DNS Security for Home Users: One Setting That Blocks Scam Sites

Almost every scam starts the same way: you click something, and your device looks up a domain name. Before a single byte of the fake login page loads, your device asks a DNS resolver, "what is the IP address for this domain?" If that resolver simply refuses to answer for known phishing and malware domains, the attack ends there — no antivirus scan, no warning banner, nothing to click through.

That is what encrypted, filtered DNS gives you. It is one of the highest-impact security changes an ordinary household can make, it is free, and it takes about ten minutes to set up across every device in the home.

What DNS Actually Does

DNS, the Domain Name System, is the phone book of the internet. Humans use names like example.com; the network routes on numbers like 93.184.216.34. Every app on every device performs dozens of these lookups per minute.

By default, those lookups go to whatever resolver your internet provider assigned when your router connected. That has two consequences most people never think about.

Your Provider Sees Every Domain You Visit

Traditional DNS queries travel in plain text. Your ISP — and anyone on the same network — can see the name of every site, app server, and streaming service your devices contact, even when the site itself uses HTTPS. In several countries this browsing metadata is legally sold to advertisers.

Your Resolver Answers for Malicious Domains Too

The default resolver is neutral. If a phishing kit is hosted at a lookalike domain registered forty minutes ago, your resolver will happily return its address.

What Filtered DNS Changes

A filtering resolver checks each requested domain against constantly updated threat feeds. If the domain is a known phishing site, malware command-and-control server, or scam storefront, the resolver returns nothing or a block page. The connection never happens.

Because filtering happens at the network layer, it protects every device and every app — smart TVs, games consoles, IoT gadgets, and your relatives' phones on the guest network — not just browsers where you installed an extension.

Choosing a Resolver

• Quad9 (9.9.9.9) — a Swiss non-profit. Blocks malicious domains using threat intelligence from multiple security vendors, keeps no personal logs, and requires zero configuration. The best default for most families.
• Cloudflare (1.1.1.1 for privacy, 1.1.1.2 for malware blocking, 1.1.1.3 to also block adult content) — extremely fast, audited privacy policy, three tiers depending on how much filtering you want.
• NextDNS — a configurable service with a free tier of 300,000 queries per month. You choose which blocklists to apply, see a live log of what each device requested, and can set different rules for a child's tablet than for your work laptop.
• AdGuard DNS — blocks advertising and tracking domains in addition to malware, which noticeably speeds up page loading on mobile.

Avoid unknown "free VPN DNS" services. A resolver sees every domain you request; that is a position of enormous trust.

How to Set It Up

Option 1: At the Router (Protects Everything)

1. Open your router's admin page, usually 192.168.1.1 or 192.168.0.1.
2. Log in. If you never changed the admin password from the sticker, change it now.
3. Find WAN, Internet, or DHCP settings and look for DNS servers.
4. Switch from "obtain automatically" to manual and enter two addresses, for example 9.9.9.9 and 149.112.112.112.
5. Save and reboot the router.

Every device that joins the Wi-Fi now inherits the filtered resolver. Note that some phones override this with their own private DNS setting, so pair this with the device-level step below.

Option 2: On Each Device (Encrypted, Works Everywhere)

Device-level configuration uses DNS over HTTPS or DNS over TLS, which encrypts the lookup so it cannot be read or tampered with on public Wi-Fi.

• Android: Settings, Network and internet, Private DNS, choose "Private DNS provider hostname" and enter dns.quad9.net or your NextDNS hostname.
• iPhone and iPad: install the configuration profile offered by Quad9, Cloudflare, or NextDNS, then approve it in Settings, General, VPN and Device Management.
• Windows 11: Settings, Network and internet, your adapter, DNS server assignment, Edit, Manual, enter the addresses and set DNS over HTTPS to On.
• macOS: System Settings, Network, Details, DNS, add the servers. For encryption, install the provider's profile.
• Browsers: Chrome and Firefox both have a "secure DNS" setting that overrides the system. Set it to match your chosen provider so behaviour is consistent.

Warning Signs That Your DNS Has Been Tampered With

• Certificate warnings on sites that normally load fine.
• Search results redirecting to unfamiliar search engines.
• Advertising appearing on sites that do not usually show ads, across multiple devices.
• Your router's DNS fields containing addresses you did not enter. Router DNS hijacking is a real and common attack against devices with default admin passwords.

What Filtered DNS Will Not Do

Being honest about limits matters. Filtered DNS does not stop a scam that arrives as a phone call, does not stop you from typing your password into a phishing page hosted on a brand-new domain the feeds have not caught yet, and does not encrypt your traffic the way a VPN does. It also cannot inspect content once a connection is allowed.

It is a layer, not a shield. Its value is that it is cheap, silent, and catches a meaningful share of attacks before they ever render on screen.

If Something Is Already Blocked That You Need

1. Check the block page — most resolvers explain the category that triggered it.
2. If you use NextDNS or AdGuard, add the domain to your personal allowlist rather than disabling filtering entirely.
3. If a whole category is over-blocking, step down a tier: Cloudflare 1.1.1.2 blocks malware only, without the content filtering of 1.1.1.3.
4. Never disable filtering to reach a site that a resolver flagged as phishing. That warning is usually right.

The Bottom Line

Changing your DNS is the rare security step that costs nothing, slows nothing down, and protects every device on your network at once. Set Quad9 or Cloudflare at the router for whole-home coverage, add encrypted private DNS on each phone so protection follows you onto public Wi-Fi, and change your router admin password while you are in there. Ten minutes of work, and a large share of scam domains simply stop resolving.