Why Your DNS Filter Works on One Device But Not Another (September 2026) Full Guide

You set up DNS filtering on your router, tested it on your laptop, and felt great about blocking malicious domains. Then you checked your phone and every blocked site loaded anyway. If this sounds familiar, you are not alone. This is one of the most common frustrations people run into with DNS-based content filtering.

The short answer is that DNS filtering works at the network level, but individual devices can override, ignore, or bypass it through their own settings. Browsers, operating systems, and apps increasingly use encrypted DNS connections that route around whatever you configured at the router. Your DNS filter works on one device but not another because not every device on your network plays by the same rules.

In this guide I will walk you through exactly why this happens, the most common culprits, and how to fix each one. I have spent years helping people troubleshoot network filtering issues, and the same handful of problems account for nearly every case. Let us break them down.

What Is DNS Filtering? (Quick Refresher)

DNS filtering is a security method that blocks access to unwanted or dangerous websites by intercepting domain name lookups before they resolve. When you type a website address, your device asks a DNS resolver to translate that name into an IP address. A filtering resolver checks the requested domain against blocklists and category rules. If the domain matches a blocked entry, the resolver refuses to return the IP address and the connection fails.

Think of the DNS resolver as a phone book. Without it, your device cannot find the server hosting the website you want to visit. A filtering resolver acts like a phone book that deliberately leaves out numbers for known scam operations, malware hosts, or content categories you have chosen to block. The request never completes because your device never learns where to connect.

People use DNS filtering for several reasons. Parents use it to block adult content and enforce screen-time boundaries. Businesses use it to stop employees from visiting phishing sites or distracting platforms. Network administrators use it to block known malware command-and-control servers. The appeal is simple: one configuration change at the router or DNS resolver level can protect every device on the network.

That is the theory. In practice, as many people discover, the coverage is rarely as uniform as expected. To understand why, we need to look at how DNS queries actually travel from your devices.

Why Your DNS Filter Works on One Device But Not Another?

Several technical factors explain why your DNS filter works on one device but not another. The root causes fall into four categories: how DNS resolvers identify your network, how devices handle DNS settings, encrypted DNS protocols, and software that overrides your configuration.

Shared Public IP and NAT Mean the Resolver Cannot See Individual Devices

Your router uses Network Address Translation, or NAT, to share a single public IP address across every device on your home or office network. When your phone, laptop, and smart TV all make DNS queries, those queries leave your network from the same public IP. The DNS resolver on the other end has no way to tell which specific device made which request.

This matters because DNS filtering services often apply policies based on the source IP address. If you set up filtering by telling your resolver provider to filter your home IP, that filtering applies to your entire network equally. The resolver cannot distinguish between your work laptop and your kid’s tablet. It sees one network, not individual devices.

This is why DNS filtering is described as network-wide protection. It is a blanket approach. When it works, every device benefits. When a device bypasses it, the bypass is also invisible to the resolver because the device simply sends its queries somewhere else.

DNS Is Stateless

The DNS protocol is stateless, meaning each query is independent. The resolver does not maintain a session or remember which device asked for what. Every DNS request is a fresh lookup with no memory of previous requests or the device that originated them.

This statelessness is a design feature that makes DNS fast and reliable. But it also means the resolver cannot track patterns, build device profiles, or enforce different rules per device based on history. A filtering resolver can only check the current domain against its blocklist and respond. It cannot say “this query came from a child’s device, so apply stricter rules.”

If you want per-device policies, you need a solution that operates closer to the devices themselves. We will cover those options later in this guide.

Devices Can Override Router DNS Settings

This is where most filtering gaps appear. When you configure DNS on your router, you are setting the default DNS servers that the router hands out via DHCP to devices that join your network. But DHCP is a suggestion, not a command. Devices are free to ignore it.

Many modern operating systems and applications do exactly that. Android and iOS both support Private DNS settings that route queries to a different resolver entirely, ignoring whatever the router specified. Windows and macOS let users manually configure DNS per network adapter. Browsers like Chrome and Firefox have their own internal DNS resolvers that can bypass system DNS entirely.

