SkieCan a student turn off the web filter on a Skie device?
No. The filter is the device's Private DNS, set by the device owner, and the Private DNS setting is blocked. If a change were somehow made, Skie re-applies the protection, and the compliance read-back shows the device if it differs. Chrome's own secure DNS is off too.
On a normal Android phone the user can open network settings, find Private DNS and type in another provider. That would take the filter out of the path in seconds. On a Skie device, that option is not available.
The filter is set through the device owner as the system's DNS. The Private DNS setting in Android is blocked, and so are VPN setup, network reset and mobile network settings, which are other places someone might look. Installing certificates is blocked too. If something changes the protection, Skie re-applies it, which also covers the 'Reset all settings' route within seconds.
The browser side is closed as well. Chrome's secure DNS is turned off so Chrome uses the system filter, and incognito, alternative browsers, VPN apps, proxy apps and DNS changer apps are not available.
How would you know? After every apply the device reads each protection back from Android and reports a compliance score, and a missing or altered filter is reported. The breach centre shows it at device, group, branch, school and organisation level.
One honest condition: on a network that blocks the encrypted DNS port, the device uses the network's DNS and the dashboard flags it. That is a network condition, not something the student did. Use the network check wizard to see which of your networks behave that way.