SkieCan an app use its own DNS over HTTPS to bypass the filter?
Only allowed apps run on a managed device, and Chrome's secure DNS is turned off, so the main routes are closed. Alternative browsers, VPN apps and DNS changer apps are never allowed, and installs outside the allow list are removed. Admins choose the apps, so they choose the risk.
Some apps and browsers resolve names through their own encrypted DNS, which sidesteps the system setting. Firefox and Brave do it, as does Chrome in its default state. It is a real concern for any filter that works at DNS.
Skie deals with it by controlling what can run. Chrome's secure DNS is off by device owner rule, so Chrome follows the filtered system DNS. More than 50 alternative browsers are always blocked. VPN, proxy and DNS changer apps are never allowed. Everything else on the device is an app that the organisation put on the group's list, and all apps come from Google Play.
The install guard removes silently any app that is installed after enrolment and not allowed. Unknown sources are blocked, and developer options and adb are off, so a package cannot arrive from outside.
That leaves the apps you chose. Before you add an app to a list, treat it like any other approval: check what it does and whether it has an embedded browser or its own network settings. The organisation app store has a draft stage and Publish step, and own apps wait for Skie approval, so there is a natural place for a review.
If you are unsure about a particular app, trial it on a pilot group with the filter on, and test it against a site that should be blocked. If it gets through, report it. That is the sort of case the team wants to hear about.