The suggestions to use PrivateDNS do work — the only drawback is that they are easily disabled.

To set up PrivateDNS, you go to Settings > Connections > More Connection Settings and select Private DNS. Here you can enter one of the cleanbrowsing DNS hostnames (https://cleanbrowsing.org/guides/dnsovertls) in the box provided. And it works quite well.

The big downside here is that someone can very very easily go in and just turn off PrivateDNS if they want to circumvent this filter.

I’m wondering if there is a way to lock down a phone so that it always uses the PrivateDNS and is not easily disabled by toggling settings or restarting the phone.