Frequently asked questions and protection layer comparison

No. When you use Private DNS away from home on mobile data (LTE/5G) or public Wi-Fi, only brief encrypted DNS queries – your phone asking for a site’s IP address – are sent to the LKH Secure server. All actual internet traffic (streaming video, banking, browsing, calls or file downloads) travels directly over your mobile operator’s network at full speed.

DNS plans (Start, Rodzina, Max, LKH Secure Router) and basic Firewall check domain names – they do not inspect email contents or scan files on disk. However, they help at the next step: if a malicious attachment tries to connect to a known criminal (malware/C2) server once launched, DNS blocks that connection. Network-level scanning of transferred files (along with encrypted HTTPS traffic inspection on Windows computers with the LKH certificate installed) is available in LKH Secure Firewall Pro and LKH Secure Firewall Box (excluding password-protected archives). Blocking the file itself on the computer when saving or opening it requires device antivirus software (such as Microsoft Defender or ESET), which we monitor as part of LKH IT care.

The toggle in the Rodzina, Max and LKH Secure Router plans blocks over 116,000 known web-proxy gateway domains, free and paid VPN provider websites, VPN connection servers and the Tor network (and on the LKH router also known Tor entry node IP addresses). This stops typical ways children try to bypass blocks. An employer’s own VPN server (e.g. vpn.yourcompany.com in FortiClient, Cisco AnyConnect, OpenVPN or WireGuard) is not on the public VPN list and works without interference. However, if the company uses a cloud VPN that is on the list (e.g. Tailscale or Cloudflare WARP), in the Max plan simply add its domain to Allowed domains (allowlist), and in the Rodzina plan set the blocking schedule outside remote working hours (on an Android phone during corporate VPN work, set Private DNS to Automatic so internal company addresses work). VPN apps that connect directly by raw IP addresses without DNS are blocked by LKH Secure Firewall Pro and Firewall Box.

Yes – in the Rodzina, Max and LKH Secure Router plans, once you enter your personal Private DNS address on an Android phone (Android 9+). When you tap a link in an SMS, messenger or email, the phone asks our server for the site address first. If the domain is on the CERT Polska warning list, phishing/malware feeds or your custom blocklist (in Max), the site is blocked even away from home – on mobile operator networks (LTE/5G) and public Wi-Fi. Just keep in mind that DNS protection does not work on iPhones (iOS), with an external VPN active, or for a brand-new site created moments ago that is not yet on threat lists.

Yes. LKH Secure Router lets you set schedules for selected devices, such as a child's phone, while keeping TV connected. Manage them in the LKH app. The Rodzina plan above provides DNS filtering for the entire connection.

DNS protection blocks access to known dangerous domains. It does not scan files or replace antivirus software. Your internet traffic keeps its existing route.