Even if he surfs in “private mode” he still needs to go through a DNS server somewhere. OpenDNS is a great idea. I use it as do many forum members.