Cisco DNS-layer security: Umbrella DNS and Secure Access DNS Defense

What Cisco DNS-layer security is

Before a browser, app or piece of malware connects to anything, it asks DNS for an address. Cisco's DNS-layer security answers those questions from Cisco's global network of recursive resolvers, the same infrastructure that grew out of OpenDNS. Each lookup is checked against Cisco Talos threat intelligence and against the security and content categories in your policy. Safe domains resolve as normal. Domains linked to malware, phishing, command and control or blocked content categories are refused or sent to a block page, so the connection does not start.

That is the same idea as any protective DNS service, and it gives the same benefits: it covers every application on a device, not just the browser, it works on any port and protocol that starts with a name lookup, and it adds very little delay because it filters the lookup rather than the traffic. If you are new to the concept, start with what is DNS security? and our explanation of DNS-layer security.

Cisco has sold this capability under several names. For years it was Cisco Umbrella. Cisco's own Umbrella website now says that Umbrella has evolved to Cisco Secure Access, and that Secure Access DNS Defense provides all Umbrella DNS features and more. The rest of this page untangles the names.

Every Cisco variant at the DNS layer

The table lists every Cisco package you are likely to meet on a quote, renewal or invoice, and what each one does at the DNS layer. Everything Cisco sells in this family includes the same DNS-layer core: Talos-backed security categories, content categories, allow and block lists, roaming protection and reporting. The differences are in what happens beyond the lookup.

For the full package-by-package feature comparison, see our Cisco Umbrella packages guide on the specialist Umbrella site, and Cisco Secure Access licensing for the newer packages. We do not repeat those tables here because the detail changes, and it is kept up to date in one place.

Three layers: DNS, intelligent proxy and full web gateway

Cisco's family is a good worked example of how DNS security relates to deeper web security, because the same platform offers three layers:

1. The DNS layer. Every package starts here. The resolver sees the domain name being looked up and decides whether to answer. It cannot see the page, the file or anything sent after the connection opens.
2. The intelligent proxy. In DNS Security Advantage, domains that are neither clearly safe nor clearly bad (for example, a popular file-sharing service that occasionally hosts malware) are answered with a route through Cisco's selective proxy, which inspects the full URL and files for those domains only. Inspecting HTTPS needs the Umbrella root certificate on devices. On the Secure Access side, Cisco's package guide shows the same partial proxying and URL lists in DNS Defense Advantage, not Essentials.
3. The full secure web gateway. In the SIG packages and Secure Internet Access, web traffic itself is proxied and inspected, with a cloud firewall and CASB alongside, so you get URL-level control for every site, not just risky ones.

Many organisations start at layer one, because DNS-layer protection is quick to deploy and needs little upkeep. Our guide to DNS filtering vs URL filtering explains when the extra layers are worth it, and our sister site covers the full secure web gateway picture.

What Cisco's DNS layer cannot see

DNS-layer security is a strong first control, but it is not everything. Be clear about the gaps before you rely on it:

• Direct-to-IP connections. Malware that connects straight to an IP address makes no lookup. Cisco retired its optional IP Layer Enforcement feature in July 2022; inspecting that traffic now needs the SIG packages or Secure Internet Access.
• Encrypted DNS sent elsewhere. A browser or app using its own DNS over HTTPS service skips your resolver entirely. Cisco's content categories include encrypted DNS and filter avoidance, and the Umbrella Low content preset blocks them; see blocking DNS over HTTPS for the wider controls.
• Pages and files on allowed domains. At the DNS layer a domain is either allowed or blocked. One page on an allowed site needs the intelligent proxy or a full gateway.
• Devices that are not pointed at Cisco. Protection only applies where networks, virtual appliances or the roaming module send lookups to Cisco's resolvers. Our DNS security test guide shows how to check.

How Cisco gets lookups to its resolvers

Getting every lookup to the protective resolver is what makes DNS security work. Cisco's options are the same for Umbrella DNS and DNS Defense:

• Network forwarding: point your firewall, router, DHCP or internal DNS forwarders at Cisco's resolvers, which covers every device on site, including printers and IoT.
• Virtual appliances: lightweight forwarders on your own hypervisor that pass internal IP addresses and, with the AD Connector, user identity to Cisco; see the Umbrella virtual appliance guide.
• Roaming laptops: the Roaming Security Module in Cisco Secure Client (formerly AnyConnect) protects devices at home and on public Wi-Fi; see the Cisco Umbrella roaming client page and our vendor-neutral guide to DNS roaming clients.
• Chromebooks: Cisco Security for Chromebook, a Chrome extension that sends the whole device's DNS to Cisco over DNS over HTTPS; see Umbrella on Chromebooks.
• Cisco Meraki networks: a DNS integration that applies policy per wireless network or group policy; see Umbrella with Meraki.

For integrations beyond the network, the DNS packages include an API and log export to Amazon S3, which security teams use to feed DNS events into a SIEM. Step-by-step set-up belongs on our specialist site: see Cisco Umbrella setup.

End of sale: the dates that matter for DNS security

Cisco announced the end of sale and end of life of Umbrella SIG and DNS on 1 September 2026. These milestones apply to every Umbrella DNS package, including the education versions:

Existing Umbrella services do not stop on the first date: Cisco says customers keep service and support under their subscription terms and its published milestones. Cisco's notice also says any new or changed subscription must end on or before the last date of support, so no Umbrella DNS term can run past 31 January 2029. The practical question is when to move, and to what. Our DNS Defense vs Umbrella page compares the DNS packages directly, and the full milestone list, including add-ons with no migration product, is in the Cisco Umbrella end of life guide. Some organisations will use the change as a moment to look at alternatives, such as DNSFilter; see Cisco Umbrella vs DNSFilter.

Which Cisco DNS option fits

• You want threat and content blocking by domain, with very little to maintain: Umbrella DNS Security Essentials today, or Secure Access DNS Defense Essentials for new projects.
• You want risky domains inspected more closely, an investigation console for your security team, or (on DNS Defense) SaaS API DLP and cloud malware scanning: DNS Security Advantage, or DNS Defense Advantage.
• You are a school, college or trust: the education packages, with roaming and Chromebook cover; see web filtering for schools and Cisco Umbrella for schools.
• You need URL-level control, a cloud firewall or data loss prevention for all web traffic: look past DNS to Secure Internet Access, covered under Cisco Secure Access.

If you are still unsure, compare Cisco with the other DNS security solutions we supply before you decide.

How Forever Systems helps

Forever Systems is a Cisco Partner. We can review how your organisation uses Umbrella DNS today, check which devices and networks actually reach Cisco's resolvers, and recommend whether to renew, move to DNS Defense or step up to a fuller service. For new customers we can scope Cisco DNS-layer security alongside other options and set it up with you, from network forwarding to roaming clients and reporting.

Pricing depends on the package, user numbers and term, so ask us for a quote. Licensing detail and pricing factors are on our Cisco Umbrella cost page. Contact us to talk it through.