DNS filtering is the single most impactful thing you can do to protect your family's internet — and it takes less than 10 minutes to set up. Change two numbers on your router, and every device in your house — phones, tablets, laptops, game consoles, smart TVs — gets filtered automatically, with no software to install.
I've tested all the major family DNS services on my own home network (router, PS5, Roku, three kids' devices). Here's what actually works, what doesn't, and which one you should pick.
1. What Is DNS Filtering and Why Does It Matter?
Every time you type a website address or tap a link, your device asks a DNS server to translate that domain name into an IP address. Normally this happens invisibly using your internet provider's DNS. A filtering DNS does the same job, but checks every domain against a blocklist first — if the site is on the list (adult content, malware, gambling, etc.), it blocks the request before any content loads.
Why this matters for parents:
It covers everything. Unlike Screen Time or Family Link which only work on one platform, DNS filtering protects every device on your network — including the PS5 browser, the Roku, and that old iPad you forgot about.
It's invisible. No apps to install, no settings to configure on each device. Block adult content at the router and it just works.
It's free (or very cheap). The best options cost $0-$20/year — a fraction of what subscription parental control apps charge.
It's the foundation. DNS filtering doesn't replace Screen Time or Family Link — it's the safety net underneath them. If a kid finds a way around app-level controls, DNS filtering is still blocking the worst content.
2. Quick Comparison
| Service | Price | Custom Blocklists | Per-Device | Analytics | SafeSearch |
|---|---|---|---|---|---|
| NextDNS | Free (300k queries) $20/yr unlimited |
✓ Extensive | ✓ Yes | ✓ Detailed | ✓ Yes |
| CleanBrowsing | Free Paid from ~$6/mo |
◐ Paid only | ✗ Free tier | ◐ Paid only | ✓ Yes |
| OpenDNS FamilyShield | Free | ✗ No | ✗ No | ✗ No | ✗ No |
| Cloudflare for Families | Free | ✗ No | ✗ No | ✗ No | ✗ No |
3. NextDNS (Our Pick)
Website: nextdns.io
4. CleanBrowsing
Adult Filter: 185.228.168.10 / 185.228.169.11
5. OpenDNS FamilyShield
6. Cloudflare for Families
Malware + Adult: 1.1.1.3 / 1.0.0.3
Too many options? We'll pick for you.
CyberDaddy recommends the right DNS filter for your household and walks you through the setup — for your router, every device, and every bypass prevention step.
Join the Waitlist — Free7. How to Set It Up on Your Router
Configuring DNS at the router level means every device that connects to your WiFi gets filtered automatically. No per-device setup needed.
Log into your router admin panel
Open a browser and go to 192.168.1.1 or 192.168.0.1 (the most common addresses). The admin username and password are usually on a sticker on the bottom of your router. If you've never changed them, try admin/admin or admin/password.
Find the DNS settings
This varies by router brand, but look under: WAN settings, Internet settings, DHCP settings, or Network settings. You're looking for fields labeled "DNS Server 1" and "DNS Server 2" (or Primary/Secondary DNS).
Enter your chosen DNS addresses
Replace the existing DNS addresses with your chosen filter. For example, for CleanBrowsing Family: set DNS 1 to 185.228.168.168 and DNS 2 to 185.228.169.168. Save and apply.
Test it
Connect to your WiFi on any device and try visiting a known adult site. It should be blocked. You can also visit dnsleaktest.com to verify your DNS is pointing to the right service.
8. Preventing Bypass
The biggest weakness of DNS filtering is that tech-savvy kids (or just kids who watch YouTube tutorials) can bypass it. Here are the most common bypass methods and how to block each one.
DNS-over-HTTPS (DoH) in browsers
Modern browsers like Chrome and Firefox can encrypt DNS queries and bypass your router's DNS entirely. Fix: On each child's device, open Chrome → Settings → Privacy → turn OFF "Use secure DNS". In Firefox → Settings → turn OFF "DNS over HTTPS". This forces browsers to use the router's filtered DNS.
VPN apps
VPN apps route all traffic through an encrypted tunnel, completely bypassing DNS filtering. Fix: Block VPN app installations on each device — use Screen Time (iOS), Family Link (Android), or Family Safety (Windows) to prevent VPN apps from being installed. See our guide: How to Block VPN Apps on Your Kid's Phone.
Manually changing DNS on a device
A child could change the DNS settings on their own device to use Google (8.8.8.8) or Cloudflare (1.1.1.1) instead of your filtered DNS. Fix: On iOS, use Supervised Mode or a configuration profile. On Android, Family Link can prevent settings changes. On Windows, restrict the child's account from modifying network settings.
Block alternate DNS at the router level
Some routers (especially those from Asus, Ubiquiti, or pfSense) allow you to create firewall rules that redirect ALL DNS traffic to your filtered DNS, regardless of what individual devices request. This is the nuclear option — it makes bypass nearly impossible on your home network. Check your router's documentation for "DNS redirect" or "force DNS" settings.
Frequently Asked Questions
DNS is the foundation. CyberDaddy is the dashboard.
We guide you through DNS setup AND every other parental control across all your devices — then verify it's all working and alert you when anything changes.
Get Early Access — Free