Lockdown add-on
Add a Real Web Filter: Block Porn, Ads, and Malware with NextDNS
The optional second layer: DNS-level filtering that blocks and logs porn, ads, and malware across every app, on Wi-Fi and cellular, pushed through your MDM so it sticks.
Your supervised setup already does basic web filtering through Apple's built-in content filter. NextDNS is the heavier layer: it filters at the DNS level (the internet's phone book), so it blocks and logs porn, ads, trackers, and malware across every app and browser, on Wi-Fi and cellular. (If you haven't set up the supervised phone yet, start with the main lockdown guide.)
It's free for light use (about $2/month if you go over), and it's the one piece that gives you a dashboard of exactly what the phone tried to reach.
Context
Why add NextDNS, and why "managed"
Two reasons this is worth the extra few minutes:
- It's explicit and everywhere. Apple's filter is a blunt on/off. NextDNS lets you block whole categories (adult, gambling, and so on), specific sites, and the ad and tracker networks that follow your kid around, in every app, not just Safari.
- It logs. You can see what the phone actually requested, which is how you catch a new app or a workaround early.
One rule before you start: you'll push the NextDNS profile through SimpleMDM as a managed profile, not by hand. A profile you tap to install yourself isn't managed by your MDM and won't survive an iCloud restore, so it silently disappears the next time the phone is set up. Pushed through SimpleMDM, it sticks.
Step 1 of 3
Make a NextDNS config for each kid
about 10 min
- Create a NextDNS account and make a separate config for each kid (so the filtering and the logs stay separate; mine are tuned differently per kid).
- Tune that kid's config: switch on the blocklists and categories you want. The defaults plus the adult-content and security blocks are a strong start.
- In that kid's config, download the Apple
.mobileconfigprofile. It carries the config's unique ID, which is how NextDNS knows the traffic is theirs.
Step 2 of 3
Push it through SimpleMDM
about 5 min
Upload the .mobileconfig to SimpleMDM and push it to the phone as a managed (custom) profile, the same way you assigned the Block Apps profile in the main guide. Do not hand-install it on the phone.
Step 3 of 3
Verify it's filtering
about 5 min
Open test.nextdns.io on the kid's phone; it should confirm the config is active. Or watch your NextDNS dashboard light up with the phone's traffic as they use it, and try a known-blocked site to confirm it fails to load.
That's the full stack: a supervised, locked-down phone that sleeps when it should and filters the web everywhere. If you skipped the other upgrade, the bedtime lock add-on is the one that quiets your evenings.
Want the printable version of this checklist?
I'll send the step-by-step PDF, plus a heads-up when an app or setting changes that affects your kid's phone.
Brian
I spent my career in security: the FBI, CrowdStrike, and now detection engineering. I'm also a dad who got beaten down by Screen Time like everyone else. I write this for the parent I was not long ago. More about why I built this →
Questions & comments
I approve everything on-topic, including criticism. I remove only spam, abuse, personal attacks, and off-topic noise.
No comments yet. Have a question about the guide overall? Ask below. (You can also comment on a specific step above.)