DNS Speed Test

Why DNS Parental Controls Work

The internet does not come with a filter. Every device connected to your home network can access any website, any app, and any content — unless you actively block it. For parents, this is a problem that needs a practical solution, not a lecture about screen time or a lecture about responsibility.

DNS parental controls solve this problem at the network level. Instead of installing filtering software on every phone, tablet, laptop, and smart TV in your house, you change two settings on your router. Every device that connects to your Wi-Fi then routes its DNS queries through a filtering resolver that blocks inappropriate content before it loads. The child never sees the blocked site. There is no app to bypass, no extension to disable, and no setting to toggle on each individual device.

This approach works because every internet connection starts with a DNS lookup. When your child types a URL or clicks a link, the device first asks a DNS resolver to translate that domain name into an IP address. A parental DNS resolver checks the domain against its blocklist and refuses to resolve blocked categories — adult content, gambling, violence, drugs, proxy services, and VPNs. The connection is rejected before any content is loaded.

The practical advantage is coverage. A single router configuration protects every device: phones, tablets, laptops, gaming consoles, smart TVs, and IoT devices. You do not need to configure each device separately. You do not need to install software on devices you do not own. And you do not need to trust that your child will leave the filtering software running.

DNS parental controls are also transparent. They do not slow down browsing, they do not inject ads, and they do not collect personal data beyond what is needed to resolve DNS queries. The best providers — Cloudflare, OpenDNS, and CleanBrowsing — are transparent about their data practices and have been audited by independent firms. Your child's browsing habits are not stored, sold, or shared.

The limitation is that DNS filtering is a blunt instrument. It blocks entire categories of domains, not specific pages or images. A social media platform might host both harmless content and inappropriate material, and DNS filtering cannot distinguish between the two. For fine-grained control, you will need to combine DNS filtering with device-level restrictions and open conversations about online safety.

Top 5 DNS Servers for Parental Controls

These five providers offer the strongest content filtering for families. Each has been evaluated on blocking categories, ease of setup, speed, privacy, and pricing.

#1 — Cloudflare for Families (1.1.1.3)

Blocks: Adult content, malware, phishing | Speed: Very fast | Encryption: DoH, DoT | Cost: Free

Cloudflare 1.1.1.3 is the family variant of Cloudflare's public DNS. It blocks adult content and malware simultaneously, giving you two layers of protection in a single resolver. The filtering is powered by Cloudflare's massive global network — over 300 data centers across 100+ countries — which means query response times are consistently fast regardless of where your family is located.

What makes Cloudflare 1.1.1.3 the top choice is the combination of speed and simplicity. There is no account to create, no configuration portal to manage, and no query limits to worry about. Change your router DNS to 1.1.1.3 and 1.0.0.3, and every device on your network is protected. Cloudflare engages KPMG to audit its privacy practices annually, confirming that DNS query logs are purged within 24 hours and never used for advertising.

Cloudflare also supports DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt your DNS queries so your ISP cannot see or modify them. For browsers that support DoH natively — Firefox, Chrome, Edge — you can enable family filtering directly in the browser settings using Cloudflare's family DoH endpoint.

IPs: 1.1.1.3, 1.0.0.3 | DoH: https://family.cloudflare-dns.com/dns-query | DoT: family.cloudflare-dns.com

Visit 1.1.1.1 · How to set up

#2 — OpenDNS FamilyShield

Blocks: Adult content, malware, phishing, proxy/VPN | Speed: Fast | Encryption: DoH | Cost: Free

OpenDNS FamilyShield is operated by Cisco, one of the largest cybersecurity companies in the world. It uses Cisco Umbrella's threat intelligence — sourced from Talos Intelligence, one of the most comprehensive threat research teams in the industry. FamilyShield blocks adult content, malware, phishing, and proxy/VPN domains, making it one of the most aggressive free content filters available.

Cisco Talos analyzes over 600 billion DNS requests daily, giving them extraordinary visibility into global internet activity. Their domain categorization database contains over 80 categories, covering everything from adult content to gambling, drugs, violence, and social networking. When a new domain appears, Talos categorizes it within minutes, which means newly created inappropriate sites are blocked almost immediately.

