How DNS filtering works on a phone, and where it stops working

Adapted from the Mamori guide DNS filtering on Android, step by step. Vendor details were checked against Google, Cloudflare and CleanBrowsing documentation.

A lot of content filtering, from parental controls to company networks, comes down to one small step: the DNS lookup. Understand it and you can see what a filter can block, what it cannot, and how it gets bypassed. The example here is blocking adult sites on a phone, but the same mechanics apply to malware or ad domains.

The lookup a filter hooks into

When you open a website, your phone first asks a DNS resolver to turn the name, such as example.com, into an IP address. Only then does it connect.

A filtering resolver keeps a list of domains by category. When a lookup matches a blocked category, it does not return the real address. The connection never starts, so the page never loads.

This has two useful properties:

• It covers every app, not just one browser. Any app that uses the system resolver goes through the same check.
• It is cheap. There is no need to inspect page content, so it adds almost no work for the phone.

It also has one built-in weakness. It only sees names. It cannot see what is on a page, so a site that is not on the list yet, or adult content hosted on a large general site, can slip through.

Option 1: a public family resolver

The quickest setup uses a public resolver that already filters. Two common free ones:

• Cloudflare 1.1.1.1 for Families. The version that blocks malware and adult content uses the hostname family.cloudflare-dns.com, or the IP addresses 1.1.1.3 and 1.0.0.3. The malware-only version (security.cloudflare-dns.com, or 1.1.1.2 and 1.0.0.2) does not block adult content.
• CleanBrowsing Adult Filter. Hostname adult-filter-dns.cleanbrowsing.org, IPv4 185.228.168.10 and 185.228.169.11. It blocks adult sites and enforces SafeSearch on Google and Bing. It does not block proxies, VPNs or mixed-content sites. CleanBrowsing's stricter Family Filter does block those. The free tier is throttled and has limited settings.

On Android 9 and later, you set this system-wide with Private DNS. Open Settings, then Network & internet, then Private DNS. Choose "Private DNS provider hostname", enter the hostname with no https://, and save. On some phones the setting sits under an Advanced heading. If you can't find it, search Settings for "Private DNS". Private DNS uses DNS over TLS, which is why it takes a hostname and not an IP address. Cloudflare notes that once it is set, the phone uses that resolver on every network, mobile data included.

iPhone is different. Cloudflare's own page says a manually set DNS server only applies to the Wi-Fi network you are on and does not work on mobile data. That is why iPhone filters usually install a profile or use Apple's Screen Time web filter.

Option 2: an on-device filter using the VPN slot

Many blocker apps on Android, Mamori included, ask for the VPN permission. They do not do this to send traffic to a remote server. They do it because Android's VpnService API is the supported way for an app to see the phone's DNS traffic.

The common pattern works like this:

1. The app creates a local VPN interface and tells Android to use a DNS server address that routes into that interface.
2. DNS queries arrive at the app on the phone itself.
3. The app checks each name against its blocklist. Blocked names get no usable answer. Allowed names are forwarded to a normal upstream resolver, and the answer is passed back.
4. All other traffic carries on as normal.

Done this way, nothing leaves the phone that would not have left anyway, and no browsing log has to exist. The trade-off is set out plainly in Android's developer documentation: "There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created." So if you turn on a privacy VPN, or install a second blocker, the filter is quietly switched off. Android also lets the user stop any VPN app from the VPN screen in Settings.

Where DNS filtering stops working

Every DNS filter, whatever the setup, shares the same limits:

• The user can undo it. CleanBrowsing says anyone with access to the network settings can change the DNS server, and on most systems it "takes less than a minute".
• Browsers can bypass it. Chrome and Firefox have their own encrypted DNS setting. When it is on, the browser can resolve names itself and skip the system filter. Google notes that Chrome's secure DNS cannot be used if the device is managed or parental controls are on.
• Other software may not follow it. A VPN, or an app that does its own DNS, may not use the choice made in Settings.
• Names, not content. New domains and mixed-content sites get through until a list catches up.

Making it stick

The filter is the easy part. The hard part is the moment when the person who set it up wants it off. So the useful extras add friction: a lock someone else holds, a delay before switching off, and protection against simply uninstalling the app.

Mamori is built around that layer: a filter for 2.5M+ adult domains, plus a cooldown timer, phrase or PIN lock you choose before you need it. When protection is off, everything is off and the app uninstalls normally. It is meant as a lock you set on purpose, not a trap.

The full step-by-step guide, with the sources, is here: DNS filtering on Android. For a side-by-side look at Screen Time, DNS, VPN-based apps, extensions and router filters, see blockers compared.