{"id":8339,"date":"2022-05-02T13:01:05","date_gmt":"2022-05-02T18:01:05","guid":{"rendered":"https:\/\/tcn.tidbits.com\/?p=9158"},"modified":"2022-05-02T15:14:13","modified_gmt":"2022-05-02T20:14:13","slug":"block-malicious-and-adult-web-sites-with-dns-filtering","status":"publish","type":"post","link":"https:\/\/www.macworks.com\/blog\/block-malicious-and-adult-web-sites-with-dns-filtering\/","title":{"rendered":"Block Malicious and Adult Web Sites with DNS Filtering"},"content":{"rendered":"<p>One of the best ways to keep malware from infecting your computers is to avoid visiting websites designed to do just that. No one intentionally visits loadmetogetinfected.com, but malware authors employ all sorts of tricks to lure unsuspecting users into viewing malicious sites. Various tools can help, but the easiest free technique is called <i>DNS filtering<\/i>.<\/p>\n<p>DNS, which is short for Domain Name System, is the Internet technology that maps human-readable computer names like www.apple.com to the numeric IP address of Apple\u2019s server, 17.254.0.91. Every time you click a link to visit a new Web page, your Mac queries a DNS server to learn the IP address associated with the domain name embedded in the link\u2014it all happens seamlessly and instantaneously in the background.<\/p>\n<p>Typically, your Mac will automatically use the DNS servers specified by your Internet service provider. However, you can change your DNS servers manually, and one good reason to do so is to take advantage of DNS servers that look at your Mac\u2019s DNS requests and refuse to resolve names associated with malicious sites. Such DNS filtering is great since it protects you from malicious sites without you having to do anything special. Such sites simply won\u2019t load at all.<\/p>\n<p>One more thing. DNS filtering can also block porn sites. That\u2019s helpful if you want to avoid accidentally loading adult content or to ensure that those in your office don\u2019t, in order to reduce the chances of a sexual harassment complaint. As with malicious sites, filtered adult sites just won\u2019t load.<\/p>\n<p>Setting up DNS filtering is easy. All you have to do is replace your current DNS server addresses with the IP address of a particular public DNS service\u2014the steps are later in this article. The two providers we recommend are <a href=\"https:\/\/www.quad9.net\/\" target=\"_blank\" rel=\"noopener\">Quad9<\/a> and <a href=\"https:\/\/blog.cloudflare.com\/introducing-1-1-1-1-for-families\/\" target=\"_blank\" rel=\"noopener\">Cloudflare<\/a>, both of which are free and run by reputable companies. Of the two, Quad9 is more focused on user privacy, but Cloudflare offers additional DNS filtering capabilities that may be useful.<\/p>\n<p>The options are:<\/p>\n<ul>\n<li><b>Quad9 malware blocking:<\/b> 9.9.9.9 with a secondary of 149.112.112.112<\/li>\n<li><b>Cloudflare malware-only blocking:<\/b> 1.1.1.2 with a secondary of 1.0.0.2<\/li>\n<li><b>Cloudflare malware and adult content blocking:<\/b> 1.1.1.3 with a secondary of 1.0.0.3<\/li>\n<\/ul>\n<p>You should always enter the secondary DNS server in case the primary server goes down. Otherwise, you wouldn\u2019t be able to connect to any sites at all.<\/p>\n<p>However, don\u2019t mix in other DNS servers. If you use Cloudflare\u2019s adult content filter as your primary DNS server with your ISP\u2019s DNS server as a secondary, when Cloudflare refuses to resolve an adult site, macOS will drop down to the secondary ISP server, which will resolve it happily, thus eliminating the utility of the Cloudflare\u2019s filtering.<\/p>\n<p>One final note before you get started. Apple\u2019s <a href=\"https:\/\/support.apple.com\/en-us\/HT212614\" target=\"_blank\" rel=\"noopener\">iCloud Private Relay<\/a> service (in beta in macOS 12 Monterey, iOS 15, and iPadOS 15) sends all your traffic through two proxy servers, which prevents DNS filters like Quad9 and Cloudflare from working. That\u2019s unfortunate since iCloud Private Relay is a useful way to hide your IP address and browsing activity from your network provider and the websites you visit. Apple is clear about this limitation, noting in its various DNS server interfaces:<\/p>\n<blockquote><p><i>DNS requests are being routed by iCloud Private Relay for this network. Turn off Private Relay to manually configure DNS settings.<\/i><\/p><\/blockquote>\n<p>If you need to turn off iCloud Private Relay on the Mac, open System Preferences &gt; Apple ID and deselect the checkbox next to Private Relay. On an iPhone or iPad, open Settings &gt; <i>Your Name<\/i> &gt; iCloud &gt; Private Relay and flip the switch to Off.<\/p>\n<h3>Set Up DNS Filtering in macOS<\/h3>\n<p>To use DNS filtering on the Mac, follow these steps, which should work in any version of macOS. We\u2019re using Quad9 as the example here, but replace the primary and secondary IP addresses as desired if you want to use one of the Cloudflare filters.<\/p>\n<ol>\n<li>Open System Preferences &gt; Network, and select the adapter you use (likely Wi-Fi or Ethernet) in the sidebar.<\/li>\n<li>Click the Advanced button, and in the sheet that appears, click DNS.