Is it safe that sometimes my Anti-filtering program does not change the DNS address?
If your DNS queries are being resolved by your ISP, then yes, you should change your system DNS server to
126.96.36.199 (Google's public DNS resolvers).
DNS filtering is performed by the ISP, typically under instruction by a governing body. In this case, the actual DNS server queried is irrelevant, the ISP will drop any DNS queries for a particular domain name, preventing users from resolving it. This occurs irrespective of the target DNS server. However, if you are actually using your ISP's DNS server, then you are giving them a second opportunity to filter your lookups.
Your antifiltering software can work in one of two primary ways;
Out-of-band DNS Queries The anti-filtering software performs DNS queries by dialing out to a C&C server, which performs the actual DNS lookups on your behalf and returns the results to you via an encrypted (SSL) tunnel. This method requires a browser plugin and is rarely used, because it is a terrible hack.
Full Connection Tunneling This is by far the most common approach, your connection is tethered to a remote server via an encrypted (SSL, PPTP, IPSec etc) tunnel, also known as a VPN gateway. All traffic is passed through this tunnel, including DNS queries. Your ISP cannot see what you are doing, instead the ISP of the VPN gateway sees all the traffic, which is why you put the gateway in a country with less strict filtering laws than your own.