OpenDNS also offers a free OpenDNS Home tier with customizable filtering — you can choose which categories to block and which to allow. FamilyShield is the preconfigured "block everything inappropriate" option that requires zero setup beyond changing DNS addresses. For parents who want more control, creating a free OpenDNS account gives you access to a dashboard where you can customize filtering per category.

IPs: 208.67.222.123, 208.67.220.123 | DoH: https://family.opendns.com/dns-query

Visit OpenDNS · How to set up

#3 — CleanBrowsing

Blocks: Adult content, proxy/VPN, explicit DNS over HTTPS | Speed: Fast | Encryption: DoH, DoT | Cost: Free (paid plans available)

CleanBrowsing is a content filtering DNS provider built specifically for families and schools. Unlike general-purpose DNS resolvers that added filtering as a secondary feature, CleanBrowsing was designed from the ground up for content control. It offers three filtering levels: Security Filter (malware and phishing only), Adult Filter (adult content, proxy/VPN, and explicit DoH endpoints), and Family Filter (adds social media, video streaming, and dating sites to the block list).

The Family Filter is the most restrictive option and the one most relevant for parents with younger children. It blocks adult content along with platforms like TikTok, Instagram, Snapchat, YouTube, and dating apps. This level of filtering is useful for households with children under 12, where even social media platforms may expose kids to inappropriate content. Older teens who need social media access for school can use the Adult Filter instead.

CleanBrowsing also blocks DNS-over-HTTPS endpoints, which prevents tech-savvy kids from bypassing router-level filtering by using DoH in their browser. This is a unique feature among free DNS providers and addresses one of the most common bypass methods. The free tier includes unlimited queries for the security and adult filters, with the family filter available on paid plans starting at $65/year for家庭use.

IPs (Adult Filter): 185.228.168.168, 185.228.169.168 | IPs (Family Filter): 185.228.168.9, 185.228.169.9 | DoH: https://family.cleanbrowsing.org/dns-query

Visit CleanBrowsing · How to set up

#4 — AdGuard DNS Family

Blocks: Adult content, ads, trackers, malware | Speed: Fast | Encryption: DoH, DoT, DoQ | Cost: Free (300K queries/mo)

AdGuard DNS offers a dedicated family server that combines adult content filtering with ad and tracker blocking. The family server at 94.140.14.15 blocks adult sites, malicious domains, advertisements, and tracking pixels in a single resolver. This dual protection means your children see fewer inappropriate ads and are not tracked across the web.

AdGuard maintains its own content categorization database, updated regularly with data from community reports and automated analysis. The family filter covers adult content, gambling, drugs, and violence. It also blocks ads and trackers by default, which provides an additional layer of protection — many inappropriate ads are served through ad networks, and blocking the ads themselves reduces exposure to inappropriate content.

The free tier includes 300,000 queries per month, which covers most individual users. For larger families with many devices, the paid plan at approximately $2.50/month removes the query limit and adds access to dedicated servers. AdGuard supports the widest range of encryption options among the providers in this guide — DoH, DoT, and DNS over QUIC (DoQ) — giving you flexibility in how you encrypt your queries.

IPs: 94.140.14.15, 94.140.15.16 | DoH: https://family.adguard-dns.com/dns-query

Visit AdGuard DNS · How to set up

#5 — Quad9 (9.9.9.9)

Blocks: Malware, phishing, exploit kits | Speed: Fast | Encryption: DoH, DoT, DoQ | Cost: Free

Quad9 is not a content filter in the traditional sense — it does not block adult content by default. However, it blocks known malicious domains with the most comprehensive threat intelligence of any free DNS provider, drawing from over 25 sources including IBM X-Force, Proofpoint, CrowdStrike, and VirusTotal. For families whose primary concern is malware and phishing rather than content filtering, Quad9 provides the strongest security baseline.

