The challenge for schools
A school network carries hundreds of devices with very different owners: school-managed laptops, shared classroom computers, staff devices and often pupils' own phones on a guest network. Pupils are curious and resourceful, and staff time for IT is limited. Requirements for content filtering may come from local regulation, the school's own safeguarding policy or both. [VERIFY: applicable filtering requirements in your country]
DNS filtering is a practical foundation because it covers every device on the network without installing anything, and because it is simple enough for a small IT team to manage.
What to filter
Most schools start with a combination of security and content filters:
- Malware and phishing protection for all devices
- Newly registered domain blocking to catch fresh scam sites
- Adult content and gambling blocked on pupil networks
- Social media blocked or allowed depending on age group and policy
- A custom blocklist for specific sites or games that disrupt lessons
Keeping learning resources open
Over-blocking frustrates teachers and pupils and leads to workarounds. When a lesson resource is caught by a filter, the query log shows exactly which domain was blocked and why, and the allowlist makes it available to the whole network in seconds. Building a short allowlist during the first weeks of term avoids most interruptions later.
Separate rules for staff and pupils
Staff often need broader access than pupils. The simplest way to achieve this is to separate staff and pupil traffic onto different networks with different public IP addresses, each registered with its own settings. [VERIFY: how many IP addresses and settings profiles an account supports] Guest and bring-your-own-device networks can be handled the same way.
Preventing bypasses
Pupils share tips for getting around filters quickly. Block outbound DNS to any server other than FirewallDNS at the school firewall, restrict VPN applications on managed devices, and use device management policies to stop browsers from using their own encrypted DNS resolvers. These measures, together with supervision, make DNS filtering far more robust.
Logs, privacy and safeguarding
Query logs help staff troubleshoot and spot problems such as an infected device. Because pupils' browsing is personal data, treat logs carefully: restrict who can view them, follow your school's data protection policy and tell pupils and parents that filtering and logging are in place. Our security and GDPR pages describe how FirewallDNS stores and protects log data. [VERIFY: retention settings available to schools]
A start-of-term checklist
Before term starts, confirm that every school network hands out the FirewallDNS resolver through DHCP and that outbound DNS to other servers is blocked. Test a pupil device and a staff device on each network. Ask teachers for the websites and platforms they plan to use this term and check them against the query log. Prepare a simple process for teachers to request an exception, and decide who on staff can approve and make allowlist changes. Finally, update your acceptable use policy and privacy notice to reflect DNS filtering and logging.
Working with your IT provider
Many schools rely on an external IT provider. FirewallDNS supports the MSP model, so your provider can manage your settings, apply their standard baseline and invoice you directly, while the school sees its own logs and cost.
Measuring whether filtering works
Review blocked categories and security blocks monthly. Falling numbers of malware blocks after cleaning devices, few teacher exception requests and no evidence of bypasses are good signs. Rising requests suggest rules are too strict for teaching needs and should be reviewed with staff.
Homework devices at home
School-issued laptops often go home with pupils. At home they use the family's internet connection and DNS, so the school's network filtering no longer applies. If filtering must follow the device, you will need device-level controls such as managed browser policies or, where available, a per-device encrypted DNS address. [VERIFY: per-device DoH/DoT availability] Parents can also add home filtering with their own router.
Explain these differences to parents in your device agreement so expectations are clear.
Not a complete safeguarding solution
DNS filtering decides which domains can be reached. It does not monitor what pupils type, see inside allowed apps or detect bullying. Schools with safeguarding monitoring obligations will usually need additional tools and processes. DNS filtering is the network-wide foundation those tools build on.