What DNS is, in one paragraph
Every time any app on your device wants to reach a website, it first asks a resolver: "where is this domain?" The resolver answers with an address, and only then does the connection happen. This question is asked by Safari, Chrome, a private tab, the browser inside Instagram, a video app, everything. The resolver is set once, for the whole device or the whole network.
What a filtering resolver does
A filtering resolver keeps a classification of domains by category: pornography, nudity, adult themes, gambling, dating, and so on. When a device asks for a domain in a blocked category, the resolver answers "nowhere", or points to a block page, and the site never loads. Three things follow from this design:
- It's device-wide. The browser is not a variable. Incognito, another browser, an in-app browser, an app that isn't a browser: same question, same refusal.
- It's a category, not a list. Nobody maintains a list of every adult site by hand; new domains appear daily. Classification catches them by what they are, not by name.
- It keeps no history of what you did. The resolver sees domain questions, not pages, not searches, not what was on the screen. Filtering by category needs no record of you at all. (What a given operator logs is their policy; ours is in the privacy policy.)
Most public filtering resolvers publish "family" addresses that block adult content, and some let you pick categories from an account. The addresses are on their sites.
Setting a filtering DNS on each device
iPhone and iPad
Per Wi-Fi network: Settings → Wi-Fi → (i) → Configure DNS → Manual. That covers one network only. For all networks including mobile data, you install a configuration profile that sets an encrypted resolver, or an app that provides one. Both cover every app on the phone.
Mac
System Settings → Network → your connection → Details → DNS, add the resolver's addresses, remove the others.
Windows
Settings → Network & internet → your adapter → DNS server assignment → Edit → Manual. Windows 11 also lets you turn on encryption (DNS over HTTPS) there.
Router
Set the resolver in the router's LAN/DHCP settings and every device on the Wi-Fi inherits it. Steps and limits in the router guide.
Door one: change it back
The setting you just made is a setting. The same screen that took the filtering resolver takes any other one, or "Automatic". On a computer you're the administrator; on an iPhone, a profile you installed is removed in Settings → General → VPN & Device Management → Remove Profile, four taps, no password. A DNS filter set by you is a note on the door in your own handwriting.
Door two: a VPN
A VPN app tunnels the device's traffic to the VPN provider, and most of them replace the resolver with their own while connected. The filtering resolver is no longer being asked. Nothing is broken; it's simply bypassed. Install a VPN app, tap connect. What closes this door, device by device: a porn blocker that blocks VPNs.
Door three: the browser's own encrypted DNS
Modern browsers can resolve domains themselves over HTTPS, ignoring the system resolver. Chrome's Secure DNS and Firefox's DNS over HTTPS both have a "custom provider" option where you type any resolver you like. On a computer, that's a text field in the browser's settings. On iPhone and iPad, browsers use the system's DNS path, so this door doesn't exist there.
What a DNS filter needs to actually hold
The filter is right. The attachment is the product. A DNS blocker holds when three things are true at once:
- The resolver setting can't be changed by the person using the device.
- A VPN can't be added.
- Loosening anything is slow on purpose: a delay long enough for an urge to pass.
On iPhone and iPad, Apple's supervision makes the first two possible: a supervised device can carry a profile that cannot be removed and that forbids VPN configurations. That's the profile SELFCNTRL installs; the third point is the account rule that any loosening waits twenty-four hours while tightening is immediate. The setup is ten minutes, once: the iPhone guide. On Mac and Windows, where no equivalent of supervision exists for a personal machine, SELFCNTRL installs the filter as an app tied to your account with curfews and the same delay; the phone is where the immovable lock goes, because the phone is where 2am happens.
DNS filtering, side by side
| DNS set by you | DNS profile (iPhone) | DNS in a supervised profile | |
|---|---|---|---|
| Every app, every browser, incognito | Yes | Yes | Yes |
| Follows the device on any network | Per network | Yes | Yes |
| Can be switched back | Yes, one screen | Yes, Remove Profile | No |
| VPN walks around it | Yes | Yes | VPN can't be added |
| Browser custom DoH walks around it | On a computer | No (iOS) | No (iOS) |
Questions
Is a DNS porn blocker better than a browser extension?
Yes, by construction. An extension sees one browser; a DNS filter answers the question every app asks before loading anything, so it covers all browsers, private windows, in-app browsers and apps. The remaining question is whether you can switch it off.
Does a DNS blocker slow down the internet?
Not noticeably. A DNS lookup happens once per domain and takes a few milliseconds; the answer is cached. Nothing about your traffic is routed elsewhere, unlike a VPN.
Can a DNS blocker block part of a site, like NSFW on Reddit?
No. DNS works on domains, not on pages or content inside a page. Either reddit.com resolves or it doesn't. Blocking a whole domain or a whole category is possible; blocking one kind of post within an app is not what DNS does.
Does a DNS blocker see my browsing?
A resolver sees which domains a device asks about, not the pages, searches or content. Whether it keeps those requests depends on the operator. Category filtering itself needs no record of you. SELFCNTRL stores no browsing history and sends no reports.