Free DNS Filtering UK Parents Guide 2026: Cloudflare, OpenDNS, CleanBrowsing

Why DNS filtering matters in 2026

DNS filtering is the easiest, cheapest and most universal layer of online safety available to UK families, and it remains the most underused. In about ten minutes, with zero ongoing cost, you can apply a content filter that blocks tens of thousands of adult sites, phishing pages and malware downloads to every device on your home Wi-Fi: every phone, every tablet, every console, every smart TV, every e-reader, every smart speaker. No app to install on each device. No subscription. No login. No account.

The reason most UK parents have never heard of DNS filtering is that it sits behind several letters of jargon (DNS, primary server, secondary server, IPv6) that put off non-technical readers immediately. This guide is deliberately written to make those things easy. If you can copy and paste a four-digit number into a settings field, you can do everything in this guide.

Three reasons DNS filtering is more important in 2026 than in previous years:

• UK ISP filters are good but not universal. BT, Sky, Virgin, TalkTalk and EE offer strong free filters as detailed in the UK ISP parental controls guide. But Three Home Broadband, NOW Broadband (without paid Buddy), and many smaller altnet providers (Hyperoptic, Community Fibre, Cuckoo and others) provide weaker or no built-in filtering. Free DNS filtering fills that gap.
• Modern devices have more web access than parents realise. Every gaming console has a web browser. Every smart TV has YouTube. Every smart fridge in 2026 has a screen. DNS filtering catches all of these in one go, where individual device controls would require fiddling with each.
• The Online Safety Act 2023 (fully enforced from 25 July 2025) has not solved the underlying problem of harmful content existing online, only made the major platforms more accountable. The long tail of dodgy websites, phishing scams and malware stays exactly the same. DNS filtering catches that tail effectively for free.

This is the seventh deep-dive in the BroadbandSwitch.uk online safety series. If you have not already, start with the main parents' hub. For the broader router controls picture see the router controls deep-dive. For your specific UK ISP's filter options see the ISP parental controls guide.

What is DNS, in plain English

The slightly longer version, for parents who want to understand how it works.

Every time a device on your network tries to load a website, it has to figure out where that website actually lives. Computers use numbers (IP addresses) to find each other on the internet, but humans use names like "bbc.co.uk". The DNS is the system that translates the human-friendly name into the computer-friendly number.

Imagine the DNS as a phone book. You look up "British Telecom" and find the number. Then you dial that number to actually make the call.

Now imagine someone has taken that phone book and gone through it crossing out the entries for businesses unsuitable for children: certain phone-sex lines, scammers, dodgy operators. When you look up one of those crossed-out entries, the phone book just refuses to give you the number. You cannot call them.

That is exactly what a filtering DNS service does. It is a phone book where the entries for adult sites, malware, phishing, and (depending on the service) gambling, drugs and weapons sites have been crossed out. When any device on your network tries to load one of those sites, the DNS refuses to translate the name to a number. The site does not load. The user sees an error page or a "this site has been blocked" message.

Three more things worth knowing:

• DNS filtering is fast. Cloudflare's 1.1.1.3 is among the fastest DNS resolvers on the internet, and OpenDNS and CleanBrowsing are fast too. You will not notice a speed change.
• DNS filtering is privacy-respecting. All three services this guide recommends (Cloudflare 1.1.1.3, OpenDNS FamilyShield, CleanBrowsing) have public privacy commitments not to log your queries for advertising or sell your data. This is genuinely better than your default ISP DNS, which may log everything.
• DNS filtering is whole-network. Set it once on your router, and every device that joins your home Wi-Fi automatically uses the filter. No per-device setup needed.

Choosing a free family DNS service

Three free DNS services are worth considering for UK families. All three are reputable, free forever, require no account, and work fine alongside your existing UK ISP.

Each of the three is covered in detail next.

