SkieOSSafe browsing for students: filtering, safe search and DNS explained
Safe browsing needs layers: enforce safe search in the browser, filter at the DNS level, block alternative browsers that ignore the rules, and stop students changing any of it. No single layer is enough on its own.
Layer 1: safe search, enforced
Safe search filters explicit results. On a managed device it should be switched on by policy, so a student cannot turn it off in settings.
Layer 2: DNS filtering
DNS filtering blocks categories of sites when the device looks them up, so unsuitable sites fail to load in any browser or app that uses the system's DNS. Locking the device's DNS settings stops students switching to an unfiltered provider.
Layer 3: control other browsers
Some browsers have their own secure-DNS feature that bypasses system filtering. A managed device should allow only approved browsers and enforce the rules in them.
Layer 4: stop the workarounds
- Block VPN setup
- Block private DNS changes
- Block installing certificates
- Block installing unapproved browsers or proxy apps
Limits to be honest about
Filtering is not perfect. Categories can miss new sites, and school networks sometimes block filtering ports. Combine technology with supervision and education.
Frequently asked questions
Can we turn the browser off completely?
Yes. Browser access can be off, restricted or allowed per group.
Does filtering work in every app?
DNS filtering covers apps that use the system's DNS. Some apps use their own, which is why app allow lists matter too.
Can students change safe search?
Not when it is enforced by device policy.