DNS security solutions we supply

Six ways to buy DNS security

Every DNS security product does the same basic job: it answers your devices' DNS lookups from a protective resolver that refuses to resolve domains known to host malware, phishing or command-and-control servers, and optionally blocks content categories you choose. If you are new to the idea, start with what DNS security is and protective DNS.

Where the products differ is in how lookups reach the resolver, and that decides which one suits you:

• Standalone cloud DNS service: you point networks at the provider's resolvers and add a roaming client to laptops. Best when you want one DNS policy across everything, whatever endpoint or firewall you run.
• Endpoint add-on: DNS filtering switched on in the agent you already run for antivirus or EDR. Quick to roll out and one console, but tied to that endpoint vendor.
• Firewall security service: the firewall sends every lookup on the network to the vendor's DNS service. Covers every device behind the firewall, including guests and IoT, but not laptops at home.
• SASE or business VPN with DNS filtering: an agent sends traffic through the provider's cloud, which filters DNS alongside web, firewall and private-app access.
• Browser security: protection runs inside the browsers your staff already use.
• Mobile security: a secure DNS feature in a mobile threat defence app for phones and tablets.

Most organisations need two of these working together: something on the network for every device in the office, and something on laptops and phones for when they leave it. Our guide to DNS roaming clients explains the off-site half.

Every DNS security option we supply, compared

Licensing for each of these is set out on our sister site softwarelicensing.uk, and every option is priced on users, devices or appliances, so ask us for a quote. We have deliberately left out products where we could not confirm a genuine DNS-layer feature from the vendor's own material.

Standalone DNS security: Cisco and DNSFilter

A dedicated DNS security service is the most flexible choice. It works whatever firewall or antivirus you run, it covers every device on a network the moment you change the network's DNS settings, and roaming clients extend the same policy to laptops off site.

Cisco. Cisco Umbrella, built on OpenDNS, is Cisco's cloud DNS-layer security service. Cisco has announced that Umbrella's DNS and SIG packages reach their last day to order on 31 January 2027, their last day to renew or add on 31 January 2028 and their last date of support on 31 January 2029, and that Umbrella evolves into Cisco Secure Access. The named successor for DNS security is Secure Access DNS Defense, which Cisco describes as providing all Umbrella DNS features and more, including AI-based detection of DNS tunnelling and domain generation algorithm (DGA) domains. Our Cisco DNS-layer security guide covers every variant from the DNS angle, and DNS Defense vs Umbrella explains what changes. Forever Systems is a Cisco Partner.

DNSFilter. DNSFilter is a cloud DNS security and content filtering service with Core, Plus and Enterprise plans, roaming clients for Windows, macOS, iOS, Android and Chrome, DNS over TLS support, DNSSEC validation and Microsoft Entra ID or Active Directory identity. The vendor now brands its platform LUMINATE by DNSFilter. If you are choosing between the two, read Cisco Umbrella vs DNSFilter.

DNS security from your endpoint or firewall vendor

If you already pay for endpoint protection or a firewall subscription, the quickest route to DNS security may be a feature you can switch on rather than a new product.

Endpoint add-ons. Webroot DNS Protection is added per device to Webroot Business Endpoint Protection. ThreatDown DNS Filtering is an optional add-on available with all ThreatDown bundles. Sophos DNS Protection for endpoints comes with Sophos Workspace Protection, where the Sophos Endpoint agent on Windows forwards lookups to Sophos over HTTPS. The advantage is one agent and one console; the trade-off is that DNS policy only reaches devices running that vendor's agent.

Firewall services. Sophos DNS Protection is included with the Sophos Firewall Xstream Protection bundle at network level, and WatchGuard DNSWatch is part of the Firebox Prime and Total Security Suites. A firewall service protects every device on the network, including printers, guest devices and IoT that cannot run an agent, but it stops at the office door.

Sophos DNS Protection has its own detailed page on our Sophos DNS Protection site, so we do not repeat it here.

Secure DNS vs a business VPN with DNS filtering

People often ask whether they need DNS security or a VPN. They solve different problems.

A secure DNS service, including the secure DNS setting in browsers and Windows, protects the lookup: it encrypts it and, if it points at a protective resolver, blocks dangerous domains. It does not hide or route the rest of your traffic, and it does not give access to private systems.

A business VPN or SASE platform routes traffic through the provider's network, gives staff access to private resources and, in the products we supply, adds DNS filtering on top:

If all you need is protection from malicious domains, a DNS service is simpler. If you also need remote access to private apps, or full web inspection, a SASE platform that includes DNS filtering may replace two products. Check Point's earlier Harmony Connect reached end of life in December 2025, and the current product is covered on our Check Point Harmony SASE pages. See SASE on our Cloud Security site for the wider picture.

How to choose

Start from what you already run and where your people work:

1. List what you have. Endpoint protection, firewall, Cisco or Microsoft licensing and any SASE or VPN product. An add-on you already partly pay for may be the shortest route.
2. Map where devices connect from. Office only, hybrid, field staff, school sites, guest Wi-Fi. Anything that leaves the building needs a roaming client or agent.
3. Decide whether DNS-level control is enough. If you need to block individual pages, inspect files or see search terms, you need a proxy as well. See DNS filtering vs URL filtering.
4. Check encrypted DNS handling. Browsers and apps using their own DNS over HTTPS can bypass a DNS filter, so ask each vendor how they deal with it. See should you block DNS over HTTPS?
5. Check the NCSC criteria. Logging, SIEM export, allow lists, block pages, DNSSEC and privacy commitments, as listed on our protective DNS page.
6. Run a trial on your own traffic before committing, and test that it works on and off site.

Schools have extra requirements under the Department for Education's filtering and monitoring standards; start with web filtering for schools. Eligible public sector bodies should first check the NCSC's free NCSC PDNS.

How Forever Systems helps

Because we supply several DNS security products rather than one, we can recommend the one that fits what you already run, not the one we happen to sell. We can help you:

• shortlist options against your estate, the NCSC criteria and your budget
• run a pilot on your own networks and devices
• set policies, allow lists and block pages, and deploy roaming clients through Intune, Group Policy or your RMM tool
• close the gaps that let DNS security be bypassed, such as unmanaged encrypted DNS and outbound port 53
• bring your DNS security licences onto one Forever Systems account, with the details confirmed at quote

Contact us with a rough count of users, devices and sites and what you run today, and ask us for a quote.