Add protection beyond one browser

A device setting protects one screen. Filters applied to the network — through a broadband provider's free filter, a router setting or a DNS service — reach every phone, laptop and console that connects through them. They make a useful second layer, with well-known gaps: mainly mobile data and browsers that bring their own secure DNS.

What a DNS filter actually does

Whenever you type a web address, your device asks a DNS resolver to translate the name into a numerical address. A filtering resolver keeps lists of sites sorted into categories and simply declines to answer for categories that have been switched off. Because it works on names, it covers browsers and most apps at once, without software on each device.

DNS resolver: The service that turns names like example.org into numerical addresses.
Router: The box that connects your home to the internet and usually decides which resolver every device uses.
Private DNS: An Android setting that sends lookups to a chosen resolver on Wi-Fi and mobile data alike.
Secure DNS (DNS over HTTPS): A browser feature that can send lookups to the browser's own chosen resolver, sometimes skipping the router's.
VPN: A tunnel that sends traffic through another network, which usually avoids local DNS filters.

Broadband provider filters

The main UK broadband providers each offer a free network filter, managed from the account holder's online settings: BT Parental Controls, Sky Broadband Shield, Virgin Media Web Safe and TalkTalk HomeSafe. They were designed with families in mind, and several include a gambling category alongside adult content. Category names and defaults change over time, so look at the current options in your provider's account area. Switching a filter off normally needs the account holder's login, which makes it worth thinking about who keeps that password.

A closed laptop resting on a wooden desk beside a mug, photographed with a shallow depth of field — A network filter keeps working whichever device is picked up next.

Router settings and configurable DNS services

Many routers let you replace the provider's resolver with one of your choice. Some services, such as NextDNS and the OpenDNS Home service, let you create an account, switch on a gambling category and point the router at your profile. Free family presets, such as Cloudflare's 1.1.1.3 address or OpenDNS FamilyShield, are aimed mainly at adult content and malware, so do not assume they block gambling. Check the category list before relying on any of them.

On Android, Private DNS takes the same idea onto the phone itself:

Open Settings and go to Network & internet (on some phones, Connections, then More connection settings).
Choose Private DNS.
Select the option for a provider hostname and enter the hostname given by your filtering service.
Save, then test a blocked address on both Wi-Fi and mobile data.

Private DNS has been part of Android since version 9 and applies on mobile data as well as Wi-Fi, which a home router filter cannot do. On iPhone, most filtering services supply a configuration profile that sets DNS in a similar way.

Comparing the network options

Network filtering options and their gaps
Option	Where it applies	Who can switch it off	Common gap
Broadband provider filter	Home broadband connection	The account holder	Mobile data and other Wi-Fi networks
Router DNS change	Devices on home Wi-Fi	Anyone with the router password	Browsers using their own secure DNS
Android Private DNS	One phone, Wi-Fi and mobile data	Anyone who can open the phone's settings	Can be turned off in a few taps
iPhone DNS profile	One device	Anyone who can delete the profile	Easy removal unless Screen Time restricts changes

The routes around a network filter

Mobile data skips a home router filter entirely.
Firefox and Chrome can use secure DNS of their own, which may bypass the router; check each browser's privacy and security settings.
A VPN carries traffic through another network and avoids most DNS filters.
Wi-Fi at work, in cafés or at friends' homes has its own rules.

Pairing a network filter with a device barrier closes several of these gaps together: Screen Time can prevent VPN and profile changes, and dedicated blockers watch for some workarounds. Account controls then catch much of what still slips through.