DNS Filtering at Home That Stops Bad Sites Before They Load

Every time someone in your house taps a link, their device first asks a DNS server where that website lives. That lookup happens hundreds of times an hour on a normal home network, and on most networks nobody checks what is being asked for. DNS filtering changes that one step: when a device asks for a known phishing or malware domain, the filter simply refuses to answer, and the page never loads.

It is one of the cheapest security upgrades available, often free and set up in under fifteen minutes on a router. It is also widely misunderstood. I have seen small offices treat it as a replacement for antivirus and families assume it makes children's browsing completely safe. Neither is true. Here is what DNS filtering actually does, how to set it up, and where its limits are.

How DNS Filtering Works in Plain Terms

DNS is the internet's address book. You type a name like a bank's website; a DNS resolver translates it into a numeric IP address so your device can connect. By default, that resolver is usually run by your internet provider and answers every request without question.

A filtering resolver keeps lists of domains known to host malware, phishing pages, scam shops or other categories you choose. When a request matches the list, it returns a block instead of the real address. The device then shows a connection error or a block page. Because it works at the name level, it protects every device on the network, including smart TVs and cameras that cannot run security software.

Free DNS Filtering Services Worth Knowing

Several reputable public resolvers offer filtering at no cost. The addresses below are the primary IPv4 ones.

Service	Address	What it blocks	Custom lists
Quad9	9.9.9.9	Malware and phishing domains	No
Cloudflare for Families	1.1.1.2	Malware	No
Cloudflare for Families	1.1.1.3	Malware and adult content	No
NextDNS	Personal address from your account	Configurable categories and blocklists	Yes, with a free monthly query allowance

For most households, Quad9 or Cloudflare's malware option is a sensible starting point: no account, no configuration, nothing to maintain. NextDNS suits people who want logs, per-device rules or their own allow and block lists.

Setting It Up on Your Router

Changing DNS on the router protects everything connected to your Wi-Fi at once. The menu names differ between brands, but the steps are similar.

Log in to your router's admin page, usually through an address printed on its label.
Find the WAN, Internet or DHCP settings, and look for DNS server fields.
Replace the automatic or provider entries with your chosen filtering addresses, a primary and a secondary.
Save, then restart the router so devices pick up the change.
Test by visiting a known test page offered by the service, or check that normal sites still load quickly.

If you have not secured the router itself yet, do that first; our guide to the first 20 minutes with a new router covers admin passwords and firmware. A filtering resolver on a router with the default password is a locked door with the key under the mat.

When the router will not let you change DNS

Some provider-supplied routers lock the DNS fields. In that case, set DNS on individual devices instead. Windows, macOS, Android and iOS all let you change DNS in network settings, and Android's Private DNS option accepts a hostname from services like Quad9 or NextDNS.

The Bypass Most People Miss

Modern browsers can use encrypted DNS, known as DNS over HTTPS, and some switch it on by default with their own chosen provider. When that happens, the browser skips your router's DNS entirely, and your filtering does nothing for that browser.

Check each browser's security or privacy settings for "secure DNS" or "DNS over HTTPS". Either set it to use the same filtering provider you chose, or set it to use the system's default resolver. The same applies to some VPN apps, which route DNS through their own servers while connected. Five minutes checking browsers on each family laptop closes the biggest gap.

DNS Filtering Is Not a Security Suite

A common sales pitch frames DNS filtering as "network-wide protection" that makes other tools unnecessary. I would push back hard on that. It is a useful layer, not a wall.

It only knows about listed domains. A phishing page set up an hour ago may not be on any blocklist yet.
It cannot see files. A malicious attachment in an email or a file on a USB stick goes straight past it.
It does not stop you typing a password into a page that slipped through. That still takes judgement, a password manager that refuses to autofill on the wrong domain, and two-factor authentication.
It is easy to bypass on purpose. Anyone who can change a device's DNS settings can opt out.

Treat it as one item on a short list alongside updates, a password manager and two-factor authentication, the same approach as in our roundup of free security tools worth setting up first.

Using It in a Small Office

For a small business without an IT department, DNS filtering offers a lot for little effort. A configurable service lets you block known malicious categories for every desk and guest network, and logs show which devices tried to reach blocked domains. If one laptop repeatedly tries to reach a malware domain at odd hours, that is an early sign it may be infected.

Keep a written note of what you changed and where, including the admin account for the DNS service. When someone else has to troubleshoot a blocked site in six months, that note saves an afternoon.

Handling False Positives

Occasionally a legitimate site gets blocked. It happens most with small businesses on shared hosting, newly registered domains and some link-shortening services. With Quad9 or Cloudflare, you cannot whitelist a site yourself; you can report it, and in the meantime use a different network if you trust the site. With a configurable service, add the domain to your allow list. Do not respond to the occasional false positive by turning filtering off for everyone.

FAQ

Does DNS filtering slow down my internet?

Usually not. Large public resolvers often answer faster than an internet provider's default servers, and lookups are cached, so most requests take only a few milliseconds.

Can DNS filtering stop all ads?

Some services and tools such as Pi-hole can block many ad domains, but ads served from the same domain as the content still get through. Treat ad blocking as a bonus.

Will DNS filtering protect my phone on mobile data?

Only if you set it on the phone itself, for example with Android's Private DNS or a configuration profile on iOS. Router settings stop at your Wi-Fi.

Fifteen Minutes This Weekend

Pick a filtering resolver, set it on your router, restart, and then check the secure DNS setting in every browser in the house. Add it on phones for protection away from home. For more practical security tools you can set up without specialist help, see our tools section.