Here is a quick breakdown of how different platforms handle DNS:

Android: Since Android 9, the operating system supports Private DNS, which uses DNS over TLS by default on many devices. If a user or app has configured a Private DNS provider, those queries go directly to that provider, completely bypassing your router’s DNS settings. This is the single most common reason DNS filtering works on a computer but not an Android phone.

iOS: Apple devices support encrypted DNS through configuration profiles and, since iOS 14, through native DNS over HTTPS and DNS over TLS support. If a VPN app or configuration profile is installed, it may include its own DNS settings that override your network configuration. Safari on iOS also supports DoH independently.

Windows: Windows respects router DHCP DNS by default, but users can manually set DNS on any network adapter. Windows 11 also supports DoH natively for compatible resolvers. If a user has enabled DoH in Windows settings or installed a browser using DoH, those queries bypass your filtering resolver.

macOS: Similar to iOS, macOS supports encrypted DNS through configuration profiles and native DoH in Safari. Users can also manually override DNS in Network preferences for any interface.

DNS over HTTPS and DNS over TLS Bypass Filtering

This deserves its own focus because it is the biggest hidden culprit. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries and send them directly to a resolver over a secure connection. They were designed to improve privacy by preventing ISPs and network operators from seeing or modifying DNS queries.

The privacy benefit is real, but the side effect is that DoH and DoT completely bypass any DNS filtering you have set up at the router or network level. Your filtering resolver never sees the query because it is encrypted and sent to a completely different server.

This is not an edge case. Major browsers enable DoH by default or encourage users to turn it on. Chrome prompts users to enable secure DNS. Firefox enables DoH by default in the United States. Microsoft Edge supports it as well. Mobile apps increasingly use DoH internally for their own DNS queries, meaning even if your device’s system DNS is filtered, individual apps may route around it.

Forum discussions on Reddit’s r/pihole and r/sysadmin repeatedly highlight this issue. Users report that their Pi-hole or router-based DNS filter catches queries from some devices but lets others through entirely. The explanation is almost always DoH or DoT running on the device or inside a specific app.

VPNs and Mobile Data Bypass Home DNS Entirely

When a device connects to a VPN, all its traffic, including DNS queries, tunnels through the VPN server. Your home router’s DNS settings become irrelevant because the device is effectively on a different network. The VPN provider’s DNS resolver handles all lookups.

The same applies to mobile data. When your phone switches from Wi-Fi to cellular, it leaves your filtered network entirely. Cellular DNS queries go to your carrier’s default resolvers unless you have configured device-level DNS filtering that travels with the device.

This is a frequent complaint from parents who set up filtering at home and then discover it stops working the moment their child leaves the house on a cellular connection. Router-level DNS filtering only works while the device is on that specific network.

The Most Common Culprits (Checklist)

If your DNS filter works on one device but not another, run through this checklist. These are the issues I see most often, ranked by frequency.

1. Private DNS is enabled on Android. Go to Settings, then Network and Internet, then Private DNS. If it is set to a custom provider or automatic, all DNS queries bypass your router. Set it to Off or to your filtering resolver’s hostname.

2. Browser-level DoH is active. Check Chrome settings under Privacy and security, then Security, then Use secure DNS. In Firefox, look under Settings, then Network Settings, then Enable DNS over HTTPS. Disable these or point them at your filtering resolver if it supports DoH.

3. A VPN app is running. Any active VPN tunnels all DNS through the VPN provider. Disconnect the VPN or configure DNS filtering inside the VPN profile itself.

4. Manual DNS is set on the device. Check network adapter settings on Windows, Network preferences on macOS, or Wi-Fi settings on mobile. If someone manually entered 8.8.8.8 or 1.1.1.1 directly on the device, that overrides whatever your router is handing out.

5. Smart TVs and IoT devices use hardcoded DNS. Many smart TVs, streaming sticks, and IoT devices ignore DHCP DNS entirely and use hardcoded Google or Cloudflare DNS. Some devices offer DNS settings in their own menus. Others require you to block port 53 traffic at the firewall to force compliance.

6. Multiple DNS filters are conflicting. If you have both a router-level filter and a device-level filter app running, they can conflict. One may override the other or cause DNS resolution failures. Pick one method per device.

7. The device switched to mobile data. Check whether the device is still on Wi-Fi. Cellular connections bypass home DNS filtering completely.

Step-by-Step Troubleshooting Guide

Now let us walk through a systematic troubleshooting process. Follow these steps in order and you will identify the problem in most cases.