What makes Quad9 relevant for parental controls is its combination of security with privacy. Quad9 is a Swiss nonprofit with no commercial ties, no advertising partnerships, and no incentive to collect or monetize user data. DNSSEC validation is enforced by default, meaning every DNS response is cryptographically verified. For families who want protection from malicious sites without the privacy concerns of a for-profit provider, Quad9 is the most trustworthy option.

Quad9 can be combined with content filtering DNS on different devices — use Quad9 on parents' devices for maximum speed and security, and use Cloudflare Family or OpenDNS FamilyShield on children's devices for content filtering. This hybrid approach gives each family member the right level of protection.

IPs: 9.9.9.9, 149.112.112.112 | DoH: https://dns.quad9.net/dns-query | DoT: dns.quad9.net

Visit Quad9 · How to set up

Comparison Table

*AdGuard Family free tier includes 300,000 queries per month. Paid plans remove the limit.

How to Set Up DNS Parental Controls on Your Router

Router-level DNS configuration is the most effective way to protect your entire family. Every device that connects to your Wi-Fi inherits the filtering rules without any per-device setup.

Step 1: Access Your Router Admin Panel

Open a web browser and type your router's IP address into the address bar. Common router addresses are 192.168.1.1, 192.168.0.1, or 192.168.1.254. If none of these work, check the sticker on the bottom or back of your router for the correct address. You will be prompted for a username and password. The default credentials are often printed on the router itself — common defaults are admin/admin, admin/password, or admin/blank.

Step 2: Find the DNS Settings

The DNS settings location varies by router manufacturer. Look for sections labeled WAN, Internet, Network, DNS, or DHCP Settings. On most routers, DNS settings are in the WAN or Internet section, since DNS is part of how your router connects to the internet. Some routers list DNS settings under DHCP Settings, which controls how IP addresses and DNS servers are assigned to devices on your network.

Step 3: Enter the Parental DNS Addresses

Replace the existing DNS server addresses with your chosen parental DNS provider's IPs. For Cloudflare Family, enter 1.1.1.3 as the primary DNS and 1.0.0.3 as the secondary DNS. For OpenDNS FamilyShield, use 208.67.222.123 and 208.67.220.123. Make sure to save the changes before closing the admin panel.

Step 4: Restart Your Router

After saving the DNS settings, restart your router to ensure the changes take effect. Unplug the router from power, wait 30 seconds, and plug it back in. Once the router fully restarts (usually 1-2 minutes), all devices on your network will start using the new DNS resolver. You can verify the change by visiting 1.1.1.1/help if you set up Cloudflare, or by using our DNS speed test to confirm which resolver your network is using.

Step 5: Verify the Filtering Works

Test the filtering by trying to access a known-blocked category from a device on your network. If you configured Cloudflare Family or OpenDNS FamilyShield, attempting to visit an adult content site should result in a block page or a failed connection. This confirms the DNS filtering is active and working correctly across your network.

Device-Specific DNS Setup

When router-level configuration is not possible — for example, on devices that leave your home network, or on networks you do not control — you can configure DNS directly on each device.

Android (Private DNS)

Android 9 and later support Private DNS, which encrypts DNS queries using DNS over TLS. Go to Settings > Network & Internet > Advanced > Private DNS. Select "Private DNS provider hostname" and enter your provider's hostname — for example, family.cloudflare-dns.com for Cloudflare Family, or dns.quad9.net for Quad9. This applies to all Wi-Fi and mobile data connections on the device.

iPhone and iPad (iOS)

Go to Settings > Wi-Fi. Tap the info icon next to your connected network. Scroll down to Configure DNS, tap it, and switch from Automatic to Manual. Remove any existing DNS entries and add your parental DNS addresses — for example, 208.67.222.123 for OpenDNS FamilyShield. Note that iOS DNS settings apply per Wi-Fi network, so you will need to configure each network your child's device connects to separately.