<\/li>\n<li>Click the <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9166 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering.png\" alt=\"\" width=\"18\" height=\"16\" \/> button under the DNS Servers list and enter <code>9.9.9.9<\/code>.<\/li>\n<li>Click the <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9166 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering.png\" alt=\"\" width=\"18\" height=\"16\" \/> button again and enter <code>149.112.112.112<\/code>.<\/li>\n<li>Click OK to dismiss the Advanced preferences, and click Apply.<\/li>\n<li>Close the Network preference pane.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\" wp-image-9164 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-1.png\" alt=\"\" width=\"608\" height=\"575\" \/><\/li>\n<\/ol>\n<p>It\u2019s difficult to perform a real-world test to tell if Quad9 or Cloudflare\u2019s malware blockers are active since there\u2019s no way to know which sites they block. However, Quad9 provides a test page at <a href=\"https:\/\/on.quad9.net\/\" target=\"_blank\" rel=\"noopener\">on.quad9.net<\/a> that should help. If you use Cloudflare\u2019s adult content filter, you can tell if it\u2019s working because your Web browser will refuse to load adult sites.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-9162\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-2.png\" alt=\"\" width=\"603\" height=\"204\" \/><\/p>\n<h3>Set Up DNS Filtering in iOS and iPadOS<\/h3>\n<p>The steps for setting up DNS filtering in iOS and iPadOS are a bit different. For this example, we\u2019ll use the Cloudflare malware filter, but again, you should replace the IP addresses below with the filter you want to use.<\/p>\n<ol>\n<li>Open Settings &gt; Wi-Fi and tap the <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9165 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-3.png\" alt=\"\" width=\"16\" height=\"16\" \/> button next to your current Wi-Fi network.<\/li>\n<li>Scroll down and tap Configure DNS, which is probably set to Automatic.<\/li>\n<li>On the Configure DNS screen, tap Manual.<\/li>\n<li>In the list of DNS servers, tap the red delete <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9161 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-4.png\" alt=\"\" width=\"16\" height=\"16\" \/> buttons next to any entries there.<\/li>\n<li>Tap the green Add Server <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9160 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-5.png\" alt=\"\" width=\"16\" height=\"16\" \/> button and enter <code>1.1.1.2<\/code>.<\/li>\n<li>Tap the green Add Server <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-9160 alignnone\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-5.png\" alt=\"\" width=\"16\" height=\"16\" \/> button again and enter <code>1.0.0.2<\/code>.<\/li>\n<li>Tap Save in the upper-right corner.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-9163\" src=\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2022\/05\/block-malicious-and-adult-web-sites-with-dns-filtering-1.jpg\" alt=\"\" width=\"960\" height=\"600\" \/><\/li>\n<\/ol>\n<p>That\u2019s it! You should have no trouble using either Quad9 or Cloudflare, but if you need to revert to your previous DNS servers, it\u2019s easy to do. On the Mac, just delete the manual entries you created\u2014macOS will automatically use the DNS servers provided by your ISP. On an iPhone or iPad, select Automatic in the Configure DNS screen to replace the manually entered DNS servers with those from your ISP. In either case, if you\u2019re not going to use DNS filters, it\u2019s worth turning on iCloud Private Relay. We hope that Apple adds DNS filtering options to iCloud Private Relay so you could additionally choose to filter out malicious sites and adult content.<\/p>\n<p>(Featured image by iStock.com\/Funtap)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DNS filtering is a simple way to protect yourself from malicious websites. All you have to do is configure a DNS server setting to ensure that you never accidentally load a malicious site. <\/p>\n","protected":false},"author":2,"featured_media":8340,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,69,106,112,185,7,104],"tags":[],"class_list":["post-8339","post","type-post","status-publish","format-standard","has-post-thumbnail","category-apple","category-apple-consulting-ct","category-apple-support-ct","category-mac-support-ct","category-mactech","category-networking","category-security"],"_links":{"self":[{"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/posts\/8339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/comments?post=8339"}],"version-history":[{"count":1,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/posts\/8339\/revisions"}],"predecessor-version":[{"id":8343,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/posts\/8339\/revisions\/8343"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/media\/8340"}],"wp:attachment":[{"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/media?parent=8339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/categories?post=8339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.macworks.com\/blog\/wp-json\/wp\/v2\/tags?post=8339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}