Student surveillance software like GoGuardian, Hapara, and Gaggle appears invincible. It’s installed deep within the operating system, often as a mandatory browser extension, and seems to watch every move. However, all of this software shares a fundamental, exploitable weakness: to function, it must communicate with a central server. If we can sever that connection, the software is rendered inert. This is the principle behind our custom DNS service.

The Internet’s Phonebook

Every time you visit a website, your computer performs a lookup using the Domain Name System (DNS). Think of DNS as the internet’s phonebook. You know the name (google.com), but your browser needs the number—the IP address (like 142.250.190.78)—to make the connection. Your device sends the domain name to a DNS server, which looks up the corresponding IP and sends it back.

By default, your device uses the DNS server provided by your network, which in a school setting, is controlled by the school. This gives them the power to maintain their own “phonebook” where they can simply remove the listings for sites they want to block. When you try to visit a blocked site, their DNS server effectively says, “Sorry, no number listed for that name,” and your browser can’t connect.

The Digital Black Hole: Introducing Pi-hole

This is where Pi-hole comes in. Pi-hole is a powerful, open-source application designed to be a DNS sinkhole. It sets itself up as your network’s DNS server. When it receives a request, it checks the domain against a massive blocklist.

If the domain is on the list, Pi-hole doesn’t look up the real IP. Instead, it lies. It either sends back a fake, non-routable IP address (like 0.0.0.0) or simply refuses to answer. The result is the same: the connection fails, and the unwanted content is blocked before it ever reaches your device.

Originally built for blocking ads and trackers network-wide, we realized this mechanism was the perfect weapon against edtech surveillance.

Forging the Shield: Our Implementation

The hapara.fail DNS service is, at its core, a powerful, publicly accessible Pi-hole instance. But instead of using a generic ad-blocking list, we maintain our own highly specialized blocklist, which you can view on our GitHub. This list doesn’t contain ad servers; it contains the lifeblood of surveillance companies:

# GoGuardian
*.goguardian.com
*.hosted-extensions.s3.us-west-2.amazonaws.com

# Securly
*.securly.com
*.tabpilot.com

# Blocksi
*.blocksi.net
*.block.si

# And hundreds more...

When a school Chromebook is configured to use our DNS, the entire ecosystem of surveillance breaks down. An extension might try to send a screenshot to a server at GoGuardian, but that request first goes to our DNS. Our server sees the domain on our blocklist and sinks it. The extension, unable to phone home, effectively stops functioning. We aren’t hacking the software; we’re simply cutting its lines of communication.

There’s More

When you switch your device’s DNS from your school’s server to ours, you stop using their restrictive phonebook and start using our open one. The school’s DNS-based filtering—the system that blocks gaming sites, social media, and other resources—is instantly bypassed. Our DNS resolves these domains without issue, granting you access to a less censored internet. This happens as a direct byproduct of reclaiming control over your device’s fundamental network settings.

Ultimately, our DNS service is more than a bypass tool. It’s a demonstration of a core principle: by understanding and controlling the foundational protocols of the internet, we can dismantle the systems of control built on top of them.

Back to Blog