Cloudflare 1.1.1.3 (recommended)

The Cloudflare DNS numbers (paste these)

Cloudflare offers two family-focused options. Pick the second for most UK family use:

If your router supports IPv6 (most modern UK routers do):

What Cloudflare 1.1.1.3 blocks

• Adult content: pornographic sites and explicit content portals
• Phishing sites: fake banking, fake delivery notifications, fake login pages
• Malware: sites that distribute viruses, ransomware, spyware
• Other malicious sites: command-and-control servers for botnets, known scam domains

What Cloudflare 1.1.1.3 does not block

• Social media (TikTok, Instagram, Snapchat)
• Gambling sites (use OpenDNS or CleanBrowsing for these)
• Drug, weapon or self-harm content (separate categories not in 1.1.1.3)
• Specific apps
• YouTube videos that are themselves inappropriate (the YouTube domain itself is not adult)

Privacy: what Cloudflare logs

Cloudflare's stated commitment is that DNS queries to 1.1.1.1 (and the family variants) are not logged after 24 hours, are not sold, and are not used for advertising. Cloudflare hires KPMG to audit this commitment annually, which makes it more credible than most. This is genuinely better than the default DNS your UK ISP provides, which may log queries indefinitely.

Why Cloudflare is the BroadbandSwitch.uk default recommendation

Three reasons. First, speed: 1.1.1.3 is consistently among the fastest public DNS resolvers in the world, with UK response times typically under 10 milliseconds. Second, simplicity: just two numbers to paste. Third, the privacy commitment is the strongest of the major free options.

If you only do one thing from this guide, paste 1.1.1.3 and 1.0.0.3 into your router's DNS settings.

OpenDNS FamilyShield

The OpenDNS FamilyShield DNS numbers

What OpenDNS FamilyShield blocks

• Adult content (a substantial blocklist; reputedly broader than Cloudflare's)
• Phishing sites
• Malware and known malicious domains
• Anonymisers and proxy services (which would otherwise allow bypass)
• Some sex education and LGBTQ resources (a known issue; if these matter to your family, see CleanBrowsing or Cloudflare)

OpenDNS FamilyShield vs OpenDNS Home

Two products, often confused:

• OpenDNS FamilyShield uses preset blocklist categories you cannot customise. No account needed. Free. This is the family-focused service.
• OpenDNS Home requires a free account and lets you customise which categories are blocked, plus see usage reports. More flexible but takes more setup.

For most UK parents starting out, FamilyShield is enough.

Note on coverage

OpenDNS FamilyShield's blocklist has historically been broader than Cloudflare's, which is good for families wanting more protection but occasionally causes false positives (legitimate sites being blocked). If you find a legitimate site is blocked, the OpenDNS dashboard (with a free OpenDNS Home account) lets you whitelist it.

CleanBrowsing Free Family Filter

The CleanBrowsing DNS numbers

CleanBrowsing offers three free tiers. Pick based on what you want to block:

IPv6 (if supported by your router):

What CleanBrowsing Family Filter blocks

• Adult content (extensive blocklist)
• Mixed-adult sites (Reddit, Tumblr and similar where adult content sits alongside general content)
• Proxies and VPN services
• Malware and phishing
• Forces SafeSearch on Google and Bing
• Forces YouTube Restricted Mode

CleanBrowsing's distinctive feature: forced SafeSearch

The thing CleanBrowsing does that Cloudflare and OpenDNS do not, by default, is force SafeSearch on Google and Bing automatically at the DNS level. This catches a category of risk that pure URL filtering misses: a child searching Google for an inappropriate term, then clicking image search results. CleanBrowsing's family filter forces SafeSearch even if the child has tried to turn it off in their browser settings.

This makes CleanBrowsing my recommendation specifically for households with under-13s as the youngest user.

CleanBrowsing premium tiers

For UK families wanting more control, CleanBrowsing also offers paid plans:

• CleanBrowsing Free Plan: £0. The DNS services covered above. No dashboard, no customisation.
• CleanBrowsing Family Plan: $39.99/year (about £32/year). Customise blocklists, add allow/block lists, view activity reports, set time-of-day rules.
• CleanBrowsing Business plans are not relevant to families.

