Mike… TL;DR?

Someone in my house almost installed malware from a “PDF.” So I put enterprise-grade DNS security on my home network for $0. 130 threats blocked in two days. Number of family members who noticed? Zero. Number who will read this? Also zero.

Why am I doing this?

There is a profound amount of garbage on the internet, both the kind you seek out yourself to your own dismay and the kind that's simply baked into the content. Why look at it or interact with it if you really don’t have to? Clean your life up to save your life.

A family member got an email from someone they knew. The sender's account had been compromised, and the "PDF to fill out" was really a link to install remote-access software. The email came from a real contact, passed every spam filter, and gave no reason for suspicion. The only place left to stop it was the moment the device reached out to the download site.

In an enterprise, you lock down anything that isn't needed for business. That doesn't work at home. Nobody wants a network that blocks their apps or asks them questions. So my one hard rule was that from my family's point of view, nothing changes.

Starting with DNS made sense because almost everything my family does (apps, websites, links inside emails and texts) begins with a DNS lookup. Filter there, and every device in the house is covered, the TV included, with nothing to install.

What I built

SASE? It’s not just known for when someone gives you an eye roll. Cloudflare has historically, and even now, provided the most gracious free tier of any enterprise company I’ve seen. It covers 50 users, which is plenty for a family. If it isn't, you likely have no time to read a blog post.

I'm working with a Ubiquiti UDR, a switch, an AP, and the pile of devices you’d find in any home.

The family's experience: nothing changed. The network's experience: every lookup checked. (Excalidraw is an awesome tool to give a little personality to your diagrams. I initially built this in Packet Tracer, but it felt way too sterile.)

Layer 1, the whole house: Gateway DNS

Before any device connects to anything, it asks DNS, “Hey, what’s the IP for this thing I’m trying to go to?” My router sends every lookup to Cloudflare Gateway over encrypted DNS, and Gateway checks each one against my security policy. When a lookup is blocked, the connection never gets started.

The limit is that DNS only sees the domain name (google.com), never the full URL or the page content. That deeper check is HTTP filtering, which needs the WARP client on each device. More on that in Part 2.

My old Pi-hole broke apps I actually needed, gave me thin logs, and took the whole house down whenever the Pi failed. Gateway fixes all three.

How I set it up

I rolled this out the way you'd roll out a change at work: one device first, then a test network, then the whole house.

1. Create a location and one policy. In Cloudflare Zero Trust I created a DNS location called Home and a single policy: block everything in "All security risks." No content filtering, no block page. Blocked sites just fail to load, which keeps it invisible.

2. Pilot on one device. I pointed my Windows PC at Gateway over encrypted DNS and tested a temporary block. The blocked site resolved to 0.0.0.0, and normal sites kept working.

3. Flip the whole house. My UniFi router has an Encrypted DNS setting. I gave it my Gateway address (as a "DNS stamp," a format I had to look up), and every device in the house followed. Nobody noticed.

The results

260 blocked lookups in 48 hours, really about 130, because each one is asked twice (IPv4 and IPv6). The blocks came in evening bursts, the pattern of people browsing, not an infected device calling out around the clock. Most of it was junk that rides along on ad networks: redirects, pop-ups and tracking.

One domain kept showing up: a retail marketing platform, blocked as "Spam." The pattern looked like an app retrying in the background. Nobody had complained, so I left it blocked and noted that I'd allow it if an app ever broke. That's the same loop an enterprise SOC runs on a false positive.

And yes, I still see ads. The policy is security only. Ad blocking belongs in the browser, not on the house network. Right control, right layer.

What I learned

• Windows is picky about encrypted DNS. The server IPs have to match where your DoH hostname actually resolves, or nothing works.
• Know what your test tool reports. I spent an evening "fixing" a router that was already working because I read the wrong line of my test output.
• Invisible is also private. Every lookup reaches Gateway from the router, so the logs show "the house," not each person. That's all a security-only tier needs, and it's kinder to my family.

Coming in Part 2

• WARP on my own devices: full-URL filtering and device posture, where a fake-PDF lure gets stopped.
• Access and Tunnel: reaching my apps with zero open ports, the same model that replaces corporate VPNs.
• Logs and a little DLP, kept to security events, not the household's browsing.