Block Ads Inside Apps with a Locked Private DNS

The browser and SafeGuard's controls (see closing in-app browsers) handle browsing itself. But to cut ads and add a broad safety net against unsafe sites — system-wide, in every app and not just one browser — your phone has a second layer you can use: Private DNS.

You need a filtering DNS — and good ones are free

A plain DNS just translates domain names into addresses; on its own it blocks nothing. The ad and content blocking comes from the resolver you choose. Android has a built-in Private DNS setting (DNS over TLS) — point it at a filtering resolver and it works across the whole device. Several solid ones are free:

• AdGuard DNS (dns.adguard-dns.com) — blocks ads and trackers device-wide; a “Family” variant also blocks adult content.
• NextDNS (your-id.dns.nextdns.io) — a free tier with fully customizable blocklists for ads, trackers and whole categories.
• Cloudflare for Families (family.cloudflare-dns.com) — blocks malware, and optionally adult content.
• Quad9, CleanBrowsing and FamilyGuard — other free security- and family-focused resolvers.

Whichever you pick, the benefit is immediate and system-wide:

• Blocks ads inside apps and on the web by refusing to resolve known ad and tracker domains — across the whole device, not just one browser.
• Filters adult and unsafe sites at the DNS level as a broad backstop.
• No latency and no battery cost. Unlike a VPN, Private DNS doesn't route your traffic through an external server — it only changes how domain names are resolved. Pages can actually feel faster with fewer ads to load.

You set it under Settings → Network & internet → Private DNS, where you enter your provider's hostname.

The catch — and how SafeGuard fixes it

The problem is that anyone can switch Private DNS back to “Automatic” in a few seconds. Fine for convenience, useless for accountability.

That is where SafeGuard comes in. Running as a Device Owner, it locks the Private DNS option so it can't be changed or turned off. SafeGuard doesn't run a DNS service itself — you choose the filtering provider; SafeGuard just makes sure the setting stays put. See how Device Owner lockdown works.