DNS filtering: block known risky domains without calling it antivirus
Choose a filtering resolver, set it in the appropriate device configuration and understand encrypted DNS and bypass limits.
In brief
DNS resolves a website name to its network address. A filtering resolver can refuse domains it classifies as malicious, but a regular privacy-focused resolver is not automatically a malware filter.
This can add a layer of protection against known bad destinations without installing an extension that reads every webpage.
Choose the right endpoint
For example, Cloudflare’s malware-filtering Families resolver uses 1.1.1.2 and 1.0.0.2 for the documented IPv4 configuration. Android’s Private DNS field instead uses the supported hostname security.cloudflare-dns.com. These formats belong to different settings; do not paste an IP into a hostname-only field.
Check which devices use the rule
A router setting can cover clients that use its DNS, but a browser’s separate encrypted-DNS setting or a VPN may use another resolver. Confirm coverage on the device you care about. A successful router change is not proof that every app’s queries follow it.
Handle mistakes without disabling protection everywhere
Use the provider’s false-positive reporting route if a legitimate domain is blocked. Record the old setting for a narrow rollback test. Keep normal updates, phishing checks and account protection in place; DNS filtering is one layer, not a replacement for them.
Before you act
Filtering cannot detect every new domain, remove downloaded malware or stop every connection using a direct IP. Encrypted DNS protects the query path; it is not a VPN for all traffic.
What to do next
- Choose the resolver’s actual filtering product and read its data policy.
- Record the existing setting, then apply the supported device or router configuration.
- Test ordinary sites and the provider’s benign category test, restoring the prior setting if legitimate services fail.