Windows

Open Settings > Network & Internet > Ethernet (or Wi-Fi, depending on your connection). Click "Edit" next to DNS server assignment. Switch from Automatic to Manual. Enable IPv4, enter your primary and secondary DNS addresses, and save. For Cloudflare Family, use 1.1.1.3 and 1.0.0.3. The change takes effect immediately without a restart.

macOS

Open System Settings (or System Preferences on older macOS versions) > Network. Select your active connection (Wi-Fi or Ethernet), click Details, and go to the DNS tab. Click the plus button under DNS Servers and add your parental DNS addresses. Remove any existing entries. Click OK to save. The change applies immediately.

Chromebook

Open Settings > Network. Click on your connected Wi-Fi network, then click the Network tab. Under Name servers, select "Custom name servers" and enter your parental DNS addresses. ChromeOS also supports Private DNS — in the same Network settings, you can enable "Use encrypted DNS" and enter a DoH provider hostname.

Gaming Consoles

PlayStation, Xbox, and Nintendo Switch all allow manual DNS configuration in their network settings. On PlayStation, go to Settings > Network > Set Up Internet Connection > Custom > DNS Settings > Manual. On Xbox, go to Settings > Network > Network Settings > Advanced Settings > DNS Settings > Manual. On Nintendo Switch, go to System Settings > Internet > Internet Settings > your network > Change Settings > DNS > Manual. Enter your parental DNS addresses in the primary and secondary fields.

Limitations of DNS Filtering

DNS parental controls are effective, but they have real limitations that every parent should understand. Knowing these limitations helps you set up a more complete protection strategy.

Cannot Block Content Inside Apps

DNS filtering works at the domain level — it blocks entire domains or categories. It cannot block specific content within an app or website. If your child uses a social media app that hosts both appropriate and inappropriate content, DNS filtering can only block the entire platform, not individual posts or images. For granular content control within apps, you need device-level parental controls like Apple's Screen Time or Google Family Link.

Encrypted DNS Can Bypass Filters

If a device can use DNS over HTTPS (DoH) directly in the browser, it can bypass router-level DNS filtering. Firefox, Chrome, and Edge all support DoH natively, and a child who knows how to change browser settings can point their browser at a public DoH resolver and bypass your router configuration. To prevent this, use CleanBrowsing's Adult Filter (which blocks known DoH endpoints), or configure DoH at the browser level with parental policy enforcement.

VPN and Proxy Bypass

A VPN encrypts all traffic and routes it through an external server, completely bypassing DNS filtering. Many free VPN apps are available on mobile app stores. CleanBrowsing's Adult Filter blocks known VPN and proxy domains, but new or less-known VPN services may not be in the blocklist. Device-level restrictions that prevent VPN installation are the most reliable way to address this.

New Domains Are Not Pre-Blocked

DNS filtering relies on known domains in categorized databases. A newly registered domain that has not yet been categorized will not be blocked, even if it hosts inappropriate content. The best providers — OpenDNS, Cloudflare, CleanBrowsing — categorize new domains within minutes to hours, but there is always a window between a domain being registered and being categorized. This window is small, but it exists.

Limited Control Over Specific Content

DNS filtering is category-based, not content-based. You can block "adult content" as a category, but you cannot block specific images or pages within a non-adult site. If a news website publishes an article with graphic content, DNS filtering will not block that specific article — it only blocks domains classified as "adult." For families who want fine-grained content control, DNS filtering should be combined with browser extensions, search engine SafeSearch settings, and platform-specific parental controls.

Overblocking

DNS filters sometimes block legitimate content. A health education site might be categorized as adult content. A technology blog might be flagged as a proxy or VPN site. Overblocking is more common with aggressive filters like CleanBrowsing's Family Filter, which blocks social media and video platforms entirely. Most providers offer a way to report false positives, and the OpenDNS Home tier lets you customize which categories to block. If a site your child needs for school is blocked, you may need to whitelist it manually.

Frequently Asked Questions

Test Your DNS Speed

After setting up parental DNS, run our speed test to confirm the new resolver is performing well from your network. The test benchmarks 17+ resolvers simultaneously using real DNS-over-HTTPS queries, measures actual response times, and delivers results in seconds. No downloads. No registration. No data collected.

Run DNS Speed Test

Compare your results with our fastest DNS rankings, or read the best DNS servers guide to find the right resolver for your household.