How to Verify Your CleanBrowsing DNS Configuration

Step 1: Browser-Based Verification

The quickest way to check if CleanBrowsing is active is to use a browser-based DNS leak test. These tools show you which DNS resolver is answering your queries.

How to Test

Visit one of the following DNS leak test sites in your browser:

• dnsleaktest.com: Click "Standard test" and check the results.
• browserleaks.com/dns: Shows your active DNS resolvers.
• ipleak.net: Displays DNS server information alongside your IP address.

What to Look For

If CleanBrowsing is configured correctly, the DNS leak test should show IP addresses in the 185.228.168.x or 185.228.169.x range. These are CleanBrowsing's resolver IPs.

If you see your ISP's DNS servers instead (e.g., Comcast, AT&T, Verizon DNS addresses), then CleanBrowsing is not active on the device or network you are testing from. This means your DNS configuration needs to be corrected.

Step 2: Command-Line Verification

For more detailed verification, use command-line DNS tools. CleanBrowsing provides special debug domains that return information about your filter configuration.

Windows: Using nslookup

Open Command Prompt and run:

This should return a TXT record with your CleanBrowsing filter information, including which filter is active and your account details (for paid plans).

For more detailed location and account information, run:

Mac / Linux: Using dig

On Mac or Linux, use the dig command instead:

The response should include TXT records confirming your CleanBrowsing filter status. If you get no response or an error, CleanBrowsing DNS is not being used on this device.

Quick Functional Test

You can also verify filtering is working by attempting to resolve a domain that should be blocked. For example, if you are on the Family filter:

If CleanBrowsing is active and the Family filter is configured, this should return an NXDOMAIN or a block page IP instead of the real IP address.

Step 3: Troubleshooting Common Issues

If your verification tests show that CleanBrowsing is not active, work through these common causes:

1. DNS Settings Not Applied Correctly

Double-check that DNS is configured correctly on your device or router. The CleanBrowsing DNS IPs should be set as your primary and secondary DNS servers. Common free filter IPs are:

2. Flush Your DNS Cache

After changing DNS settings, your device may still use cached responses from the old DNS server. Flush the cache:

3. VPN or Encrypted DNS Overriding Settings

A VPN, DNS-over-HTTPS (DoH), or DNS-over-TLS (DoT) setting may be overriding your DNS configuration. Check for:

• Active VPN: Disable any VPN and retest. VPNs typically use their own DNS resolvers.
• Browser DoH: Chrome, Firefox, and Edge may have Secure DNS enabled, which bypasses your network DNS. Check browser settings and disable Secure DNS or set it to use CleanBrowsing's DoH endpoint.
• OS-level DoH: Windows 11 and newer macOS versions support system-wide encrypted DNS that may override network settings.

4. Conflicting Software

Some software may interfere with DNS settings:

• Avast / AVG: Avast's "Real Site" protection intercepts DNS. Disable it or configure it to use CleanBrowsing.
• Comcast xFi: Comcast's xFi Advanced Security may override DNS settings on Xfinity routers. Disable xFi Advanced Security in the Xfinity app.
• Apple Screen Time: On iOS devices, Screen Time can conflict with DNS profiles. See our Apple Screen Time guide.
• Antivirus software: Some antivirus programs have DNS protection features that redirect DNS queries.

For additional help, see: Common Questions and Troubleshooting