Step 1: Verify your DNS filter is actually working. On a device where filtering seems to work, visit a test domain that should be blocked. If the block page loads, your filtering resolver is functioning. If nothing blocks on any device, the problem is with your resolver configuration, not individual devices.

Step 2: Check what DNS server the problem device is using. On Windows, open Command Prompt and run nslookup. The first line of output shows the default server your device is querying. On macOS and Linux, the same command works. On Android, use a DNS lookup app or check the Private DNS setting. On iOS, check for installed configuration profiles under Settings, then General, then VPN and Device Management.

If the resolver address does not match your filtering resolver, you have found the bypass. The device is sending its queries elsewhere.

Step 3: Disable encrypted DNS on the device.

On Android, go to Settings, then Network and Internet, then Private DNS, and select Off. Test again.

On iOS, remove any DNS configuration profiles and disable DoH in Safari if applicable. Go to Settings, then General, then VPN and Device Management to check for profiles.

On Windows 11, go to Settings, then Network and Internet, then Wi-Fi or Ethernet, then DNS server assignment, then Edit. Check whether DoH is enabled for your DNS servers.

On macOS, check for configuration profiles in System Settings, then Privacy and Security. Disable DoH in Safari through Safari preferences.

Step 4: Disable browser-level DoH. Open your browser settings and search for secure DNS or DNS over HTTPS. Turn it off or configure it to use your filtering resolver. Do this for every browser on the device, since each browser manages DoH independently.

Step 5: Disconnect any VPNs. Turn off all VPN apps and test again. If filtering starts working, the VPN was tunneling DNS elsewhere. You will need to either keep the VPN off or configure DNS filtering within the VPN.

Step 6: Flush the DNS cache. After making changes, clear the local DNS cache so stale entries do not interfere. On Windows, run ipconfig /flushdns in Command Prompt. On macOS, run sudo dscacheutil -flushcache followed by sudo killall -HUP mDNSResponder in Terminal. On Android, toggle airplane mode on and off. On iOS, toggle airplane mode or restart the device.

Step 7: Test with a different network. If possible, connect the device to a mobile hotspot with known DNS settings. This helps you determine whether the problem is the device or your home network configuration.

How to Get True Per-Device DNS Filtering

If you need different filtering rules for different devices, router-level DNS alone will not cut it. Here are the approaches that actually work for per-device enforcement.

Use a roaming client or agent. Some DNS filtering providers offer software agents that install on each device and enforce filtering regardless of which network the device connects to. The agent captures DNS queries locally and sends them to your filtering resolver, even over cellular data or foreign Wi-Fi. This is the approach used by enterprise filtering solutions and some parental control services.

Set up a local DNS filter with per-device rules. Solutions like Pi-hole or AdGuard Home run on your local network and can apply different blocklists to different devices based on IP address or MAC address. You configure your router to hand out the Pi-hole address as the DNS server, then create device groups with different filtering policies. This works well but still requires that devices actually use the Pi-hole as their resolver.

Force DNS at the firewall. For devices that stubbornly ignore your DNS settings, you can configure your router or firewall to block all outbound DNS traffic except traffic destined for your filtering resolver. This means even if a device tries to query 8.8.8.8 directly, the firewall drops the request. The device has no choice but to use your resolver. This is the most reliable method for IoT devices and smart TVs with hardcoded DNS.

Use MDM for managed devices. In business or school environments, Mobile Device Management platforms can push DNS configuration profiles that enforce specific resolvers and prevent users from changing them. This works well for organization-owned devices that you manage directly.

FAQs

Conclusion

Understanding why your DNS filter works on one device but not another comes down to recognizing that DNS filtering is a network-level tool that individual devices can override. NAT hides your devices from the resolver. Encrypted DNS protocols like DoH and DoT send queries to entirely different servers. VPNs and mobile data move devices off your filtered network entirely. And some devices simply ignore DHCP DNS in favor of hardcoded or manually configured resolvers.

The good news is that every one of these issues has a fix. Start by checking for Private DNS on Android, browser-level DoH, active VPNs, and manually configured DNS settings on the problem device. If you need per-device enforcement, consider a local DNS filter like Pi-hole with device-specific rules, or configure your firewall to force all DNS traffic through your filtering resolver.

Take it one device at a time, run through the troubleshooting steps, and you will have consistent filtering across your entire network. The key is knowing where to look, and now you do.