In this article
Educational institutions governed by the Children’s Internet Protection Act (CIPA) must implement technical measures to block access to harmful content and promote safe internet use among minors.
DNSFilter enables network administrators to enforce these protections through robust content filtering and threat prevention tools, aligning with CIPA guidelines while streamlining configuration and oversight.
CIPA Requirements Overview
CIPA mandates that schools and libraries receiving E-Rate discounts implement an Internet Safety Policy—commonly referred to as an Acceptable Use Policy (AUP). The policy must outline:
- Measures to block access to inappropriate online content
- Safety protocols for minors using direct electronic communications
- Protections against unauthorized online activity
- Safeguards for minors’ personal information
- Monitoring mechanisms to restrict access to harmful material
Additionally, the Protecting Children in the 21st Century Act requires the inclusion of cyberbullying awareness and responsible online behavior in education and policy enforcement.
DNSFilter configuration for CIPA compliance
The following configuration steps align DNSFilter policies with FCC and CIPA requirements:
Block access to inappropriate content
Enable filtering of the following high-risk content categories and threats to prevent access by minors to materials deemed obscene, harmful, or pornographic:
- Adult Content
- Alcohol & Tobacco
- Botnet
- Cryptomining
- Drugs
- Gambling
- Malware
- Phishing
- Self Harm
- Suspicious & Deception
- Weapons
✍️ DNSFilter enforces automatic blocking of child sexual abuse material (CSAM) for all customers by default via integration with the Internet Watch Foundation and Project Arachnid. This safeguard is non-configurable and cannot be disabled.
Secure use of direct communication tools
Protect minors using email, chat, and other interactive platforms by blocking the following content categories:
- Blogs & Personal Sites
- Media Sharing
- Message Boards & Forums
- Social Networking
- Streaming Media
- Webmail & Chat
Block Search Engines & Portals to block access to search engines. Allow access to specific search engines via the Privacy tab in the policy.
To allow access to educational tools or communication platforms that are essential and supervised, use the Allow List feature.
Helpful Resources:
Block unauthorized access and online threats
Prevent minors from participating in unlawful online activities:
- Block Hacking & Cracking and P2P & Illegal categories
- Enable all Threats categories
This setup mitigates risk from both intentional misuse and inadvertent exposure to malicious content.
Restrict circumvention of Filtering Policies
Ensure DNS filtering enforcement by configuring firewall rules to redirect all outbound DNS traffic on port 53 to DNSFilter servers. This prevents circumvention through local DNS changes or use of external resolvers.
Refer to the Preventing Circumvention Guide for implementation instructions.
Support bypass for authorized use
To comply with CIPA provisions allowing adults to bypass filtering for legitimate research or lawful purposes:
- Implement NAT IP policies or policy-based segmentation by LAN/vLAN
- Assign different filtering profiles to staff and student networks
This configuration enables differentiated access control based on device or user group without compromising network integrity.
Additional Resources
- American Library Association’s CIPA Analysis
- Reporting tips to track policy impact
- Filtering Policy introduction
Comments
2 comments
How do you setup a bypass password listed in the last paragraph? I don't see any option for that and the support portal only lists this single page when searching for ‘bypass password’.
Hi Matt Schumacher , thanks for reaching out. This is an error on our part: DNSFilter removed the bypass password functionality in late 2024 due to security risks it presented, and this mention was missed during our documentation audit process.
The article is now updated. If you'd like to see a bypass option again in the future, please submit a feature request via our canny.
Please sign in to leave a comment.