DNS filtering, explained. Without the jargon.
Every parental control product uses one of a few underlying methods, and they behave very differently. Understanding which is which tells you more than any feature list.
What DNS actually is
DNS is the internet's address book. When a device requests example.com, it asks a DNS resolver for the numeric address, then connects to that address.
DNS filtering intercepts that lookup. If the domain is on a blocklist, the resolver returns nothing and the site doesn't load.
The key property: this happens before any connection is made, at the operating system level. So it doesn't matter which browser asked, whether the tab was private, or whether the request came from an app rather than a browser.
The three main approaches
1. DNS filtering
How: Blocks domain lookups against a list.
Strengths: Covers every browser and app; negligible performance cost; no content inspection; works on cellular when applied on-device; survives private browsing.
Limits: Domain-level only — can't block one page on an allowed site. Depends on blocklist quality. Doesn't see inside apps, so it can't block a specific video inside YouTube.
2. Content inspection / filtering proxies
How: Analyses page content in real time and decides per page.
Strengths: Page-level granularity; can catch uncategorised new sites.
Limits: Requires visibility into what your child reads; heavier on battery and performance; struggles with encrypted traffic without more invasive access.
3. Monitoring and reporting apps
How: Records activity — sites, searches, messages, sometimes screenshots — and reports to a parent dashboard.
Strengths: Maximum visibility. Can surface a specific safeguarding concern that filtering would miss entirely.
Limits: Creates a permanent record of a child's private life held by a company; teenagers who discover it route around it; and monitoring on its own blocks nothing.
Filtering, not monitoring
Defenras uses DNS filtering — it blocks harmful domains and never builds a record of the ones it allows.
Get Defenras free →Where the filtering runs matters as much as how
| Location | Covers | Doesn't cover |
|---|---|---|
| Router | Every device on home Wi-Fi, including consoles and TVs | Cellular, other networks, manual DNS changes, VPNs |
| On device (system DNS) | Every network the device joins, every browser and app | Consoles and TVs; other people's devices |
| Browser extension | That browser only | Other browsers, apps, in-app browsers |
This table explains most parental control failures. A browser extension is bypassed by installing another browser. A router filter is bypassed by turning off Wi-Fi. On-device system-level filtering is the hardest to get around, which is why it's what we build.
What DNS filtering can't do
Stated plainly, because vendors in this space routinely overclaim:
- It can't block one video inside an app. If YouTube is allowed, the whole of YouTube is allowed.
- It can't read messages. By design — but it means it won't catch a grooming conversation on an allowed platform.
- It can't block content on a site you've allowed. Domain level only.
- It doesn't stop a determined technical teenager. Nothing does, indefinitely.
- It can't cover a friend's phone.
Filtering handles accidental exposure, casual curiosity, and the large volume of harmful content that arrives without being sought. That's most of what actually happens to most children — and it's a real, worthwhile job, not the whole job.
Matching approach to age
| Age | What fits |
|---|---|
| Under 6 | Allowlist filtering — only approved sites and apps |
| 6–10 | Category filtering plus time limits; router filtering works well |
| 11–13 | On-device filtering, app blocking, agreed schedules |
| 14–17 | Lighter filtering on the genuinely harmful categories, minimal monitoring, more conversation |
Filtering and monitoring are different products solving different problems, and they're frequently sold as the same thing.
Filtering says: this category of content doesn't reach my child. Monitoring says: I see what my child does. The first scales as they get older and costs you nothing in trust. The second stops working the moment they find out, and they always find out.
Frequently asked questions
Does DNS filtering slow down the internet?
No. It changes which server answers a lookup — a few milliseconds. There's no traffic routed through anything and no inspection.
Can DNS filtering block YouTube videos individually?
No. It's domain level, so it's all of YouTube or none. Blocking specific videos requires app-level control that no DNS filter provides.
Is DNS filtering the same as a VPN?
No. A VPN routes all traffic through another server, usually to bypass restrictions. DNS filtering only affects address lookups and adds restrictions.
What happens if the DNS filter goes down?
Well-built filtering fails open — the site loads unfiltered rather than the internet breaking. Worth asking any vendor how theirs behaves.
Defenras blocks all of this — without collecting your child's data.
One app, every device, every browser. Adult content, gambling, vaping, scams, malware, social media — all blocked. PIN-locked. Free version available, no credit card.