I can answer that one, I think. Provided the laptop or computer your user (presumably child) uses, has a separate account that does not have administrative rights, they won’t be able to change the DNS. A second account on your PC has admin rights, and it’s there that you set the DNS to cleanbrowsing.org’s DNS. That’s what I did for my childrens’ devices.
That’s interesting. But if I’m not mistaken, my child can just delete the VPN profile, right? If that is true (which looks to be the case), is there some way I’d know if the VPN profile was deleted, aside from frequently looking at the device?