DNS filtering and IPv6: close the gap that skips your filter
The filter is set on the router, the test laptop shows the block page, and yet some phones open everything. For the IT lead, provider or librarian who has seen this, the cause is very often IPv6: the router hands out a second set of DNS servers, and devices use those instead.
What happens now
The router gives devices your filter's IPv4 address and the internet provider's IPv6 DNS servers. Devices that prefer IPv6 ask the provider and get unfiltered answers.
What you want
Every DNS server a device receives, on IPv4 and IPv6, is the filter, and other DNS traffic leaving the network is blocked.
Why IPv6 lets lookups skip a DNS filter
IPv6 is switched on by default on many home and business connections. Four details of how it works explain the gap.
Two ways to hand out DNS
On IPv6, routers announce DNS servers in their router advertisements or through DHCPv6, separately from the IPv4 settings you changed.
Provider defaults
Many provider-supplied routers announce the provider's own IPv6 DNS servers unless told otherwise.
Devices prefer IPv6
Modern systems try IPv6 first when it works, so the provider's IPv6 servers can win over your IPv4 filter.
Two kinds of lookup
Every name can be asked for an IPv4 and an IPv6 address. A filter that blocks only one of them leaves the other route open.
A filter that blocks a name for IPv4 and IPv6 alike
Our managed DNS filter gives a blocked site a blocked answer whether the device asks for its IPv4 or its IPv6 address. Once the router stops handing out other DNS servers, the same rules hold on every device, whichever protocol it prefers.
- Blocked names get an empty IPv6 answer as well as the IPv4 block.
- Router steps in the dashboard send DNS only to the filter.
- Public encrypted DNS services are blocked so devices cannot switch resolvers.
Check which DNS servers a device really uses
Run this on a device that is not being filtered, while it is on the network in question. It takes a minute and settles the question.
Windows
In Command Prompt, list the network settings and read every "DNS Servers" line:
ipconfig /allThen ask for a blocked site's IPv6 address:
nslookup -type=AAAA example.comMac
In Terminal, list the resolvers the system uses:
scutil --dnsThen check the same blocked site:
nslookup -type=AAAA example.comHow to read it: if any DNS server listed is not your filter, for example an IPv6 address starting with your provider's prefix, that device can skip the filter. If the IPv6 lookup of a blocked site returns a real address, the gap is open.
Four router fixes, from best to last resort
Pick the first fix your router supports. Most business routers and firewalls offer at least the first two.
Point IPv6 DNS at the filter
If your filter offers IPv6 addresses, enter them as the IPv6 DNS servers the router announces. Devices then reach the filter on both protocols.
- Look for "IPv6 DNS", "RA DNS" or "DHCPv6 DNS" in the router
Stop announcing IPv6 DNS
If the filter is IPv4 only, tell the router not to announce any IPv6 DNS servers. Devices fall back to the IPv4 filter for lookups while IPv6 traffic keeps flowing.
- Often an option to disable "RDNSS" or "DNS in router advertisements"
Block other DNS on the firewall
Allow outgoing DNS on port 53 only to the filter, on IPv4 and IPv6, and block port 853 for encrypted DNS. Devices with hard-coded DNS then fail over to the filter.
Turn IPv6 off on the LAN
It closes the gap but can slow some services and causes support questions later. Use it only when the router offers none of the options above.
Five popular sites whose blocks depend on every lookup reaching the filter
Real rows from our data. Many large sites answer on both IPv4 and IPv6, so if IPv6 lookups skip the filter, each of these switches stops working on the devices concerned.
| Site | Categories in our data | Switch that should block it |
|---|---|---|
| facebook.com | Social Networking | Social Networking |
| disneyplus.com | Streaming Media | Streaming Media |
| expressvpn.com | VPN / Proxy / Anonymizers | VPN / Proxy / Anonymizers |
| bet365.com | Gambling, Sports & Recreation | Gambling |
| pokerstars.com | Gambling | Gambling |
How different devices pick up IPv6 DNS
Devices do not all behave the same way, which is why a gap can show on phones and not on laptops. The general pattern:
| Device | Takes DNS from router advertisements | What it means for the filter |
|---|---|---|
| Windows 10 and 11 | Yes, alongside DHCPv6 | Shows IPv6 DNS servers in ipconfig /all; check after every router change |
| Mac, iPhone and iPad | Yes | Prefers IPv6 when it works, so the gap shows quickly |
| Android phones and tablets | Yes; DHCPv6 addresses are not used | Announcement settings matter most; DHCPv6 DNS alone will not reach these devices |
| Smart TVs and streaming sticks | Varies by maker | Some ignore the network's DNS entirely; the firewall rule on port 53 is the safety net |
| Game consoles | Usually yes, with manual DNS available | Leave them on automatic so they follow the router |
Because Android devices take their DNS servers from router advertisements, a router that only offers a DHCPv6 DNS setting can leave phones unfiltered. Check the advertisement settings as well.
