Set Up DNS Filtering to Block Malicious Sites

The Problem

Every time you open a site, your device asks a DNS resolver to turn the name into an address. By default that resolver is your ISP's, it answers every question truthfully, and it does so in plain text that anyone on the path can read.

Swap it for a filtering resolver and one setting does a lot of work: known phishing, malware, and scam domains simply fail to resolve. The malicious link in an email loads nothing. The ad network serving malvertising is never reached. It applies to every browser and every app, not just the one with an extension installed — and on the router, to every device in the house including the ones you cannot install anything on.

This is not a replacement for antivirus. It is a cheap, near-invisible layer that removes a large slice of everyday risk before anything downloads.

Already redirected to strange search pages? Fix the cause first — remove a browser hijacker and search redirect — then set filtering as the follow-up.

Choosing a Resolver

| Provider | Filtering addresses | Blocks | |---|---|---| | Cloudflare for Families | 1.1.1.2 / 1.0.0.2 | Malware | | Cloudflare for Families | 1.1.1.3 / 1.0.0.3 | Malware and adult content | | Quad9 | 9.9.9.9 / 149.112.112.112 | Malware and phishing | | OpenDNS Family Shield | 208.67.222.123 / 208.67.220.123 | Malware and adult content | | AdGuard DNS | 94.140.14.14 / 94.140.15.15 | Malware and ads/trackers |

All are free for home use. Quad9 is the most conservative choice if you want threat blocking with minimal chance of breaking a legitimate site. AdGuard blocks the most and is correspondingly more likely to need an exception.

For per-device policies and reporting, NextDNS and Control D offer free tiers with a dashboard — useful if you want to see what is being blocked and by which device.

The Fix: Step-by-Step

Step 1: Set It on Windows 11 With Encryption On

Doing this on one PC first lets you test before changing the whole house.

Windows + I → Network & internet → Wi-Fi (or Ethernet) → click the connection name.
DNS server assignment → Edit → switch Automatic (DHCP) to Manual.
Turn on IPv4. Enter your chosen preferred and alternate addresses.
Set DNS over HTTPS to On (automatic template) for both.
If your network uses IPv6, turn on IPv6 too and enter that provider's IPv6 addresses — otherwise Windows may resolve over IPv6 and bypass your filtering entirely.
Save.

Step 5 is the one people miss, and it silently defeats the whole exercise on a modern ISP connection.

DNS over HTTPS matters here: without it, your queries travel in plain text and can be read or rewritten in transit. See how to change DNS servers for more on the mechanics.

Step 2: Confirm It Is Actually Being Used

Open Terminal and run:

Resolve-DnsName -Name example.com -Type A

Then test the filter itself by visiting the provider's test page — Cloudflare has one at malware.testcategory.com, Quad9 at test.quad9.net. A blocked result means filtering is live.

Also check edge://settings/privacy or chrome://settings/security — if the browser has its own Secure DNS setting pointing elsewhere, it overrides your Windows setting. Set it to "use the operating system's" or to the same provider.

Step 3: Set It on the Router So Every Device Is Covered

Once one PC is working, move it to the router — that covers phones, tablets, TVs, consoles, and smart-home devices that cannot be configured individually.

Sign in to the router: usually 192.168.0.1 or 192.168.1.1. If you have never changed the admin password, do that now — secure your home Wi-Fi router.
Find DNS settings, usually under Internet, WAN, or DHCP.
Enter your primary and secondary filtering addresses.
If the router has an IPv6 section, set it there too, or disable IPv6 if you do not need it.
Save and reboot the router.

Then set your PC back to Automatic (DHCP) so it inherits from the router — unless you specifically want the PC on a different policy.

Step 4: Verify From Another Device

On a phone connected to Wi-Fi (with mobile data off), open the provider's test page. If it blocks, the router change is working for everything on the network.

Devices hold DNS caches, so restart anything that seems to be ignoring the change, or flush from Windows with:

ipconfig /flushdns

Step 5: Deal With Devices That Ignore Your Router

Some devices hardcode their own DNS servers — many smart TVs, Chromecasts, and IoT gadgets ask 8.8.8.8 directly regardless of what your router says.

If your router supports it, add a firewall rule redirecting or blocking outbound port 53 to anything other than your chosen resolver. On routers that do not, the practical answer is to isolate those devices instead: set up a guest network to isolate smart home devices.

Step 6: Handle False Positives Properly

Occasionally a site you need will be blocked. Before you disable filtering:

Confirm it is the DNS filter — the block page usually says which provider blocked it.
Check whether the site is genuinely compromised: how to check if a website is safe.
If it is a false positive, use the provider's allowlist (NextDNS, Control D, and OpenDNS accounts support this) or report it to them.

Do not turn filtering off for one site. That is trading a permanent defence for a temporary convenience.

Step 7: Layer It, Do Not Rely on It

DNS filtering blocks known bad domains. It does nothing about a brand-new phishing domain registered an hour ago, a malicious file on a legitimate host, or an attachment in email.

Pair it with Smart App Control and SmartScreen, a reputable ad blocker, and the habits in spot and avoid phishing emails.

What Not to Do

Do not set only IPv4 on an IPv6-capable connection. Traffic will quietly resolve over IPv6 and skip the filter.
Do not use a random "fast DNS" list from a forum. A DNS resolver sees every domain you visit; the operator matters more than the latency.
Do not treat DNS filtering as parental control on its own. Determined users switch DNS on their own device or use mobile data. Combine with account-level controls.
Do not forget the router admin password. A router with default credentials undoes everything here — anyone on the network can change the DNS back.

FAQ

Will DNS filtering slow down my internet?

No — usually the opposite. Cloudflare and Quad9 typically resolve faster than a default ISP resolver, and blocking ad and tracker domains means fewer requests per page. Any difference is milliseconds.

Does this replace an ad blocker?

Partly. DNS filtering blocks requests to ad and tracker domains network-wide, which helps every device. It cannot hide the empty space left behind or block ads served from the same domain as the content, which is why a browser ad blocker still adds value on the PC.

Can my ISP still see what sites I visit?

DNS over HTTPS hides your queries from the ISP, but the connection itself still reveals the destination server through SNI and IP address. DNS encryption is a meaningful privacy improvement, not full anonymity — a VPN addresses a different part of the problem: set up a VPN on Windows 11.

Is Quad9 or Cloudflare better?

Both are good. Quad9 blocks malware and phishing with a conservative list and a strong privacy policy. Cloudflare's 1.1.1.2 is comparable and slightly faster in many regions. Choose either; the difference is small next to the benefit of using one at all.

Will this break anything on my network?

Rarely. The usual issues are captive portals on public Wi-Fi (which need normal DNS to sign in) and occasional false positives on small sites. Both are handled with an allowlist or by temporarily reverting on that one network.

Should I set this on the router or on each device?

Router first — it covers everything including devices you cannot configure. Per-device settings are useful when you want a stricter policy on a child's laptop, or filtering that follows a laptop onto other networks.

Still Not Working?

If the test page does not block, something is overriding your setting: a browser's own secure-DNS provider, a VPN with its own resolver, IPv6 resolving unfiltered, or a device with hardcoded DNS. Check in that order. If DNS stops resolving entirely, see DNS server not responding and DNS_PROBE_FINISHED_NO_INTERNET.