SkieWhich web filter does Skie use by default and what is the fallback?
Organisations without their own filter get CleanBrowsing Family by default, with a fallback host if the first cannot be reached. An organisation or group filter overrides the default. The default is on from the first day, so a new group is filtered before anyone chooses anything.
A filter that is off until an admin turns it on leaves a gap in every first week. Skie avoids that by giving every organisation a default filtering DNS. The default is CleanBrowsing Family, which filters adult content and enforces safe search on supported engines.
A fallback host exists alongside it. If the primary filtering address cannot be reached, the device can use the fallback so that browsing keeps working and stays filtered, rather than failing open or dropping offline. The detail of the switch is handled on the device, and an admin does not need to manage it.
Defaults are replaced by choice. If an organisation or a group picks a different filter from the list the owner curates, that selection overrides the default for the devices in scope. Rules flow down from organisation to school, branch and group, and the most specific level applies last.
Honest limits: a DNS filter can only block by domain and category. It sees domain lookups, not page content, and it does not provide per-website allow or block lists yet. For the finer cases, the Chrome safe-sites filter and SafeSearch add page-level checks, and Skie's app lists control the rest.
Practical tip: the effective policy view for a group shows which filter is active and where it came from. Check it after a restructure, because moving a group under a different school can change the inherited filter.