How DNS-level filtering protects every device, not just one browser
DNS-level filtering blocks harmful and adult websites for every app on a device — not just one browser — by refusing the site’s address lookup before the page can load. Here’s what that means in practice for your family’s PCs.
What is DNS filtering, in plain terms?
Every time any app on a PC opens a website, it first asks a “phone book” service (DNS) to turn the address you typed (like example.com) into the number computers actually use. FamilyProtect routes that lookup through a filtered resolver: when the address belongs to a harmful or adult site, the answer is refused and the page simply never loads.
Because every app on the device relies on DNS (browsers, games, chat apps, even ones you didn’t know were installed), the protection covers all of them at once, before any content is fetched. There’s nothing for you to configure app by app.
Why is that better than a browser filter?
A browser extension or built-in browser control only sees what happens inside that one browser. Open a different browser, or a portable one from a USB stick, and a browser-only filter never even runs.
DNS filtering sits underneath every browser and app, so there’s no “just use a different browser” loophole at the network layer. FamilyProtect pairs this with safe-browser lockdown: browsing is kept to a single filtered browser, and private/incognito windows plus hidden-DNS workarounds are switched off. Filtering and lockdown reinforce each other. One covers the network layer, the other closes the browser-level gaps.
Can you set up free DNS filtering yourself?
Yes. Services like OpenDNS Family Shield or Cloudflare for Families give you filtered DNS IP addresses you can enter on a home router. That can block many harmful sites for every device on your Wi-Fi in a few minutes. For some families, especially younger kids who only use tablets on home Wi-Fi, that’s enough.
What router DNS does well
- One change, whole network. Every phone, tablet, and PC on that Wi-Fi uses the filtered resolver.
- No install on each device. Helpful when you can’t put software on a shared iPad or a guest laptop.
- Free or very cheap. OpenDNS Family Shield has no subscription for basic category blocking.
Where router DNS falls short
- It stops at your front door. A laptop on school Wi-Fi, a phone on mobile data, or a friend’s hotspot isn’t using your router’s filter.
- Kids can route around it on the device. Custom DNS in a browser, a VPN app, or encrypted DNS (DoH) sends lookups somewhere you didn’t configure.
- No tamper resistance. There’s nothing installed on the PC to notice the filter was bypassed or to fix itself.
- No safe-browser lockdown. Router DNS doesn’t stop a second browser or a portable app from a USB stick.
Free DNS is a good starting point. It’s not tamper-resistant on a capable kid’s PC.
Router DNS vs device-level filtering: a quick decision guide
| Situation | Router DNS alone | Device-level (FamilyProtect) |
|---|---|---|
| Young kids, tablets only on home Wi-Fi | Often enough | Optional extra |
| Homework laptop that leaves the house | Weak | Strong |
| Teen who knows what a VPN is | Easy to bypass | Designed to resist |
| You want a dashboard showing “protected / not protected” | No | Yes |
| Second browser or portable apps | No help | Covered |
FamilyProtect installs filtered DNS on each Windows PC, locks the configuration, verifies it continuously, and repairs itself if something breaks. For the full technical walkthrough (four safety checks, self-healing in minutes), read how DNS protection works on Windows.
How kids bypass DNS filters (and how we close the gaps)
Common bypass routes:
- VPN or proxy tunnels traffic away from your DNS server.
- Custom DNS (DoH) lets browsers or apps use encrypted DNS you didn’t configure.
- Mobile hotspot leaves home Wi-Fi and its router filter behind.
- Second browser or portable app means browser-only tools never see the traffic.
FamilyProtect addresses these at the device level: VPN and hidden-DNS paths are switched off, browsing is limited to a filtered browser, and protections run with system privileges a standard child account can’t change.
Does protection follow the device off your Wi-Fi?
With router DNS, no. The filter lives on the router. When the laptop connects elsewhere, it’s on its own.
With device-level DNS filtering, yes. The filtered resolver is configured on the PC itself, so school Wi-Fi, a library network, or a phone hotspot still goes through the same rules (as long as the protection is running and hasn’t been tampered with). That’s the main reason parents with homework laptops choose device-level filtering over router-only setups.
FamilyProtect also verifies continuously that protection is still active: the agent is installed, the service is running, the locked config is in place, and the certificate for block pages is trusted. Your dashboard shows the real state per device, not a green tick from an installer you ran last month.
Does it cover every family PC?
Yes. One subscription covers all of your family’s Windows PCs. Each one filters independently at the network level, so protection doesn’t depend on a single home router or a particular Wi-Fi network. Protecting a new PC is installing the agent and signing in. It starts filtering straight away. macOS and Linux support is coming soon.
What does FamilyProtect collect to do this?
Only what’s needed to enforce the protections you set: device inventory, filtering/policy status, and web/DNS activity on the protected devices. It isn’t hidden surveillance. You choose what’s on, and we’re upfront about exactly what’s collected and why. The full detail is in our Privacy Policy.
Ready to protect every device? Get started.