For most UK families the free tier is enough. If you want a dashboard, NextDNS (covered later) is generally a better value upgrade.

Side-by-side DNS comparison

My recommendation by household type

Setting up DNS filtering at router level

The exact menu locations vary by router, but the process is the same on every modern router. Here is the universal walkthrough.

Step 1: Find your router's admin page

1. Connect a device (laptop, phone, tablet) to your home Wi-Fi.
2. Open a web browser.
3. In the address bar, type one of these and press Enter:

• 192.168.1.1 (most common UK ISP routers)
• 192.168.0.1 (some Sky, Virgin and TP-Link routers)
• 192.168.1.254 (BT Smart Hub default)
• 192.168.0.254 (some older BT hubs)
• http://bthomehub.home (BT alternative)
• http://routerlogin.net (Netgear)
• http://tplinkwifi.net (TP-Link)

If none of these work, look on the bottom or back of your router. The admin URL is usually printed on the label.

Step 2: Sign in

1. You will be prompted for an admin username and password.
2. Look on the router label for the default credentials. Often admin / password, or printed unique values per router.
3. If you have changed the admin password and forgotten it, factory-reset the router (small button on the back, hold for 10 seconds with a paperclip). Note: this will reset all your settings, so do this only if you have to.

Step 3: Find DNS settings

The DNS settings location depends on your router brand:

Step 4: Replace the DNS servers

1. You will see fields for "Primary DNS" and "Secondary DNS" (or "DNS 1" and "DNS 2", or similar). They may be filled with your ISP's DNS or set to "automatic".
2. Switch from "automatic" to "manual" or "use these DNS servers" if necessary.
3. For Cloudflare 1.1.1.3 (recommended): enter 1.1.1.3 as primary and 1.0.0.3 as secondary.
4. For OpenDNS FamilyShield: enter 208.67.222.123 and 208.67.220.123.
5. For CleanBrowsing Family Filter: enter 185.228.168.168 and 185.228.169.168.
6. If you have an IPv6 field, also fill in the IPv6 equivalents from earlier in this guide.
7. Click Save or Apply.

Step 5: Restart the router

1. Most routers will prompt you to restart after saving DNS changes. Confirm.
2. If not prompted, restart manually: unplug the router for 30 seconds, plug it back in.
3. Wait 2-3 minutes for the router to fully restart and devices to reconnect.

Step 6: Confirm devices are using the new DNS

Some devices keep using the old DNS until they reconnect. Easy fix: turn Wi-Fi off and back on on each device, or restart the device entirely. After this, every device on your home Wi-Fi is using the new family DNS.

For step-by-step screenshots specific to your router brand, the DNS provider's own website usually has detailed setup guides:

• Cloudflare 1.1.1.1 setup instructions
• OpenDNS setup guides
• CleanBrowsing setup guides

Setting up DNS filtering on individual devices

If for any reason you cannot change the DNS at the router (your ISP locks the router admin, you have a particular device that needs different rules, or you want to extend filtering to mobile data), you can set DNS on individual devices instead. This is more fiddly but useful in specific cases.

iPhone and iPad (iOS 26)

1. Open Settings > Wi-Fi.
2. Tap the (i) info button next to your home Wi-Fi name.
3. Scroll down to DNS.
4. Tap Configure DNS.
5. Switch from Automatic to Manual.
6. Tap Add Server and enter 1.1.1.3, then add a second 1.0.0.3.
7. Save.

For iOS to apply this on mobile data too, install Cloudflare's 1.1.1.1: Faster Internet app from the App Store, or set up a "DNS profile" using Apple's Configuration Profile (advanced).

Android

1. Open Settings > Wi-Fi.
2. Long-press your home Wi-Fi name and select Modify network.
3. Tap Advanced options.
4. Change IP settings from DHCP to Static.
5. Enter the DNS 1 and DNS 2 fields with 1.1.1.3 and 1.0.0.3 (or your chosen alternative).
6. Save.

