Block Ads Inside Apps with a Locked Private DNS on Android

On-device filtering (see blocking in-app WebViews) handles precise, per-type rules. But to strip ads inside apps and add a broad safety net against unsafe sites — system-wide, not just in one browser — you can stack a second, complementary layer: Private DNS.

What Private DNS does

Android has a built-in Private DNS setting (DNS over TLS). Point it at a filtering resolver such as FamilyGuard and the benefits are immediate:

• Blocks ads inside apps and on the web by refusing to resolve known ad and tracker domains — across the whole device, not just one browser.
• Filters adult and unsafe sites at the network-name level as a broad backstop.
• No latency and no battery cost. Unlike a VPN, Private DNS does not tunnel your traffic — it only changes how domain names are looked up. Pages can actually feel faster with fewer ads to load.

To set it manually:

Settings
  > Network and internet
    > Private DNS
      > Private DNS provider hostname
        Enter your provider, for example: dns.familyguard.example

The catch — and how SafeGuard fixes it

The problem with the manual setting is that anyone can switch it back to “Automatic” in a few seconds. That is fine for convenience, useless for accountability.