How to block porn on Android when you are blocking yourself

Android has no single switch for this. What it does have is a system-wide encrypted DNS setting that takes about ninety seconds to configure, covers every app on the phone, and costs nothing — and a well-known gap, which is that Chrome ships its own DNS resolver and can route around it. Close that gap and you have a setup that holds against an ordinary bad evening.

Almost every guide to this is written for a parent restricting a child’s phone. That is a different problem, and an easier one, because the parent keeps the passcode. This is written for the harder case: you are blocking yourself, and you know every password involved.

Layer one: Private DNS, ninety seconds, free

Android has supported DNS over TLS natively since Android 9. It sits below the browser at the system level, so it applies to every app and every browser at once, needs no root, and installs nothing.

Settings → Network & internet → Private DNS → Private DNS provider hostname, then enter a filtering resolver. CleanBrowsing’s family filter is the usual choice:

family-filter-dns.cleanbrowsing.org

Save, and adult domains stop resolving across the phone — in Chrome, in Firefox, in the little in-app browser a social app opens links in. That last one matters more than it sounds, because in-app browsers are where a lot of accidental exposure actually happens and they are invisible to anything browser-based.

The exact menu path moves between manufacturers. On Samsung it is Connections → More connection settings → Private DNS; searching the Settings app for “Private DNS” finds it on every build.

The leak nearly every guide omits

Here is the part the vendor posts skip, and it is the single most important thing on this page.

Chrome has its own DNS resolver. Secure DNS in Chrome sends lookups over HTTPS to a provider of Chrome’s choosing, independently of the system setting you just configured. A phone with a perfectly good filtering resolver in Private DNS can still resolve whatever Chrome’s own resolver resolves.

So after setting Private DNS, do one of these:

• Chrome → Settings → Privacy and security → Use secure DNS → off, which hands lookups back to the system; or
• leave it on but set it to a custom provider — the same filtering hostname — so both resolvers point at the same filter.

Either works. Doing neither leaves you with a filter that the browser you actually use is entitled to ignore, which is worse than knowing you have no filter at all.

One useful consequence of Google’s own documentation here: Chrome disables Secure DNS when a device is managed or has parental controls active. That is also why a managed work phone behaves differently from a personal one.

Layer two: an app-level blocker, for what DNS cannot see

DNS filtering is blunt by design. It answers the question “should this domain resolve?” and nothing else — it cannot see a specific page, it cannot read a search results page, and a site that moves to a new domain resolves perfectly until the filter list catches up.

This is the layer IronWill’s Android blocker occupies. Android gives no app a system content filter the way iOS does, so the mechanism is an accessibility service that watches browser navigation and blocks matching pages on the device. How that works, and what it can and cannot see is worth reading before you grant the permission — the permission looks alarming because accessibility services genuinely are powerful, and you should know what you are agreeing to.

Two honest limits:

• It is per-browser-navigation, not system-wide. It sees browsers. It is not a network filter.
• Aggressive battery management kills it. Xiaomi, Samsung, Oppo and Huawei builds in particular will stop background services to save power, silently. If a blocker stops working on one of those phones, battery optimisation is the first thing to check, not the app.

Run both layers and they cover each other’s gaps: DNS catches everything including in-app browsers, the accessibility service catches what DNS is too blunt for.

Layer three: make undoing it slow

Both layers above can be switched off by the person who switched them on — in about fifteen seconds for Private DNS. If you are blocking yourself, that is the actual problem to solve, and it is a design problem rather than a technical one.

What helps is friction, not secrecy:

• A delay on turning protection off. IronWill puts a ten-minute wait on disabling its blocker, which is useless against a plan and quite effective against an impulse. Most of what people want to undo at 1am they no longer want to undo at 1:10am.
• Give the Private DNS a reason to stay. Pick a filtering resolver you also want for ad and tracker blocking, so turning it off costs you something you like.
• Someone else knows. The most reliable friction is social, and nothing on a phone replaces it.

What none of this does

No phone blocker is a wall. Someone determined can clear Private DNS, uninstall the app, use a second device, or reset the phone — and anyone telling you otherwise is selling something. We will not pretend our own blocker is an exception; it is not.

What the stack is good for is removing the ten-second decision — the gap between an urge and a tab, where most relapses actually happen. Turning ten seconds into several minutes of deliberate, conscious effort is the whole mechanism, and it is a real one. It is not the same as making something impossible.

If you are mid-craving right now

None of this helps in the next ten minutes. A blocker is a wall you build in advance. For the moment itself, the thing to understand is what the urge is doing, and the practical tools are breathing, grounding and getting physically elsewhere.

IronWill does the Android side of all three layers in one place: the accessibility-based blocker, a guided Private DNS setup, a ten-minute delay on switching protection off, and an emergency mode for when none of it is enough. Free to download, no account, and your logs stay on the device.