Haven
Get Haven
Troubleshooting → Device protection

Protection was on, and then it was off again

Something is putting the DNS settings back. Almost always it is another program that also considers DNS its job, and it is worth finding out which before setting it a third time.

What is probably going on

Most likely

A VPN client reset the adapter when it connected or disconnected. Most of them rewrite DNS on every session and put back what they think was there before.

Check this firstThe protection was working, then you connected or disconnected a VPN, and now it is not.
  1. Set the family resolver inside the VPN client itself so it survives the VPN, rather than on the adapter underneath it.
  2. If the client has no DNS setting, run the Haven setup again after each VPN session, or move that device onto Compass on mobile where the DNS setting is held by the operating system.
Cause 2

The device joined a different network. DNS settings are per-connection on Windows and macOS, so protection set on your home Wi-Fi is not carried onto a hotspot, a relative's house, or the office.

Applies to: windows, mac
Check this firstThe check passes at home and fails somewhere else, on the same device.
  1. Run the Haven setup script once on each network you regularly use — it takes seconds after the first time.
  2. On a laptop that moves constantly, the Windows and Mac helper is the better route: it applies the setting to every service on the device rather than one network at a time.
Cause 3

Someone in the household changed it back. This is not rare and it is not a bug — the DNS setting is not PIN-protected, because on Windows and macOS an account with Administrator rights can always change it.

Check this firstThe verification page shows protection lapsing and returning rather than failing steadily.
  1. Check whether the child's account on that computer is an Administrator. On Windows and macOS a standard account cannot change DNS; an Administrator account can, whatever else you configure.
  2. Move the child to a standard account and keep the Administrator password to yourself.
  3. Turn on the weekly household summary so a lapse shows up without you having to check.

What Haven cannot fix here

Stated plainly, because a product that hides its edges is how you end up trusting a surface nobody is covering.

A child with Administrator rights on their own computer.No DNS product can hold against that, Haven included — an Administrator can undo anything an Administrator did. The fix is the account type, not the filter. This is one of the gaps the coverage map states plainly rather than colouring green.

Next door to this

I followed the setup, but the check still says this device is not protectedThe phone is protected on Wi-Fi but not on mobile data

Still stuck?

Two doors, and neither of them is a queue you never hear back from.

Report this — it did not work Have a technician do it with you Re-run the protection check My provider is the problem

Last checked 2026-08. Nothing on this page was written by a model — a made-up menu path is worse than no instruction at all, and this is the page somebody reads when they are already stuck.