Android 9+ also has a "Private DNS" feature for global DNS-over-TLS:

1. Open Settings > Network & internet > Private DNS.
2. Select Private DNS provider hostname.
3. Enter family.cloudflare-dns.com for Cloudflare 1.1.1.3 family filter.
4. Save.

This applies on both Wi-Fi and mobile data, which is genuinely useful.

Windows PC

1. Settings > Network & Internet > Wi-Fi (or Ethernet) > Properties.
2. Find DNS server assignment and click Edit.
3. Switch to Manual.
4. Toggle on IPv4 and enter 1.1.1.3 as Preferred and 1.0.0.3 as Alternate.
5. Save.

Mac

1. System Settings > Network > Wi-Fi > Details.
2. Click the DNS tab.
3. Click + and add 1.1.1.3 and 1.0.0.3.
4. Click OK.

Smart TVs, consoles and other devices

Most smart devices (Samsung TVs, LG TVs, PS5, Xbox, Apple TV, Roku) have a Network Settings page where you can manually set DNS. Look in Network > Settings > Advanced > DNS, or similar. Process is the same: switch from Automatic to Manual, enter the DNS numbers, save.

If you have set DNS at the router level (recommended), individual device DNS is not needed; this is for cases where the router approach is unavailable.

How to test your DNS filter is working

It is genuinely worth confirming the filter is active before assuming it is. Each provider has a test URL designed to be blocked by their own filter:

Try the test URL on multiple devices: phone, tablet, console, smart TV. If all of them show the block, your DNS filter is active across the network. If only some are blocked, those devices may be using their own DNS (covered next).

You can also confirm which DNS server your network is using by visiting https://1.1.1.1/help. This shows whether you are connected to Cloudflare's DNS and which protocol (DoH, DoT, plain DNS) you are using.

DNS over HTTPS: the bypass you must address

DoH was created with good intentions (DNS query privacy from your ISP) but has the side effect of breaking router-level family filtering. Here is what to do about it.

Option 1: Disable DoH in each browser

Browsers let you turn DoH off in their settings. This is fiddly but reliable.

Chrome / Edge

1. Open Chrome > Settings > Privacy and security > Security.
2. Find Use secure DNS.
3. Toggle off, OR set to "With your current service provider" so it falls back to system DNS (the router setting).

Firefox

1. Open Firefox > Settings > Privacy & Security.
2. Scroll to DNS over HTTPS.
3. Set to Off (least private, but uses your router DNS).

Safari

1. Safari does not currently use DoH by default in macOS or iOS.
2. If you have added a custom DNS profile, manage it in Settings > General > VPN & Device Management.

Option 2: Use Apple Screen Time / Google Family Link to lock browser settings

The most robust approach is to prevent your child from changing browser settings in the first place. Apple Screen Time has a "Content & Privacy Restrictions" section where you can lock allowed browsers, force Safari to use a managed DNS, and prevent installation of alternative browsers. Google Family Link similarly restricts which browsers a supervised child can install. See the Apple Screen Time guide and the Google Family Link guide.

Option 3: Use a DNS service that supports DoH itself

Cloudflare 1.1.1.3 supports DoH natively. You can configure browsers to use Cloudflare's family DNS over HTTPS, so even when the browser does DoH it goes through your filter. In Firefox, set:

1. Settings > Privacy & Security > DNS over HTTPS > Increased Protection.
2. Choose Custom and enter https://family.cloudflare-dns.com/dns-query.
3. Save.

Repeat for Chrome's secure DNS setting (also supports custom). This way, even DoH-using browsers route through Cloudflare's family filter rather than bypassing it.

Option 4: Block DoH at the router (advanced)

Some routers (Asus AiProtection, OPNsense, pfSense, Firewalla) can block DoH at the network level, forcing all DNS through the router. This is genuinely effective but requires more technical setup. For most UK families, options 1-3 above are simpler.

How children try to bypass DNS filtering

DNS filtering vs ISP filters: do you need both?

This is a question I get asked a lot. The answer depends on your ISP.

For households with the major UK ISPs, you have a choice: rely on the ISP filter (simpler, well-supported, includes time schedules), use free DNS filtering instead (slightly more privacy-respecting, no ISP account dependency), or use both (most protection).

