What is DNS in simple terms?
People type names such as example.com. Computers connect using numbers, called IP addresses. DNS (Domain Name System) is the service that translates one into the other, like a phone book that turns a name into a number.
You do not see this step, but it happens before almost everything you open: a web page, a chat app, a video. Each of them first asks a DNS server, "what is the address of this name?" and only then connects.
How does a DNS lookup work?
In short:
- You open a site or an app asks for a server, for example
example.com. - The phone asks its DNS server for that name's address. This server is called the resolver.
- If the resolver does not know the answer, it asks other DNS servers on the internet until it finds the authoritative one, then remembers the result for a while.
- The resolver replies with an address, and your phone connects to it.
The resolver your phone uses is not fixed. By default it is the one your network gives you, usually your internet provider's or your router's. You can point the phone at a different one.
Why can DNS filtering block ads, trackers and sites?
Step 2 is where the filter sits. A filtering resolver holds lists of names, for example ad servers, trackers, phishing sites or adult sites. When your phone asks for a name on a list, the resolver does not return the real address. It returns a "blocked" answer, and the connection does not start.
EZOBLOCKER works this way, with one difference in where it runs. It catches your phone's DNS lookups with a local tunnel, sends them encrypted to its own servers and blocks the categories you switched on there, before the ad or the page loads. The lookups are the only thing sent to the servers: your pages, messages and videos do not go through them. More on the encryption in what is DNS over HTTPS.
Because the decision is made per name, filtering is quick to apply to a whole phone: the same lists cover the browser and the apps that use those names.
What can DNS filtering not do?
DNS filtering works on names, not on content. That has limits you should know about:
- Same-name content. If an ad is served from the same name as the video or the post around it, blocking the name would break the content too. YouTube video ads, sponsored posts in social apps and some in-game ads fall in this group.
- Pages inside an allowed site. DNS cannot see which page or file you open on a site, only the site's name.
- Names not on the list. A new or unlisted site is not blocked until it is added.
- Phones set to another resolver. If Android's Private DNS holds a hostname, or an app uses its own DNS, those lookups skip the filter. See how to set Private DNS on Android.
The full list is on what DNS cannot block. Knowing the limits keeps expectations realistic.
What is the difference between a DNS server and a DNS changer?
The DNS server (resolver) is the service that answers lookups. A DNS changer is a tool that makes your phone use a different resolver than the default. EZOBLOCKER is a DNS changer in this sense, and it adds category filtering on its own servers. You can also choose a public provider inside it, as explained in the family DNS servers reference. The DNS changer page shows how it fits together.
How do I know which DNS my phone uses?
On a computer, tools such as nslookup show the resolver in use. On a phone the simplest check is functional: open EZOBLOCKER's protection check. If a category address is blocked while the control address loads, your lookups are passing through the filter.
Protection also helps with privacy because unencrypted DNS can be read by whoever runs the network you are on. Our blocklists show the categories and how often they refresh.