Android has a setting that blocks known porn sites in every browser and every app at once, in about two minutes. There is nothing to install and nothing to pay.
It's called Private DNS. Below: how to turn it on, which address to choose and, most important, what this kind of filter does not catch. Without that part it's easy to believe you're fully covered when you aren't.
How it works
When you open a website, your phone first asks a server where that site lives. Normally that's your internet provider's server. Private DNS lets you pick a different one: a "family" server. For known porn addresses it answers "no such site," and the page simply doesn't load.
The setting exists from Android 9 on. It works on mobile data and on Wi‑Fi, in any browser.
Which address to enter
All four services are free. You enter a hostname: no "https://", no spaces.
family-filter-dns.cleanbrowsing.org— CleanBrowsing Family. Blocks porn and mixed-content sites such as Reddit, plus proxy and VPN sites; enforces SafeSearch on Google, Bing and YouTube. The strictest of the four.adult-filter-dns.cleanbrowsing.org— CleanBrowsing Adult. Blocks porn but leaves Reddit and proxy sites alone; enforces SafeSearch on Google and Bing.family.cloudflare-dns.com— Cloudflare for Families. Blocks porn and malware.family.adguard-dns.com— AdGuard Family. Blocks porn, ads and trackers, and turns on SafeSearch where it's supported.
If you're not sure, take CleanBrowsing Family: it's the strictest. If you need Reddit, take CleanBrowsing Adult.
How to turn it on
- Open Settings and look for "Private DNS" (the settings search works). It's usually under Network & internet → Private DNS. On Android 9: Network & internet → Advanced → Private DNS. On Samsung phones: Connections → More connection settings → Private DNS.
- Choose "Private DNS provider hostname".
- Type the hostname you picked, for example
family-filter-dns.cleanbrowsing.org. - Tap Save.
Menu names vary by manufacturer and Android version, so search for "Private DNS" rather than following the path blindly.
To check that it works, open any well-known porn site in your browser: the page should fail to load, while ordinary sites open as before. If the internet stops working completely, there's most likely a typo in the hostname: go back and look for stray letters or spaces.
What this filter does not catch
This part matters more than all the rest. An address-level filter is a good first line, but it is not complete protection.
- It sees the address, not the content. If porn sits on an ordinary site that the filter doesn't treat as a porn site (social networks, messengers, forums), it won't be caught.
- It only knows what's on its lists. A brand-new site may open until it gets added.
- It's a setting, not a lock. It protects well against accidental visits and impulsive taps, but it's built for a weak moment no better than any other phone setting. For self-control you need a second layer where changing your mind takes more than a couple of seconds: a delay, or another person involved.
What to add on top
To catch what an address filter can't see, you need a second layer: an app that reads the address and text of the page you have open and closes it if it's porn. Such an app catches sites that aren't on any list, and short-video feeds too. There are several apps like this; one of them is KarosGuard (free on Google Play), which we make. It walks you through turning on the same Private DNS, and it can also notify a person you trust and lock your settings for up to 14 days. The app is young and sometimes closes a page it shouldn't: the block screen has a "Report an error" button.
Where these addresses come from
The addresses and descriptions come from the services' own pages: CleanBrowsing, Cloudflare and AdGuard. We're not affiliated with any of them. On October 11, 2026 we checked with DNS queries that all four refuse to return well-known porn sites while ordinary sites resolve as before. Services can change their terms, so look at their pages before you set it up.
Frequently asked questions
Will Private DNS slow down my internet?
Usually you won't notice: it's one quick address lookup before a page loads. If sites start opening noticeably slower, try another address from the list.
Do I need to install anything?
No. The setting is built into Android from version 9.
Does it work on mobile data and on Wi‑Fi?
Yes. The setting belongs to the phone, not to a particular network.
What if the internet stops working after I enter the hostname?
Most likely there's a typo: it must be entered without "https://" and without spaces. Go back to Private DNS, choose "Automatic", which brings the internet back, and enter the hostname again.
Can the service see which sites I open?
It receives the address lookups from your phone, the same way your provider's server used to. So pick a service whose privacy rules you're comfortable with, and read them on the service's website.
Can I protect the whole home Wi‑Fi the same way?
Yes: the same filter can be set in your router's settings and will then cover every device at home. Routers take numeric addresses instead of a hostname. For CleanBrowsing Family they are 185.228.168.168 and 185.228.169.168; for Cloudflare for Families, 1.1.1.3 and 1.0.0.3.
Is this suitable for a child?
This guide is for adults who want to protect themselves. For children, parental controls such as Google Family Link are a better fit.