For households with weaker-filtered ISPs, free DNS filtering is essentially the missing layer. It costs nothing and takes ten minutes.

Where DNS filtering fits in the layered approach

DNS filtering is the lightest-touch, lowest-cost member of the layered defence model recommended throughout this BroadbandSwitch.uk series.

DNS filtering is the right place to start for parents who have not yet set anything up: it costs nothing, takes ten minutes, and provides immediate whole-home adult content blocking. Once that is in place, layer the others on top in priority order.

Paid DNS services worth considering (NextDNS)

For UK parents who want more than the free options provide (per-device profiles, activity reports, custom blocklists, time-of-day rules), the standout paid DNS option in 2026 is NextDNS.

I have no financial relationship with NextDNS or any other service mentioned in this guide. Recommendation based on capability, price and policies.

Honest limitations of DNS filtering

DNS filtering is genuinely useful, but it has clear limits. Every UK parent should know these:

• Domain-level only. DNS filters operate at the level of "this site is or is not on the blocklist." They cannot see which specific pages on a site are inappropriate. YouTube as a domain is not adult; specific YouTube videos may be. Reddit as a domain is not adult; specific subreddits are. DNS cannot make this distinction.
• No time scheduling. DNS filtering is on or off; there is no built-in "block social media between 9am and 3pm" capability in the free services. For schedules, use ISP filters, mesh router controls, or paid NextDNS.
• No per-person profiles. All devices on the network get the same rules. For per-child rules use mesh router profiles, device-level controls, or NextDNS.
• No activity reports in free tiers. You cannot see what was blocked or which device tried to access it. For visibility use OpenDNS Home, CleanBrowsing premium, or NextDNS.
• Mobile data bypass. As covered, DNS filtering on the router does not apply when devices switch to mobile data.
• DoH bypass. Modern browsers can bypass router DNS via DoH unless you take specific steps to prevent this.
• Cannot see inside HTTPS. Modern web traffic is encrypted (HTTPS), which means DNS filters see only the domain, not the content of pages. This is a privacy feature of the web, not a DNS limitation, but worth knowing.
• Cannot replace conversation. DNS filtering blocks what is on the blocklist; it does not teach a child to recognise or avoid harmful content they encounter elsewhere.

None of these are reasons not to use DNS filtering. They are reasons to layer it with other tools as recommended throughout this BroadbandSwitch.uk series.

What to do next

A 10-minute action plan:

1. Decide which free DNS service you want. For most UK families, Cloudflare 1.1.1.3 is the right pick.
2. Sign in to your home router admin page.
3. Find the DNS settings.
4. Paste in the chosen DNS numbers (1.1.1.3 primary, 1.0.0.3 secondary).
5. Save and restart the router.
6. Test using a known-blocked URL.
7. If your children use Firefox or Chrome, also check DoH settings and disable or redirect to Cloudflare family DNS.
8. Consider extending DNS filtering to mobile data on each child's phone using Android Private DNS or the Cloudflare 1.1.1.1 iOS app.
9. Layer with: UK ISP filters, router controls, Apple Screen Time / Google Family Link, and in-app safety settings.

Official resources and further reading

DNS provider pages

• Cloudflare 1.1.1.1 for Families
• Cloudflare 1.1.1.1 setup guides
• OpenDNS FamilyShield setup
• CleanBrowsing free filters
• NextDNS (paid alternative with free tier)

UK independent guidance

• Internet Matters: Broadband and mobile parental controls
• UK Safer Internet Centre
• NCSC Cyber Aware: home network security

Related deep-dives in this series

• Complete UK ISP parental controls guide
• Router-level controls for non-technical parents
• Apple Screen Time complete guide
• Google Family Link complete guide

Coming next in this series

8. Age-appropriate conversations with your kids
9. Recognising warning signs
10. Reporting and getting help when something has gone wrong

Helpful video resources

Below are 1 video from authoritative sources that complement this guide. Watch them at any time for additional perspective.