SkieWhy does Skie block the Private DNS setting on managed devices?
Android's Private DNS setting lets a user pick a different encrypted DNS provider, which would send lookups around the school filter. Skie blocks it with the config private DNS restriction, on by default. Filtering DNS stays locked on the device, so it applies on any Wi-Fi or mobile data.
Private DNS arrived in Android 9, and Android 10 added a way for device owners to restrict it. A user enters a hostname, and from then on the device sends its name lookups to that provider. If a student enters one that does not filter, the web filter is bypassed for apps and browsers alike.
Skie sets DISALLOW_CONFIG_PRIVATE_DNS as the device owner, so the Private DNS screen cannot be changed. Skie applies the filtering DNS itself, locked on the device. The default filter for organisations without their own is CleanBrowsing Family, and an organisation or group can choose a different one from the list that the owner curates.
This entry is about the setting itself. Filtering, the network check wizard and bypass reporting are covered by other writers in this knowledge base, so we keep to the protection here. You will see Private DNS in the hardening section as a switch that is on by default and in the compliance read-back after every apply.
One condition to know: some networks block the encrypted DNS port. In that case the device uses the network's own DNS, and the dashboard flags it so you can act on it.
Practical tip: before term starts, run the network check wizard on your school network. It tells you if the encrypted DNS port is open, and saves a support call on the first morning.