Keeping It Standing

Fortresses don't fall to battering rams. They fall to deferred maintenance. Everything on this page is designed to fit real life: five minutes a month, one longer walk a quarter, and one rule for new devices. That's the whole tax.

The Monthly Five

First Saturday of the month. Five items, five minutes. Put it on the calendar as a recurring event today — the routine you schedule is the only routine that happens.

1. Re-link. Open the NextDNS dashboard → Setup → Link IP. Ten seconds, and it neutralizes the #1 silent failure. (If you set up automated re-linking or DoT, this becomes "confirm it's linked.")
2. Push on the wall — Wi-Fi and cellular. One kid device: test page + one dummy test site, on the house network and again with Wi-Fi off. Sixty seconds.
3. Glance at the seams. Router's connected-device list: anything new you don't recognize? Kid devices: any new browsers or VPN-shaped apps since last month?
4. Triage five password warnings. Open the vault's security list, fix five, stop. The installment plan in action.
5. Log one line. Anywhere durable — a note, a notebook: "March: all held" or "March: found Opera Air on the iPad." Twelve lines a year, and you'll actually know your fortress's history instead of guessing at it.

The Quarterly Walk

Four times a year, do the full Day Seven perimeter walk again — every device, every test in the protocol. Then add the part that's unique to the quarterly:

The settings safari

Vendors move things. Between your walks, some company will have renamed a setting, relocated it, or — the sneaky one — split it: one toggle becomes two, and the new second toggle defaults to off. Your setting still shows "on"; it just governs half of what it used to.

• Open each major control surface (NextDNS dashboard, Screen Time, Family Link, each streaming service's parental settings, each console) and actually look — don't just confirm your old settings, scan for settings that didn't exist last quarter.
• Anything new that touches content, purchases, DNS, or profiles: read it, set it deliberately.
• After every major OS update, treat that device as due for a mini-safari — OS updates are when the factory tunnels (Private Relay, secure DNS) most often reappear.
• Check this site's changelog — if a vendor moved something big, it's logged there with the fix.

The New-Device Protocol

1. Add it to the Inventory before the box is fully open.
2. Layer 1: it joins the filtered Wi-Fi (automatic if your router is the wall — this step is mostly "don't give it the neighbor's password").
3. Layer 2: it signs in with the child's account, never a parent's, never a new throwaway.
4. Layer 3: device restrictions + traveling wall before the first app installs. A new iPhone is easiest to supervise now, while it's empty — the Configurator hour costs nothing on a device with nothing to erase.
5. Layer 4: its streaming/console apps get profiles and PINs before movie night, not after.

Christmas morning tip from someone who learned it the slow way: do Layers 1–4 on the new device before you wrap it. Fifteen quiet minutes in December beats a negotiation with an excited kid holding a live device.

What breaks silently — the watch list

Ranked by how quietly they fail:

The last word

The book ends where this page ends: the fortress is not the point. The kid who eventually walks out of it is. Maintain the walls so you can spend your energy on the conversations inside them — that's the whole design.

Back to the overview