Web filtering for schools: DNS filters, KCSIE and your options

Why schools have web filters

Schools and colleges in England have a statutory duty to keep children safe online as well as offline. Keeping Children Safe in Education (KCSIE) 2026, in force from 1 September 2026, expects governing bodies and proprietors to make sure appropriate filtering and monitoring systems are in place. The Department for Education's filtering and monitoring standards, last updated on 16 September 2026, set out what that looks like in practice.

The DfE draws a clear line between the two jobs:

• Filtering is preventative. It protects users from reaching illegal, inappropriate and potentially harmful content by blocking web links and digital content, which the DfE now says includes AI-generated content.
• Monitoring is reactive. It reviews what users do on devices, sometimes records it, and raises reports or alerts. Monitoring does not block anything.

A web filter is therefore one half of the requirement. It sits alongside classroom supervision, a monitoring approach, the curriculum and the school's safeguarding policies. The detail of what "appropriate" means is set out in the DfE standards and the UK Safer Internet Centre's definition, which our sister site covers in its guide to appropriate filtering for schools.

Web filtering also has a cyber security job. The same lookups that lead pupils to unsuitable sites can lead staff to phishing pages or let malware reach its control servers. That is why the strongest school set-ups combine content filtering with blocking of known-malicious domains, the core of DNS security.

What the 2026 guidance asks of a school filter

The DfE standards are short, but they are specific. For filtering, they expect a school or college to:

• name a member of the senior leadership team and a governor responsible for filtering and monitoring
• review provision at least once every academic year, and again after a safeguarding incident or a change such as remote access, BYOD, new devices, generative AI tools or network changes
• avoid one blanket profile: as a minimum, separate student and staff profiles
• implement the Internet Watch Foundation (IWF) and Counter-Terrorism Internet Referral Unit (CTIRU) blocklists so that no one, including system administrators, can disable them, and use a provider that is an IWF member and signed up to CTIRU
• filter school-managed devices when they are taken off site, BYOD devices and guests, with devices the school does not manage on a separate virtual network
• check with the provider that the filter covers every internet feed, including backup connections and portable Wi-Fi devices
• check with the provider that it blocks ways round the filter, such as VPNs, proxy services and end-to-end encryption methods
• use safe search locked into the browser, and be able to identify the device or IP address, the user where possible, the time and the search term or content blocked
• check that filtering works and record each check: when, who, what was tested and what was done

These standards apply to schools and colleges in England; schools in Wales, Scotland and Northern Ireland should also check their own government's guidance.

The UK Safer Internet Centre's appropriate filtering definition adds the system features schools should look for. Three matter most for DNS filters:

• Circumvention. It names VPNs, proxy services, DNS over HTTPS and ECH as techniques a filter should identify and manage.
• Deployment. It lists on-device, network-level, cloud and DNS filtering, and warns that relying solely on network-level filters may become increasingly challenging and less effective, so schools might combine network filtering with configuration on school-owned devices.
• Contextual content filtering. It describes analysing content by meaning and context, rather than relying solely on website categories or domain lists, so harmful content can be caught inside otherwise permitted platforms.

The DfE adds that schools should consider whether they need a solution that can handle real-time, dynamic, personalised and AI-generated content, and that no filtering system can be 100% effective, which is why it asks schools to understand their filter's coverage and limitations. The UK Safer Internet Centre also publishes filtering providers' responses to its definitions and runs an accreditation process for filtering providers, both worth checking when you compare products.

Our sister site keeps the full breakdown of the DfE filtering and monitoring standards; the rest of this page looks at how a DNS filter fits them.

What a DNS filter covers well, and what it does not

A DNS filter checks each domain a device looks up and refuses to answer for domains in blocked categories. Because every app, browser and background service looks up names first, it covers far more than the web browser. It is the approach used by Cisco Umbrella, Cisco Secure Access DNS Defense and DNSFilter, and it is why DNS filtering is popular in education.

None of this makes DNS filtering a poor choice. It is fast to deploy, light to run, covers every app and follows managed devices home, and many schools build on it. The point is to know which of the DfE's expectations it meets on its own and which need another layer, so your annual review can show both.

