How DNSFilter works

What happens to each DNS lookup

Every website visit, email link and app connection starts with a DNS lookup. DNSFilter takes over that step from your ordinary resolver, so it can refuse to answer for domains you do not want reached. In order, this is what happens:

1. The lookup reaches DNSFilter. A device asks for a name, and your router, firewall, domain controllers, the DNSFilter relay or a roaming client sends the query to DNSFilter's resolvers instead of your internet provider's.
2. DNSFilter works out whose lookup it is. It matches the query to a site (by the network's public IP address), a roaming client or, on the Plus plan with identity integration, a user, and picks the filtering policy assigned to it.
3. The domain is checked. DNSFilter checks the name against its threat categories, its machine-learning Malicious Domain Protection, the content categories your policy blocks, AppAware application lists and your own allow and block lists.
4. Blocked lookups go to a block page. Instead of the real address, the device is sent to a DNSFilter block page, hosted by DNSFilter or your own, so the user sees why the site did not load.
5. Everything else resolves normally. Allowed lookups are answered from the nearest point of DNSFilter's dual anycast network, and the query is recorded in the query log and reports.

Because the decision is made before any connection is opened, malicious servers never receive a packet from the device, and the same policy applies to every application, not just the browser. That is the core idea of protective DNS, and DNSFilter lists the selection criteria the NSA and CISA published for protective DNS providers, including DGA protection, machine-learning detection, content filtering, DNSSEC validation and DoH and DoT support, as capabilities it provides. For a vendor-neutral view of the layer, see DNS-layer security.

DNSFilter DNS servers and how traffic reaches them

DNSFilter publishes its anycast resolver addresses on its own website, and they are the addresses you forward to when you protect a network:

How lookups get there depends on the deployment, and most organisations combine more than one:

• Network forwarding: point the router, DHCP server or firewall at DNSFilter. DNSFilter's guidance is to list only DNSFilter's servers, because devices that round-robin between providers would skip the filter for some lookups, and to forward through the router, firewall or domain controllers rather than setting DNSFilter directly on devices that need to find local printers and servers.
• Firewall enforcement: a NAT or port-forwarding rule that sends all port 53 traffic to DNSFilter stops users getting round the filter by changing their own DNS settings, which DNSFilter suggests for schools.
• Active Directory: set DNSFilter as the forwarders on your domain controllers. Internal names are still answered by your own DNS, and only internet lookups go to DNSFilter.
• Relay: DNSFilter's relay application sits on your network, sends private lookups to your internal DNS and public ones to DNSFilter, and gives you more detailed query logs for the devices behind it.
• Roaming clients: an agent on Windows, macOS, iOS, Android and Chrome devices, covered in the next sections and in our guide to DNS roaming clients.

DNSFilter runs a dual anycast network, so each query is answered by the nearest resolver and traffic moves automatically if a data centre is taken out of service.

Threat protection: what DNSFilter blocks

DNSFilter's threat settings sit in each filtering policy, and the threat categories it lets you block include:

These matter most against the attacks on our DNS attacks page. Malware calling home to command-and-control servers, DNS tunnelling and data theft over DNS all depend on lookups that DNSFilter can refuse, and DNSFilter describes DGA detection, block lists of known malicious domains and detection of unusual DNS traffic patterns as its defences against tunnelling. For checking individual domains yourself, see our malicious domain checker guide.

DNSFilter also validates DNSSEC, which helps protect lookups against spoofed and poisoned answers. Connections that skip DNS altogether, such as malware using a hard-coded IP address, are the job of endpoint protection and your firewall, so DNSFilter works alongside them rather than in place of them.

Content categories, AppAware and SafeSearch

Content filtering uses the same lookup. DNSFilter's AI categorises domains as they are queried, including sites it has never seen before, and sorts them into around 40 content categories you can block per policy, among them Adult Content, Gambling, Drugs, Self Harm, Terrorism & Hate, Social Networking, Streaming Media, Games and Generative AI Tools. Its category list also includes one named Internet Watch Foundation & Project Arachnid, which UK schools will want to see when they review their filtering.

