Before you trust OpenDNS with your family's safety, you should know exactly where its walls end. Modern software bypasses DNS filtering in at least four ways — not through any fault of yours, but because the internet has been moving away from plain DNS for years. This is the honest map of the gaps.
DNS filtering has one structural rule: it can only judge the lookups it can see. If a program asks a different server, asks in an encrypted way, or does not ask at all, OpenDNS never gets a vote. None of this makes OpenDNS useless — it still stops the everyday phishing link, the typo'd domain and the casual blocked-category visit on ordinary devices. But a determined teenager, or simply a modern browser with factory settings, can pass through it. Here are the four gaps, in the order you are most likely to meet them.
Chrome, Edge and Firefox all offer Secure DNS (DNS over HTTPS), and Chrome may turn it on automatically. With it on, the browser sends its lookups, encrypted, to a provider like Google or Cloudflare — your router's OpenDNS settings are simply never consulted for web browsing in that browser. This is the single most common reason "OpenDNS works on my PC but not in Chrome". The partial fixes: in each browser's privacy settings, set Secure DNS to use the current service provider (that is, your network DNS) or switch it off on family devices; on a PC you manage, this takes a minute per browser. You cannot change it on a device you do not control — a guest's phone keeps its own rules, and that is a fair limit to accept.
A VPN app wraps all traffic, DNS included, in a tunnel to a server elsewhere. Your network sees only the tunnel; OpenDNS sees nothing. Free VPN apps are common among teenagers precisely because they defeat school and home filters, and no DNS service can stop them — the honest counter is a conversation and device-level rules, not a better DNS address. Separately, some apps hardcode their own DNS (8.8.8.8 is the classic) and ignore whatever the network offers. Advanced routers and firewalls can block outbound port 53 except to your chosen resolver, which forces most hardcoded apps back into line — but a growing number now use encrypted DNS on port 443, which is indistinguishable from normal web traffic. Know that this is an arms race with no clean finish line.
If your ISP gives your home an IPv6 connection, devices hold two roads to the internet. Set OpenDNS only on IPv4 and many devices will quietly prefer the unguarded IPv6 road. The fixes are to also point your router's IPv6 DNS at OpenDNS (its published IPv6 resolver addresses are 2620:119:35::35 and 2620:119:53::53) or, if your router makes that awkward, disable IPv6 on the router for a simple IPv4-only home network. And the gap no setting can close: the moment a phone leaves Wi-Fi for mobile data, your home filter no longer exists for it. Home DNS protects a place, not a person — for protection that travels, you need on-device tools, which are a different product category entirely.
The video shows the full OpenDNS setup. A filter with honest limits, set up properly, beats a perfect-sounding one set up wrong.
▶️ Watch Full VideoPartly, for casual use: Family Shield and the dashboard can block the proxy and anonymizer category, which stops many VPN websites and some VPN services from being reached by name. But a VPN app already installed, connecting to its servers by address or through encrypted DNS, is beyond what any DNS filter can reliably stop.
Because Secure DNS is a per-browser setting. One browser may be using your network DNS while another has its own secure DNS provider switched on. Check each browser's privacy settings and align them with your network choice.
No. Seatbelts can be unbuckled too; the question is what a protection stops in ordinary use. OpenDNS silently blocks phishing and malware domains and whole risky categories for every device on your Wi-Fi, for free. Its limits argue for adding layers where the stakes are high, not for skipping a free layer that works.