Even if he surfs in “private mode” he still needs to go through a DNS server somewhere.
OpenDNS is a great idea. I use it as do many forum members.