A lookup is a device asking for a name. It is not a minute and not a byte, and it is not proof anyone looked at anything: apps ask for names in the background all day. Blocked means the name was not answered (or was answered with the portal's address). Nothing here can see inside HTTPS, and a device on a VPN or DNS-over-HTTPS is invisible to all of it.

Worth a look

Counts of lookups, not of people or of visits. One page can ask for an adult domain many times through an embedded advert; one child can ask once. Open the log before drawing a conclusion, and treat what you find as the start of a conversation.

"Adult" and "gambling" are the names of the blocklists that matched (OISD NSFW and HaGeZi Gambling, as AdGuard is set up). A blocklist can be wrong about a site. Rows from before 2026-09-02 have no recorded reason, so they can only ever show as "blocked".

Lookups over time

DNS lookups per hour today, stacked by the person whose device asked. Hours follow the gateway's clock; the current hour is part-finished.

• Nova
• Rangi
• Piper
• Ari
• Marama
• Unattributed, and Callum, Dorothy

Unattributed lookups come from devices not yet assigned to anyone. Name them on the Devices tab and they start counting for that person.

Blocked, and why

Blocked lookups per hour, by the reason AdGuard gave. Adverts and trackers are usually most of it and mean nothing about the person; the rest is what the filter is for.

• Cut off (time up, bedtime or a block), sent to the portal 140

"Sent to the portal" is a child whose internet was off (time up, bedtime, or a block): every name their device asked for was answered with the portal's address, so a hundred of those is one open browser, not a hundred attempts.

Top sites, by lookups

The names each person's devices asked for most. Coloured where the site is in a metered category (gaming, video, social); grey is everything else, including the CDNs and app back-ends that make up most of any device's lookups. Click a name to see every lookup of it.

Minutes per category

Metered minutes per day for each child, from the firewall counters (METERING.md). A minute counts when the device moved real traffic to that category in that minute, so a backgrounded app does not rack up time. Music, schoolwork and messaging are never metered. The meter works by day, so today is one column.

• Gaming
• Video
• Social

Nova

gaming 19 min · video 28 min · social 0 min

Rangi

gaming 41 min · video 41 min · social 10 min

Piper

gaming 25 min · video 44 min · social 39 min

These are the same figures as the Trends tab. They are measured, not derived from the lookup counts above, and the two must not be added together. A child with no metered minutes in the window (a visiting child is never metered) is not listed.

The log

Every lookup in the window, newest first. Pick a person, then a site, and read every time a device asked for it. Genkan keeps domains only, never what was on a page, and keeps them for thirty days.

A row is one question from one device: "what is the address of this name?" It is not a page view, not a minute, and not proof a person did anything. Blocked means the name got no real answer. Times follow the gateway's clock. What this cannot see: anything inside HTTPS, anything a device sends through a VPN, Cloudflare WARP or its own DNS-over-HTTPS, and anything on mobile data.

How to read this page

Genkan is a family conversation aid, not a surveillance console. Domains only, thirty days, all of it in the house.