Where to find the setting on common kinds of router
Menu names differ, but the setting usually lives in one of these places.
| Router type | Where to look | What to change |
|---|---|---|
| Provider-supplied home or office router | Network or LAN settings, an IPv6 tab | Set IPv6 DNS to the filter, or disable DNS announcements; if neither exists, ask the provider or add your own router behind it |
| Business router or firewall | DHCPv6 server and router advertisement settings per interface | Announce the filter's IPv6 addresses, or announce no DNS servers |
| Mesh Wi-Fi systems | Advanced network or IPv6 settings in the app | Custom IPv6 DNS, or IPv6 off for the LAN if the app offers nothing else |
| Firewall rules on any of these | Outbound or WAN rules | Allow port 53 only to the filter on both protocols; block port 853 |
Prove the gap is closed: a five-step test
Repeat this after every router change, and once more after the next firmware update, which sometimes resets IPv6 settings.
- 1
Reconnect a test device
Turn Wi-Fi off and on, or restart the device, so it picks up the new settings.
- 2
List its DNS servers
Run
ipconfig /allorscutil --dns. Only the filter should appear. - 3
Look up a blocked site twice
Run
nslookup example.comandnslookup -type=AAAA example.com. Both answers should be blocked. - 4
Open it in a browser
The block page, or a certificate warning that leads to it, should appear. Clear the browser's DNS cache first.
- 5
Try a phone on the same network
Phones are the devices most likely to prefer IPv6. If the phone is blocked too, the gap is closed.
How the managed filter deals with the bypasses next to IPv6
Public encrypted DNS services and the browser settings that switch to them are blocked by default, and the dashboard gives router steps for sending DNS only to the filter and blocking port 853. Devices that leave the building keep the rules through a private encrypted link.
Three misunderstandings about IPv6 and filtering
Each of these leads people to the wrong fix.
"We don't use IPv6"
If the provider enabled it on the router, every modern device on the network uses it, whether anyone chose to or not.
"The filter is broken"
The filter answers correctly; it is simply not being asked. The fix is on the router, not in the filter's settings.
"Turn IPv6 off everywhere"
It works, but it is a blunt fix. Controlling which DNS servers are announced closes the gap and leaves the network modern.
IPv6 is one of several ways around a DNS filter. Encrypted DNS in browsers is another; see DNS over HTTPS and web filtering, and for VPN apps how to block VPN apps.
Closing the IPv6 gap by hand, or with the managed DNS filter
The router work is the same; what differs is everything around it.
| Task | Any DNS filter, by hand | Managed DNS filter |
|---|---|---|
| Blocking IPv6 lookups of blocked sites | Check that your filter answers both kinds | Blocked for IPv4 and IPv6 alike |
| Router steps | Search forums for your model | Steps in the dashboard for sending DNS only to the filter |
| Encrypted DNS in browsers | Set browser policies on every device | Public encrypted DNS services blocked by default |
| Spotting a device that skips the filter | Notice missing lookups yourself | Activity per network shows what reaches the filter |
| Devices away from the network | Not covered | Private encrypted link with the same rules |
DNS filtering and IPv6: frequently asked questions
Why does my DNS filter not work on some devices?
A common reason is IPv6. Many routers hand out IPv6 DNS servers from the internet provider next to the IPv4 filter address. Devices that prefer IPv6 then send lookups to the provider's servers and skip the filter.
How do I see which DNS servers a device uses?
On Windows run ipconfig /all and read the DNS Servers lines. On a Mac run scutil --dns in Terminal. If any listed server is not your filter, including an IPv6 address, the device can skip the filter.
Should I turn off IPv6 to make DNS filtering work?
Usually not. Turning off only the IPv6 DNS servers the router advertises, or pointing them at the filter, closes the gap while IPv6 itself keeps working.
Does a DNS filter need to block IPv6 addresses too?
It needs to answer both kinds of lookup. A blocked site must get an empty answer for its IPv6 address as well as its IPv4 address, otherwise a device can still reach it over IPv6.
Does the managed DNS filter handle IPv6 lookups?
Yes. Blocked names receive a blocked answer for both IPv4 and IPv6 lookups. The router still has to stop handing out other IPv6 DNS servers, which the steps on this page cover.
How can I test whether IPv6 bypasses my filter?
On a filtered device, look up a site that should be blocked with nslookup, once normally and once with -type=AAAA. Both answers should be blocked, and the Server line should show your filter.
The managed DNS filter costs $99 a month for one site, and networks with several sites share one quote. A pilot on a network with IPv6 switched on is the quickest way to see the rules hold on every device.
One filter, every lookup, both protocols
Tell us which routers you run and whether IPv6 is on. We will set up a pilot and walk your team through the router settings that close the gap.
Windows is a trademark of Microsoft Corporation. Mac, iPhone and iPad are trademarks of Apple Inc. Android is a trademark of Google LLC. They are named here only to identify the systems discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by these companies.