> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goguardian.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How GoGuardian DNS Works

> How GoGuardian DNS works as a network-level filtering solution, what it covers, and how it compares to GoGuardian Admin extension-based filtering.

GoGuardian DNS is a network-level web filtering solution. It works by routing traffic through GoGuardian's DNS resolvers and applying filtering rules to every device that connects to a filtered network. No extensions or software are required on individual devices.

GoGuardian DNS is designed for K-12 schools that need CIPA-compliant filtering across all devices on campus — including BYOD, guest, and unmanaged devices that do not have the GoGuardian extension installed.

## Understand How DNS Filtering Works

DNS stands for Domain Name System — the system that translates domain names like `goguardian.com` into IP addresses. GoGuardian DNS intercepts these translation requests and applies your filtering policy before any device can reach a blocked domain.

Because filtering happens at the network level, GoGuardian DNS:

* Covers all devices connected to your filtered networks, regardless of operating system or browser
* Requires no software installation or agent deployment on individual devices
* Applies the same filtering rules to managed and unmanaged devices on the same network

When a device on your filtered network attempts to access a blocked domain, the DNS request is denied and the user is redirected to a block page.

<Note>
  If a blocked site uses HTTPS, the browser may display a "Your connection is not private" warning. This is expected behavior. The warning appears because the requested certificate (for the blocked site) does not match the certificate from GoGuardian's block page redirect.
</Note>

## Understand What GoGuardian DNS Filters

GoGuardian DNS applies filtering at the **domain level**. It uses the same policy framework as GoGuardian Admin, with important differences:

| Feature                       | GoGuardian Admin                                       | GoGuardian DNS                                    |
| ----------------------------- | ------------------------------------------------------ | ------------------------------------------------- |
| Coverage                      | Users logged into Chrome with the GoGuardian extension | All devices connected to a filtered network       |
| URL path filtering            | Supported                                              | **Not supported** — DNS filters root domains only |
| Wildcard filtering            | Supported, including path wildcards                    | Supported, but domain/subdomain only (not path)   |
| YouTube filtering             | Supported                                              | **Not supported**                                 |
| Apps and Extensions filtering | Supported                                              | **Not supported**                                 |
| Force SafeSearch              | Supported                                              | Supported                                         |
| Website categories            | Supported                                              | Supported                                         |
| Per-student reporting         | Supported                                              | **Not supported** — network-level only            |
| Smart Alerts                  | Supported                                              | **Not supported**                                 |
| Smart Rules                   | Supported                                              | **Not supported**                                 |
| Direct IP blocking            | Supported                                              | **Not supported**                                 |

**URL path filtering example:** A policy rule that blocks `sites.google.com/unblockedgames` targets the path `/unblockedgames`. GoGuardian DNS ignores the path and would need to block the entire `sites.google.com` domain to enforce that rule — which would block all of Google Sites. For path-level rules, use GoGuardian Admin filtering.

**Wildcard filtering:** Wildcards like `*unblock*` match domains and subdomains — for example, `unblockedgames.com`. They do not match URL paths.

## Understand When to Use GoGuardian DNS

Use GoGuardian DNS when you need:

* Filtering for BYOD, guest, or unmanaged devices on campus
* A network-level filtering layer that works regardless of browser or operating system
* A supplement to GoGuardian Admin that extends coverage beyond managed Chrome devices

GoGuardian DNS does not replace GoGuardian Admin for managed devices. Use both products together when your environment includes both managed Chrome devices and unmanaged or BYOD devices.

## Resources

* [Set Up GoGuardian DNS](/products/dns/set-up-goguardian-dns)
* [GoGuardian DNS FAQs](/products/dns/dns-faqs)