Make the home network enforce the rule.

Choose the resolver model

Generic router recipe

1. Log into the router as administrator.
2. Change the router admin password. Do not let the daily user know it.
3. Set WAN or DHCP DNS to the filtering resolver.
4. If the router has separate LAN DHCP DNS settings, set those too.
5. Set IPv6 DNS or disable IPv6 only if you understand the tradeoff and cannot secure it.
6. Turn off guest networks you do not use.
7. Apply equivalent DNS rules to every guest network, VLAN, SSID, and child network.
8. Create a firewall rule to block or redirect outbound DNS to any resolver except your chosen resolver.
9. Block outbound TCP port 853 if you are not intentionally using DNS-over-TLS.
10. Disable UPnP if it is not needed.
11. Save a backup of the router configuration with the trusted person.
12. Run the DNS section of Test your setup.

UniFi checklist

UniFi menus change across Network app versions. Use this as a checklist rather than exact button text.

1. Open UniFi Network.
2. Set DNS servers on the WAN/network/DHCP settings for the client network.
3. Check whether IPv6 is enabled and set IPv6 DNS where applicable.
4. Create traffic or firewall rules that block client DNS to external resolvers on TCP/UDP port 53, except your chosen resolver.
5. Block TCP port 853 to prevent DNS-over-TLS unless you intentionally use it.
6. Apply rules to each LAN, guest network, VLAN, and Wi-Fi network.
7. Use Traffic & Firewall Rules to block known VPN, proxy, or Tor categories if the feature is available and accurate enough for your use case.
8. Have the trusted person control the UniFi console account, local admin account, cloud account, recovery email, and backup codes.
9. Test from a client using nslookup example.com 1.1.1.1. If it answers, DNS interception/blocking is incomplete.

OpenWrt checklist

1. Open LuCI.
2. Go to Network -> DHCP and DNS and set DNS forwardings or DHCP option DNS to the filtering resolver or local resolver.
3. Go to Network -> Firewall -> Port Forwards.
4. Add a redirect for LAN TCP/UDP port 53 to your router or local DNS server.
5. Repeat for IPv6 where your configuration requires it.
6. Add a traffic rule to reject outbound TCP port 853 if you are not using DNS-over-TLS.
7. Apply the same logic to guest zones and VLANs.
8. Keep root password and SSH keys with the trusted person if this is lockout.
9. Back up the config and store it with the trusted person.

pfSense / OPNsense checklist

1. Enable the DNS Resolver or DNS Forwarder/Unbound path you intend to use.
2. Configure upstream filtering DNS or resolver behavior.
3. Create NAT port-forward rules to capture client DNS requests on TCP/UDP port 53 and send them to the firewall or local resolver.
4. Place pass rules above block rules where required by your firewall platform.
5. Block external client DNS where you do not redirect it.
6. Block TCP port 853 unless you intentionally provide DNS-over-TLS through the firewall.
7. Apply rules to every internal interface: LAN, guest, VLANs, Wi-Fi, and lab networks.
8. Have the trusted person control admin credentials, config backups, and recovery.
9. Test from each interface with direct DNS queries to known external resolvers.

Consumer router checklist: Eero, ASUS, TP-Link, Netgear, Google/Nest Wi-Fi, Xfinity, ISP routers

Pi-hole and AdGuard Home notes

1. Install the resolver on a reliable device that stays on.
2. Set the resolver's upstream DNS to the filtering provider or filtering rules you trust.
3. Set router DHCP DNS to the local resolver.
4. Block or redirect client DNS that tries to skip the local resolver.
5. Protect the admin UI with a password the trusted person controls.
6. Keep the server login, SSH keys, container dashboard, and update path away from the daily user if this is lockout.
7. Use allowlists carefully. Overblocking can break school, work, banking, authentication, updates, and messaging.
8. Back up the resolver config and blocklists.

Router and firewall references