185.228.168.9: CleanBrowsing security filter

185.228.168.9 is the primary address of CleanBrowsing’s Security Filter, a free DNS resolver that blocks phishing, malware, and spam domains and nothing else. Its sibling addresses in the same block run the Adult and Family filters, so the last octet selects the policy.

Three filters, one block

CleanBrowsing publishes three free tiers, each on its own address pair. Nothing in the setup requires an account, and the resolver applies the policy attached to whichever address the query arrived on.

Filter	Primary	Secondary	Blocks
Security	185.228.168.9	185.228.169.9	Phishing, malware, spam domains
Adult	185.228.168.10	185.228.169.11	The above plus adult content
Family	185.228.168.168	185.228.169.168	The above plus mixed content sites, with safe search forced on major search engines and YouTube restricted mode

Choosing the Security Filter means you get threat blocking with no opinion about content, which suits an office network or a server where a content filter would create false positives.

Who runs it

CleanBrowsing was founded by Daniel Cid, who wrote the OSSEC host intrusion detection system and founded the website security firm Sucuri before it was acquired by GoDaddy. The company is small, which cuts both ways: the free service has run reliably for years, but it does not have the anycast footprint of Cloudflare or Google, so latency varies more by region.

Check the path with /ping-test or /traceroute before deciding it is fast enough for your location.

When you see it

The address appears in school and library network configurations, in router DHCP settings chosen by parents who then moved up to the Family pair, and in hardening guides that recommend a filtering resolver for small business networks. It also shows in resolv.conf on servers where an administrator wanted phishing protection without the query logging that comes with some commercial alternatives.

How to configure it

1. Router: enter 185.228.168.9 and 185.228.169.9 in the LAN DHCP DNS fields.
2. Windows and macOS: the same pair in the adapter’s IPv4 DNS settings.
3. IPv6: 2a0d:2a00:1::2 and 2a0d:2a00:2::2 for the security filter.
4. Android 9 and later: Private DNS provider hostname security-filter-dns.cleanbrowsing.org.
5. DNS over HTTPS: https://doh.cleanbrowsing.org/doh/security-filter/.

Lock down the router as well if the goal is enforcement rather than a default, because a device that can change its own DNS settings can leave the filter behind.

Privacy and policy

The CleanBrowsing privacy policy states that the free filters do not log the source IP address of queries and that the company keeps aggregate statistics only. Paid plans record query logs for the account holder, which is the feature people pay for. CleanBrowsing also states that it does not sell query data.

What it is not

The Security Filter is not a content filter, so an adult site resolves normally through it. It is not an ad blocker either; AdGuard DNS or Control D cover that. And DNS filtering only applies to devices that use the resolver, so a browser with its own DNS over HTTPS setting or a VPN app bypasses it entirely. Confirm what your device actually queries in /dns-leak-test.