Alongside categories, each policy can use:

• AppAware, which maps an application to every domain it uses so one setting blocks the whole app, such as a remote desktop tool or a chat service
• SafeSearch enforcement on search engines
• Allow and block lists, per policy or across the whole organisation with universal lists
• Scheduled policies for different times of day or week
• Privacy settings that block advertising and tracker domains
• Per-user policies and reporting, through Microsoft Entra ID or Active Directory, on the Plus and Enterprise plans

If a site looks wrongly categorised, DNSFilter's Domain Report tool shows how it is classified, and a hosted block page can include a form so staff can ask for a site to be unblocked. DNS filtering decides on whole domains; if you need to treat individual pages differently, read DNS filtering vs URL filtering.

Roaming clients, DNS PreCheck and encrypted DNS

Network forwarding stops at the office door, so DNSFilter's roaming clients carry the same policy to devices on home broadband, public Wi-Fi and mobile data. DNSFilter describes the roaming client as a lightweight agent that sends the device's DNS to DNSFilter, encrypts the queries and embeds the device's identity so policy and reports work per device. It runs on Windows, macOS, iOS, Android and Chrome devices and is usually deployed silently through Microsoft Intune, another MDM or an RMM tool. On Windows, the agent can pick up internal domain suffixes from DHCP, Active Directory or Group Policy, so internal names keep resolving to your own DNS servers.

DNS PreCheck, released in March 2026 for the Windows roaming client and listed on the Plus plan, moves the filtering decision onto the device. It uses a transparent proxy rather than redirecting the device's DNS settings, which DNSFilter says avoids the usual conflicts with VPNs and lets users through hotel and airport captive portals while staying protected.

On encrypted DNS, DNSFilter supports both main standards:

The other side of encrypted DNS is bypass: a browser using its own DNS over HTTPS provider can skip any DNS filter. DNSFilter's own guidance is to block or control third-party DoH resolvers, and it keeps a community list of DoH resolvers to help. We set browser and operating system policies at the same time; see should you block DNS over HTTPS?

How to test DNSFilter

DNSFilter publishes test domains so you can prove a policy works without visiting real harmful sites. Every category has its own name under filterdns.net:

From a device on a protected network, or one running a roaming client, a blocked category should show your block page. If the page fails to load with an error instead, the category is not blocked in that policy or the site is not set up correctly. The test lookups also appear in the query log and reports, which is expected and confirms the test reached DNSFilter.

Two things to know when testing. HTTPS block pages need DNSFilter's certificate on the device; it installs automatically with the Windows roaming client, and without it HTTPS sites stay blocked but show a browser error rather than the block page. And repeat the test off site, on home Wi-Fi and mobile data, to prove the roaming client is doing its job. Our DNS security test guide covers wider checks, and schools should also run the school web filter test.

Plans, schools and how we help

DNSFilter's plans are Core, Plus and Enterprise. Core protects networks you control; Plus adds roaming clients on every platform, DNS PreCheck, guest Wi-Fi, identity integration, per-user policies and reporting, and CyberSight user behaviour analytics. Qualifying schools and colleges have education licences with the Plus feature set, including iOS and Android roaming clients, covering one device per user. DNSFilter now presents the whole service as LUMINATE by DNSFilter, a DNS-first platform with five suites: Advanced Filtering, Behavior Analytics, AI Governance and Controls, Encryption and Privacy, and Threat Intelligence. The full plan comparison is on DNSFilter plans at Software Licensing UK.

Forever Systems supplies DNSFilter alongside the other options on our DNS security solutions page, so we can set it against what you already run. If you are weighing it against Cisco, read Cisco Umbrella vs DNSFilter. We can help you:

• choose between Core and Plus, or an education licence, based on where your devices work
• set up sites, forwarding, the relay and firewall rules so lookups cannot simply go round the filter
• build threat and content policies, block pages and unblock requests for staff, pupils and guests
• deploy roaming clients through Intune, Group Policy or your RMM tool and connect Microsoft Entra ID
• test every policy on and off site and tune it during the first weeks
• bring an existing DNSFilter subscription onto your Forever Systems account, with licences that can be billed monthly and terms confirmed at quote

Contact us with your rough numbers of users, devices and sites, and ask us for a quote or a trial.