Why DNS, not another app
Parental-control apps have to be installed and kept installed on each device, and the console, the TV and the friend's old tablet never get one. Filtering at the resolver covers whatever connects to your Wi-Fi, and with encrypted per-device endpoints it follows the phone onto mobile data too. It is also visible: the query log shows what was blocked and when, which turns "the internet is broken" into a two-minute conversation.
The controls you have
| Control | What it does | Typical use |
|---|---|---|
| Categories | Adult Content, Gambling, Piracy, Fake News, Social Media, plus Ads & Tracking and Threats & Malware. One switch each per profile. | Adult and Gambling on for everyone, Social Media on for the under-13 devices. |
| Blocked services | Named apps and sites, grouped: social networks, streaming, messaging, gaming, shopping, AI assistants. Block one, or a whole group with one switch. | TikTok and Snapchat off; "All social networks" off on a school night. |
| Schedules | Apply categories or services only during set hours and days. | Gaming and streaming blocked 21:00 to 07:00 and during school hours. |
| Safe search and YouTube restricted mode | Forces Google, Bing and DuckDuckGo safe search and YouTube's restricted mode at the DNS level, so it cannot be turned off in the browser. | On for every child device. |
| Devices | Each child's phone or tablet gets its own encrypted endpoint and can override the household categories and services. | Stricter rules for the 9-year-old than the 15-year-old, one household profile. |
| Custom blocklist and allowlist | Your own domains, exact or including subdomains. | Block that one game site; allow the school portal a category catches by mistake. |
| Pause | Turn blocking off for a few minutes; it comes back on by itself. | The homework site is blocked and the assignment is due in an hour. |
| Query log | Every allowed and blocked lookup, by device, with time. | Seeing what the tablet does at 2 a.m. |
A layout that works
- Create a household profile with the rules everyone gets: Ads & Tracking, Threats & Malware, Adult Content, Gambling. Point the router at dnsdome so the TV, console and guests are covered. Router guide.
- Add each child's phone and tablet as a device on that profile. Each gets its own hostname.
- On each child device, set the hostname as Android Private DNS or install the iOS profile. Android, iPhone. Now the device is filtered on mobile data and at friends' houses too, and shows under its own name in the log.
- Set per-device overrides: Social Media and gaming blocked for the younger one, inherited for the older one. Turn safe search on.
- Add a schedule for streaming and gaming services on school nights.
Stopping bypasses
A motivated teenager will try. The ranking of what works:
- Lock the DNS setting on the device. Android: a screen-pinning or Family Link restriction on Settings. iOS: a configuration profile installed with supervision, or Screen Time's passcode on Settings changes. Without this, Private DNS can be switched back to automatic in two taps.
- Block third-party DNS at the router. Redirect port 53 to the router and drop outbound port 853, so "just use 8.8.8.8" and a random DoT provider both fail. The MikroTik and OpenWrt guides show the rules.
- Browser DoH. Firefox can bring its own encrypted resolver. Set it to dnsdome or off in the browser settings, and lock it with a policy where possible.
- VPN apps are the one bypass DNS filtering cannot stop by itself. Block the service group for VPN-style apps where offered, and rely on app-install restrictions on the device.
Filtering is a tool, not a substitute for the conversation. The log is most useful when the child knows it exists.
What you are collecting
The query log is a record of domain names your children's devices resolved, kept for your plan's retention period, in the EU. It is not page content and not messages. Decide as a family how long you keep it; the Free plan keeps one day, Home 30 days.
Can I block YouTube entirely but allow YouTube Kids?
They share domains, so no. Restricted mode via safe search is the workable middle: it hides mature content and comments. Blocking the YouTube service blocks both.
Does Social Media block WhatsApp?
No. Messaging is its own service group, so WhatsApp, Signal and Telegram stay reachable unless you block them explicitly.
Do I need a paid plan?
Categories, blocked services, safe search and schedules are on every plan. Every plan includes devices with their own endpoints and overrides: one on Free, five per profile on Home, 25 on Pro, unlimited on Business. More than one profile needs Home or above.