Settings, Network & internet, the adapter's DNS server assignment with DNS over HTTPS on; prove with Get-DnsClientServerAddress and Get-NetFirewallProfile.
Do it by hand every check, on every platform
The browser check sees one browser. These guides do the rest by hand, one platform at a time: the resolver every app uses, the blocker in the browser, the device's own firewall and what listens, the router, what the internet sees of your address and what walks past the filter, the advertising identifier, and the past. Each step names the vendor page it follows. The scripts below do the same checks on a computer in one go.
The resolver's profile under System Settings, General, Device Management; the firewall under Network; prove with scutil --dns and socketfilterfw.
resolvectl status and resolved.conf; ufw status, firewall-cmd or nft list ruleset; ss -ltnup.
The resolver's profile under Settings, General, VPN & Device Management; Lockdown Mode under Privacy & Security.
Settings, Network & internet, Private DNS, the provider's hostname; the security patch level under About phone.
What every guide covers
- Filter DNS for every app: which resolver, how to set it, how to prove it with one lookup of an ad domain, and the hosts file.
- A content blocker in the browser, and what the browser's own DNS does.
- The device's firewall and what listens: profiles, the inbound default, sharing and remote access, SMB leaving the device.
- The router: the printed password, the resolver it hands out, UPnP and its mappings, remote management, firmware against this site's CVE table and KEV, Wi-Fi encryption.
- The network: what Shodan's index says about your address, whether plain DNS and DNS over HTTPS bypass the filter, and whether IPv6 reaches the device.
- Lockdown Mode and the advertising identifier, and the past: logging, and the Mobile Verification Toolkit for phones.
Why these checks carries the argument for each, with its sources.