How Changing DNS Can Defeat Basic Content Filters

A surprising number of parental controls — including some built into routers — do most of their filtering at the DNS level. That makes them easy to set up and equally easy to sidestep.

How DNS filtering works

DNS is the internet's phone book: when a device wants to visit a site, it asks a DNS server for the address. DNS filters work by refusing to answer requests for blocked domains. Simple, fast, effective — as long as the device keeps using the DNS server you chose.

The workaround kids find in minutes

In device Wi-Fi settings, the DNS server can be changed by hand — 8.8.8.8 is the famous one. Once a device uses a different DNS server, your filter never sees the request at all. Newer wrinkle: many browsers now support encrypted DNS (DoH), which quietly routes all lookups through the browser itself, ignoring network DNS entirely.

If your child's device has a custom DNS set, or a browser with DoH enabled, most DNS-based filtering is already dead — it just has not told you.

Why a gateway closes the door

Guardian-CORR handles DNS differently:

• All DNS on the network flows through the gateway. Changing the DNS setting on a device does not change where its lookups actually go.
• Known DoH resolvers are blocked, so browsers cannot tunnel lookups past the network.
• Anything that still tries is flagged. DNS overrides show up as bypass events in your activity feed — evidence, not silence.

See anti-bypass protection for exactly how VPN, proxy, and DNS workarounds are stopped at the network level.

How to check your current setup

On any filtered device, open the Wi-Fi settings and look at the DNS configuration. If it is anything other than what your filter set — or if a browser has "secure DNS" turned on — your filter can be walked around today. Then read how kids bypass parental controls for the full picture.