Recommendation: Create a NextDNS profile at nextdns.io, copy the configuration ID, then set Private DNS to YOURID.dns.nextdns.io (Settings > Network & internet > Advanced > Private DNS). Configure the NextDNS deny list to include specific domains, add categories to block, and enable logs to verify which URLs are being refused. This enforces DNS-over-TLS filtering system-wide without root access. If supervised access is needed for a child, use Google Family Link: install the Parent and Child app...