Stopping pupils getting round a DNS filter

A DNS filter only works on lookups that reach it. SWGfL, which runs the Test Filtering service, describes DNS filtering as the simplest kind of filter to set up but also the easiest to get around, because a device only has to change DNS provider. Pupils (and some apps) can bypass it by using another resolver, an encrypted DNS service built into a browser, a VPN or a proxy. Both the DfE and the UK Safer Internet Centre expect schools to deal with this. The practical controls are:

1. Force DNS through your filter. Block outbound DNS on ports 53 and 853 from the school network unless it goes to your filtering resolver, which is what the NCSC recommends for protective DNS.
2. Control encrypted DNS. Use device management to turn browser DNS over HTTPS off, or point it at your filter, and block the encrypted DNS and filter-avoidance categories your provider offers. See should you block DNS over HTTPS?
3. Block VPN and proxy services through your filter's categories and your firewall.
4. Plan for Encrypted Client Hello (ECH), which hides the site name from network inspection. A DNS filter still sees the lookup when devices use your resolver, and SWGfL notes that controlling the DNS resolver lets you strip the ECH records from responses. See Encrypted Client Hello.
5. Manage the devices. Stop pupils installing other browsers or extensions, and keep roaming clients locked in place on school laptops and Chromebooks.
6. Test it. Run filter tests on and off site and on guest Wi-Fi; our school web filter test guide shows how.

Mobile data is the gap no school network filter can close. A pupil's own phone on mobile data is outside the school's DNS, so behaviour policies, supervision and phone rules carry that risk.

Free PDNS for Schools: a security layer, not a content filter

Many schools ask whether there is a free web filter for schools. The nearest thing is the NCSC's PDNS for Schools, a free protective DNS service open to all UK schools since October 2024. It blocks domains known to be malicious, such as those hosting malware, ransomware, spyware and phishing.

It is worth having, but the NCSC is clear that it complements, and does not replace, the safeguarding filtering measures schools should already have. The NCSC describes it as blocking malicious domains, not as a content filter with categories such as pornography, gambling or self-harm, separate staff and student profiles, or the logging the DfE standards describe. Treat it as a security layer underneath your web filter, not as your web filter. Our page on free DNS protection compares other free options and what they leave out.

DNS filtering options we supply for schools

Forever Systems is a Cisco Partner and supplies several DNS filtering services that schools use. The main options for education are:

Some schools already pay for a product that can filter DNS: an endpoint add-on such as Webroot DNS Protection or ThreatDown DNS Filtering, or a firewall service such as WatchGuard DNSWatch or Sophos DNS Protection. Those are compared on our DNS security solutions page. Whatever you choose, ask the provider in writing about IWF membership, the CTIRU list, staff and student profiles, logging and circumvention, check whether it has published a response to the UK Safer Internet Centre's definitions, and keep the answers with your annual review.

Pricing for education depends on the product, the number of pupils, staff or devices, and the term, so ask us for a quote.

How we help schools, colleges and trusts

Forever Systems helps schools, colleges and multi-academy trusts put DNS filtering in place and keep it working. We can:

• Review your current filter against the DfE standards and UKSIC definition and show which needs it covers and where another layer is needed
• Design staff, student and guest policies, using Active Directory, Entra ID or Google Workspace groups where the product supports them
• Deploy roaming and Chromebook clients through Microsoft Intune, the Google Admin console or your existing tools
• Close bypass routes: resolver rules, encrypted DNS controls, VPN and proxy categories
• Help you test and record filtering checks for your annual review
• Plan the move from Cisco Umbrella to Secure Access for schools and trusts with existing Umbrella estates, ahead of Cisco's end-of-life dates

We do not provide safeguarding monitoring, and we do not describe any filter as KCSIE compliant: each school must satisfy itself, and we help you gather the evidence. For the rest of your school's security, see Cyber Essentials for schools, security awareness training for schools and Cisco Duo for schools.

Contact us to talk about your school's filtering.