see:

• What is SafeSearch? — How SafeSearch works across Google, Bing, and YouTube.
• How to Enforce SafeSearch — Manual setup using DNS VIPs and hosts files (for advanced users).

Step 3: Lock Down Individual Devices

This is the most important step. Router-level DNS filtering protects your home Wi-Fi, but it can be bypassed — browsers have built-in settings that ignore router DNS, phones on cellular data bypass your router entirely, and anyone with device access can change DNS settings back. The solution is locking DNS filtering at the device level so it can't be undone without a password.

Windows — Desktop App

The CleanBrowsing Windows App enforces DNS filtering at the system level and locks it with a password. Your kids can't change DNS settings, disable the app, or uninstall it without the password. It works on all browsers and prevents Secure DNS bypass automatically.

• Windows App Features & Overview
• Create a Standard User Account — Pair with the app: give kids a non-admin account so they can't install VPNs or change system settings.

Android — Mobile App

The CleanBrowsing Android App locks DNS filtering on the device with encrypted settings. It works across Wi-Fi, cellular data, and network roaming — so filtering stays active when your child leaves the house. Settings are password-protected and can't be changed or uninstalled without authorization.

• Android App Features & Overview
• Android Private DNS (Manual) — If you prefer manual setup: Settings → Network → Private DNS → enter family-filter-dns.cleanbrowsing.org. Works on Wi-Fi and cellular but can be changed by the user.

iPhone & iPad — Apple DNS Profiles

Install a CleanBrowsing DNS profile on iOS/macOS devices. The profile enforces encrypted DNS (DoH) and can be locked so it requires a passcode to remove. It works on Wi-Fi and cellular, and includes built-in captive portal handling so public Wi-Fi login pages still work.

• Apple DNS Profile Generator — Generate and install a profile for your filter type (free or paid).
• Child-Proofing iPhone & iPad — Full guide: Screen Time, content restrictions, remove admin access, and lock DNS settings.
• Lock Mobile DNS Settings — Prevent profile removal on iOS.

Chromebooks & Other Devices

• Chromebooks: Configure DNS in Chrome OS network settings. If managed through Google Admin, set DNS policy there.
• Gaming Consoles — Nintendo Switch, Xbox, PlayStation DNS configuration.

Why This Matters

Without device-level lockdown, anyone can undo your filtering by changing a single setting. The apps and profiles above make DNS filtering persistent — it stays active across networks, survives reboots, and requires a password to modify. Think of it this way: your router is the safety net for your home Wi-Fi, and the apps are what make it stick on each device.

Step 4: Prevent Your Kids from Bypassing Filters

Kids are resourceful. They share bypass methods at school and find tutorials on YouTube. Here's how to stay ahead:

Common Bypass Methods and How to Block Them

• How Kids Bypass Filters — The most common methods kids use: VPNs, changing DNS, using mobile data, cached pages, and alternative browsers.
• Disable Browser DoH — Chrome, Firefox, and Edge have built-in DNS-over-HTTPS that can bypass your router's DNS settings. Disable it on each browser.
• Lock DNS Settings — Use firewall rules to force all DNS traffic through CleanBrowsing, even if someone changes their device's DNS.
• Lock Mobile DNS Settings — Prevent users from removing DNS profiles or changing DNS settings on phones and tablets.
• Understand VPNs — VPNs tunnel traffic past DNS filters. Know what to look for and how to block them.
• Complete Bypass Prevention Guide — The full technical breakdown: blocking VPNs, DoH, DoT, and forced DNS redirection.

Step 5: Verify Everything Works

After setting everything up, test that filtering is active on every device your kids use.

What to Do

• Run the DNS Leak Test — Our leak test shows your IP, DNS resolvers, and device type in one step. Click "Share Results with Support" if you need help troubleshooting.
• Verify DNS Configuration — Command-line checks and additional verification methods.
• Functional test: Try visiting a site that should be blocked. If using the Family filter, adult sites should show a DNS_PROBE_FINISHED_NXDOMAIN error.
• Test each device separately: The most common issue is filtering works on the desktop but not on phones. Run the leak test from each device — on Wi-Fi and on cellular data. Check every browser installed on the device.

Step 6: When to Upgrade to a Paid Plan

The free Family Filter is excellent for most families. Consider upgrading to a paid plan if you need:

• Custom category blocking: Block gaming, social media, or streaming sites while keeping everything else accessible.
• Per-device control: Different filtering rules for different family members.
• Activity reporting: See what domains are being queried on your network.
• Custom allow/block lists: Override filtering for specific sites (e.g., allow a specific game site that's blocked by category).

• Free vs Paid Plans — Detailed comparison of what you get with each plan.
• All 26+ Content Filters — See every category you can block with a paid plan.
• Set Up a Paid Account — Step-by-step paid plan configuration.