Most filters tell you "the whole home is covered" and hope you never ask what that means. Here is the device-by-device truth: what is protected, what travels with the device when it leaves your house, and where the honest limits are.
Layer 1 — the device itself. A device can use filtered DNS when its operating system and network support the configuration. Named per-device reporting is not available as a verified feature. DNS filtering does not inspect images or content inside an allowed site or app.
Layer 2 — the home network. A router configured to use filtered DNS can protect DNS lookups that pass through it. Devices using other DNS services, a VPN or cellular data may bypass that configuration.
A device covered only by Layer 2 is protected at home and unprotected the moment it leaves. Protection away from home requires a working device configuration and a separate check on that network.
| Device | How it is protected | Travels with the device? | Can it be removed? |
|---|---|---|---|
| iPhone / iPad | DNS configuration profile. Filters DNS requests that use the configured resolver; it does not inspect app content. | Configuration dependent — while the DNS configuration remains active | Screen Time can lock apps and Safari, but not the DNS setting itself; only a supervised iPhone (set up with Apple Configurator) makes it hard to switch off |
| Android | One settings field (Private DNS) with your family's protection address. | Configuration dependent | Family Link can restrict some settings; verify on the device. |
| Windows laptop | Manual filtered DNS configuration. A dedicated Windows protection app is not verified as available. | Configuration dependent | DNS changes depend on administrator permissions; removal resistance is not guaranteed. |
| Mac | Filtered DNS configuration; named per-device attribution is unavailable. | Configuration dependent | Removal depends on device management and administrator permissions. |
| Chromebook | Special case. No lockable DNS on personal Chromebooks. We use Google Family Link: forced SafeSearch, site blocking, no incognito, no guest mode. At home, filtering applies to lookups using the router's configured resolver. | Partially — Family Link rules travel; DNS alerts do not | Check the current supervision settings; removal resistance is not guaranteed. |
| Amazon Fire tablet | Per-network filtered DNS plus Amazon Parental Controls behind a partner-held PIN. | Per network — set once for each WiFi it joins | Check DNS and parental-control settings on the device. |
| Older iPad or Android (even 10 years old) | Same filter via a fallback path: manual DNS on old iPads, the free Intra app on old Androids. | Configuration dependent (Intra) / per network (old iPad) | A store PIN does not guarantee the DNS setting stays active. |
| Xbox / PlayStation | Uses the home router's filtered DNS when configured; console family settings are a separate control. | No — home coverage only (consoles rarely travel) | Check console family settings and DNS configuration. |
| Smart TVs, guests' phones | DNS filtering applies while the device uses the home router's configured resolver; bypasses remain possible. | No — home coverage only | n/a |
If someone turns on a phone's hotspot and connects a laptop, the laptop does not inherit the phone's protection. Phone hotspots pass traffic straight through to the carrier. The phone's protection depends on its own configuration; do not assume it also protects the tethered laptop.
A laptop must have its own working DNS configuration to filter lookups away from home. A hotspot does not supply that protection. Check protection on the laptop after changing networks.
The resolver implementations use shared filtering rules. A profile or token in a request is not proof of which person used a device. Named per-device activity reports and reliable guest attribution are not available as verified features. A blocked DNS request can also come from background traffic; do not treat it as proof of a person's intent.
Guests may use the home router's filtered DNS, but their devices may bypass it. There is no verified guarantee that guest activity is separated from household activity in alerts.
Gateway hardware is in testing. Shipping availability, device naming and guest separation are not verified as available.