A DNS filter blocks bad addresses before they ever reach your device. Set Cloudflare for Families 1.1.1.3 and 1.0.0.3 on your router and every connected device is protected from known adult content and malware in seconds. Free, fast, private, and easy to remove later.
Initiative funded and led by Dr Alex J. Martin-Smith, CMgr · MBA · LLM · DBA. Contact Alex directly at ams@upleashed.com or 0330 122 1223 / 07624 218080.
Every device on your home Wi-Fi has to look up the address of a website before it can connect to it. That lookup is called DNS. By default, your router uses the DNS servers your broadband provider hands it. If you switch the router to use a family-safe DNS provider instead, every adult site, malware host or known-bad domain on that provider's published list will fail to resolve, on every device, automatically.
It is the single change that does the most work for the smallest effort, and it stacks neatly on top of whatever your ISP already provides.
All five are free for home use. Pick whichever fits. None pays us to be on this page.
The router is the right place to set DNS because it covers every device on your home Wi-Fi at once, including phones, tablets, smart TVs, games consoles and guest devices. Allow about ten minutes.
From the five above. Note down the primary and secondary DNS addresses.
On a device connected to your home Wi-Fi, open a browser and go to your router's admin address. Common UK defaults: 192.168.1.1, 192.168.0.1 or 192.168.1.254. The admin password is printed on a sticker on the back or underside of the router.
Look under WAN, Internet, Network or Advanced. The setting is often labelled "DNS server" or "Domain Name Server". On many UK Hubs (BT, Sky, Virgin), DNS settings are inside an "Advanced" tab.
Some routers list a primary and secondary box. Some have separate IPv4 and IPv6 boxes. Enter the two addresses from your chosen provider in the primary and secondary fields. Save.
Either use the reboot option in admin, or unplug it for thirty seconds. Allow two to five minutes for every device in your home to pick up the new DNS settings.
Come back to the homepage and run the free check again. It will confirm whether adult content and malware categories are now blocked on your network.
Return to your router DNS settings and replace custom DNS addresses with your ISP default values, or set DNS assignment back to Automatic if your router supports it.
If the router is locked down by your ISP, or you have rented accommodation, or you've lost the admin password, you can still set DNS on individual devices. The trade-off is that you have to do this on every device a child uses, and you have to keep it set when iOS, Android, Windows or macOS update.
Settings → Wi-Fi → tap the (i) next to your network → "Configure DNS" → Manual → add the primary and secondary addresses → Save.
For Wi-Fi only: Settings → Network & internet → tap your network → Modify network → IP settings: Static → enter the DNS addresses.
For Wi-Fi and mobile data: Settings → Network & internet → Private DNS → enter the provider's DoT hostname (e.g. family.cloudflare-dns.com, family-filter-dns.cleanbrowsing.org, dns-family.adguard.com).
System Settings → Network → Wi-Fi → Details on your network → DNS → click + → add both addresses → OK.
Settings → Network & internet → Wi-Fi → click your network → Hardware properties → DNS server assignment → Edit → Manual → IPv4 on → enter the addresses → Save.
DNS filtering is the best single change most UK homes can make. It is also one layer in a wider plan, not the whole plan. These are the things it does not do:
No. A DNS filter blocks devices on your network from resolving the addresses of sites on a published category list. It will not see inside encrypted apps, end-to-end messaging or video calls, and it will not stop content already cached or shared via screenshot. Treat it as one layer in a wider plan that also includes conversation, device-level settings and supervision of younger children.
Yes. A free VPN or a browser that turns on its own encrypted DNS (DNS-over-HTTPS) will route around the router-level filter. This is why DNS filtering pairs with a conversation about what is on offer, why limits are there, and how to ask for help when something feels off.
In day-to-day use, no. The family-filtered versions of Cloudflare 1.1.1.1 and Google Public DNS run on the same global infrastructure as the standard public resolvers. In some homes the new DNS will be faster than the ISP default.
Every DNS provider, including your ISP, sees the domain part of each request your devices make. Cloudflare publishes a no-logging commitment audited by KPMG (Cloudflare, 2020). OpenDNS (owned by Cisco Systems, 2015) and the others have varying retention policies published on their privacy pages. Read the privacy notice of the provider you choose if this matters to you.
As well as. Where your ISP runs its own network filter (BT, Sky, TalkTalk, Virgin Media, EE, Plusnet, Vodafone, NOW, Hyperoptic and Community Fibre all do), keep it on and add DNS filtering on top. Where your ISP does not run a network filter (Zen, Sure on the Isle of Man, Sure on the Channel Islands), DNS filtering is your primary line.
