How DNS Protection works on Windows: a look under the hood

When you switch on DNS Protection, FamilyProtect installs enterprise-grade Cloudflare filtering on each of your family’s Windows PCs, locks it so it can’t be switched off, verifies four separate safety checks around the clock, and automatically repairs itself within minutes if anything breaks. This is the source-of-truth guide to exactly what happens under the hood, with no hand-waving.

What happens the moment I toggle it on?

One switch in your dashboard, and the protection rolls out to every enrolled Windows PC in your family. No visits to each machine, no sign-ins on the device, nothing for a child to click through. Behind the scenes, FamilyProtect deploys Cloudflare WARP, the same protection layer used by businesses worldwide, onto each PC and enrolls it into filtering automatically. Devices you add later are covered the moment they join.

How does the filtering actually work?

Every app on a PC starts a connection the same way: a DNS lookup that turns a name like example.com into an address. Browsers, games, and chat apps all do it. DNS Protection routes those lookups through Cloudflare Gateway, a filtered resolver running on one of the world’s largest networks. When a lookup matches a harmful or adult category, the answer is refused and the page never loads. The content is stopped before a single byte of it reaches the device.

Two properties fall out of this design:

• It covers every app, not one browser. Anything that uses the internet uses DNS, so there is no “just open a different browser” loophole. (More on that in how DNS-level filtering protects every device.)
• It travels with the device. Filtering happens on the PC itself, not on your router, so a laptop is just as protected on school Wi-Fi or a phone hotspot as it is at home.

FamilyProtect runs this in DNS-only mode by design: lookups are filtered, but your family’s actual browsing traffic isn’t tunnelled or inspected. It’s protection, not surveillance.

Can my child just turn it off?

No. This is where DNS Protection differs from an app your child can uninstall. The filtering is deployed with a locked configuration: the on/off switch inside the Cloudflare app is disabled, the protection connects automatically, and the settings file that enforces all of this is written to a system location that requires administrator rights to touch. A standard (non-admin) family account can see the protection running but cannot switch it off, change its settings, or uninstall it.

And if something does break it, the next layer catches that. Read on.

How do I know it’s actually working?

This is the part most parental-control tools skip. FamilyProtect doesn’t assume a device is protected because an installer once ran. It continuously verifies four independent conditions on every Windows PC:

1. The Cloudflare WARP protection software is installed.
2. Its background service is running right now.
3. The locked configuration that forces filtered DNS is in place.
4. The security certificate that lets “this site is blocked” pages display cleanly (instead of a scary browser error) is trusted.

Only when all four pass does your dashboard show the device as protected. If even one fails, say the service was stopped, the device shows as not protected. You see the true state per device, not a hopeful green tick.

What happens if something breaks?

It heals itself. When any of the four checks fails on a device, FamilyProtect automatically re-runs the full deployment on that PC: it repairs the configuration, restarts the service, and reinstalls anything that’s missing. The whole sequence is safe to run repeatedly, so a healthy device is never disturbed and a broken one is simply put back together. In our live testing, a deliberately broken device went from not protected back to protected in about four minutes, without anyone touching it.

That verify-detect-repair loop runs for as long as the toggle is on. Turn the toggle off, and the protection is removed just as cleanly.

What does FamilyProtect see?

Only what’s needed to enforce the protection: which devices are enrolled, whether each one passes the four checks, and DNS lookup activity on protected devices. DNS-only mode means the content of your family’s browsing is never tunnelled through us or inspected. You choose what’s on, and the full detail of what’s collected and why is in our Privacy Policy.

Which devices does it cover?

DNS Protection is live today for Windows PCs, and one subscription covers all of them (see pricing). macOS and Linux support is built on the same foundation and coming soon.

Ready to see it on your own dashboard? Get started and protection reaches your first PC in minutes.