Relution Decon (content filter)

Starting with version 26.5, Relution enables the setup of a DNS-based content filter for macOS devices. This feature ensures a secure and focused internet experience by restricting access to selected websites and apps. With AI-powered content categorization, Relution Decon also provides a comprehensive parental control filter with advanced configuration options.

What is Relution Decon? #

Relution Decon is an AI-powered add-on for macOS that filters content in real-time, creating a safe digital environment. Using DNS-based content control, Decon blocks unwanted websites and apps, allowing users to work and learn in a protected, distraction-free space.

Relution Decon uses a DNS proxy to forward all requests to the Decon server. Websites are classified and either allowed or blocked according to policy rules. All data transfers are SSL-encrypted, ensuring user activities remain secure.

Decon App #

The Decon app is automatically deployed on macOS devices when the policy is installed. It monitors device DNS requests and ensures that only approved content is accessible.

App features:

• Activates a system-wide DNS proxy, which cannot be disabled by the user
• Displays the current status of Relution Decon
• Provides insight into blocked websites and applied filter categories

Set up Apps and Books (VPP) in Relution →
Relution Decon in the Apple App Store →

Decon Policy #

In the device policy, the configuration is added via Add → Relution Decon. This policy automatically installs the Decon app on the devices, where it acts as a proxy for all DNS requests. Unlike on iOS, macOS additionally requires a Managed App Configuration → and the approval of the system extension — Relution sets up both automatically.

Policy configuration is completed upon publishing.

On macOS, Relution Decon is only available for devices with device enrollment. With User Enrollment →, the configuration cannot be added.

A license that includes Relution Decon is required. Without it, the configuration shows a notice and cannot be saved.

Policy configuration hierarchy (highest to lowest priority) #

1. Allowed apps
2. Blocked apps
3. Permitted domains
4. Blocked domains
5. Blocked categories

Decon in Relution Teacher #

On macOS devices, Decon can be selected and managed in class profiles starting with Relution Server 26.5. Prerequisite: the student devices have a Decon policy assigned. Relution Teacher only shows a notice about a missing Decon configuration for iOS devices, not for macOS devices.

More about Relution Teacher →

Note: If Decon is enabled in the class profile, the otherwise valid Decon configuration is completely overwritten for the duration of the lesson. Permitted or blocked domains from the Relution Decon requests do not apply during this time.

Filtering #

In the Filtering section of the Decon policy, Filter Type determines how websites are filtered:

• Off: No filtering by categories or age level.
• Categories (default): The categories to be blocked are selected individually via toggles. The toggles are only shown for this filter type. Adult content, Advertising and Phishing are blocked by default.
• Age level: Filtering is based on an age level (0+, 6+, 12+ or 16+, default 12+).

Two further toggles are available regardless of the filter type:

• BPJM list: Additionally filters content classified as inadmissible by the BPjM. Entries under Permitted domains can still enable access to such content.
• Safe search: Set independently of the blocked categories and the age level. Blocking the Adult content category does not enable safe search.

If several Decon configurations are used on one device, the strongest filtering automatically takes effect: age-based filters take precedence over category-based filters. Configurations without filtering are ignored.

Category Classification #

Relution Decon automatically assigns each website to a category. With the filter type Categories, administrators can define which categories are blocked:

Permitted and Blocked Apps and Domains #

• Allowed apps / Blocked apps (Apps section): Internet access of individual apps is allowed or blocked specifically, while basic functions remain available.
• Permitted domains / Blocked domains (Domains section): Specific domains can be allowed or blocked independently of categories. Only the domain should be specified, not the path. Permitted domains remain accessible even if the filter deems them inappropriate. The number of blocked domains should be limited to about 500.

Regardless of these lists, the Relution server URL, the Decon server and the Relution apps (Relution Agent, Teacher, Files, Assets and Decon) are always allowed. In addition, Relution adds the domains allowed and blocked organization-wide under Settings → Relution Decon requests to every Decon configuration.

Advanced DNS Configuration #

DNS servers on the device: Alternative DNS servers can be configured if the Relution Decon DNS is unavailable. Fallback: Cloudflare Families DNS (1.1.1.3).

DNS servers on the Relution Decon server: An alternative DNS server can replace the standard DNS on the Decon server. IP addresses (UDP) or DNS-over-HTTPS (DoH) such as Zero or Quad9 can be used.

Limitations #

• Caching: Blocks and policy changes can take up to 1 minute to take effect.
• Path independence: DNS operates at domain level, subpages are not distinguished.
• App blocking: Only internet access is blocked, basic functions and cached content remain available.