In short
PDNS for Schools is the NCSC's free Protective Domain Name Service for UK education. It stops school devices reaching domains known to host malware, ransomware, spyware and phishing. Since October 2024 all UK schools can use it, usually through their DNS provider. It complements, but does not replace, the school's safeguarding web filter.
Get a quote for school DNS filtering
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What PDNS for Schools is
PDNS for Schools is a cyber security service developed by the NCSC to protect schools from online threats. It is the education version of the NCSC's protective DNS service, which the NCSC has offered to UK public sector organisations since 2017.
Protective DNS works at the point where a device turns a name, such as a website address, into an IP address. The Department for Education's Cyber Security Hub describes it simply: devices send their DNS queries to the PDNS service, which checks each requested domain against a threat intelligence database. If the domain is safe, the request goes ahead as usual; if it is flagged as malicious, the request is blocked.
According to the NCSC and the DfE, it:
- blocks access to known-malicious domains, including those hosting malware, ransomware and spyware, and phishing sites
- helps prevent data exfiltration through DNS requests, which the DfE's Cyber Security Hub lists as a benefit; see DNS exfiltration for how that works
- costs nothing: the NCSC offers it free of charge
- needs no extra hardware, according to the DfE, and integrates with existing school networks
The NCSC says the full launch builds on its partnership with Cloudflare and Accenture, who implement the wider NCSC PDNS service, and that PDNS for Schools is part of a wider NCSC offer of cyber security guidance and tools for schools.
Who can sign up
After a first phase, the NCSC announced the full launch on 15 October 2024 and said all UK schools could now benefit. The NCSC lists these groups as able to use the service:
| Who | Notes from the NCSC |
|---|---|
| Local authorities or eligible public sector networks in Scotland, Wales and Northern Ireland | Where they provide DNS to their schools |
| Local authorities in England | Where they provide DNS to their maintained schools |
| School internet service providers in England | Those who manage school DNS services and have wide reach into the school sector |
| Multi-academy trusts, academies and independent schools | Those that do not receive their DNS from any of the providers above and are able to implement the service |
In practice, most schools get PDNS through whoever already provides their DNS: the local authority, the school's internet provider or the trust. A trust or independent school that runs its own DNS can register itself if it is able to implement the service. The NCSC reviews eligibility over time, so check its PDNS pages for the current position.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How to sign up for PDNS for Schools
The NCSC says educational organisations sign up by asking their DNS provider to register for PDNS through MyNCSC, the NCSC's portal. If you are unsure who your DNS provider is, the NCSC suggests asking whoever manages your school's IT or internet connection to check whether your DNS provider is eligible. The DfE's Cyber Security Hub puts it the same way from the school's side: apply through your local authority, your multi-academy trust, or directly through the NCSC.
- Find out who resolves your DNS. Ask your IT support or internet provider. It might be the local authority, a school ISP, your trust, your filtering provider or your own servers.
- Ask them whether they already use PDNS for Schools. Many school networks may already be covered.
- If not, ask them to register through MyNCSC, or, if your trust or school runs its own DNS and is eligible, register through MyNCSC yourself.
- Check it is working once it is live: confirm which resolver devices really use, on site and off site. Our DNS security test guide shows how.
Forever Systems does not run, resell or register NCSC PDNS, and we cannot sign in to MyNCSC on your behalf. We can help your IT team work out where your DNS is resolved and what needs to change.
PDNS for Schools is not a web filter
This is the most important point on this page. The NCSC says PDNS for Schools helps prevent malware, ransomware, phishing attacks and other online threats from reaching school networks, and that it complements (but does not replace) the safeguarding filtering measures that schools should already have in place.
The DfE's Cyber Security Hub describes PDNS as supporting safeguarding policies and Keeping Children Safe in Education by restricting access to harmful content. That is true as far as it goes: malicious sites are harmful. But it is not the same as the appropriate filtering KCSIE expects.
| What schools need | PDNS for Schools | A school web filter |
|---|---|---|
| Block known-malicious domains (malware, ransomware, spyware, phishing) | Yes | Many do, through security categories; ask your provider |
| Block inappropriate content such as pornography, gambling or self-harm by category | Not described by the NCSC as part of the service, which targets malicious domains | Yes, by content category |
| IWF and CTIRU blocklists that cannot be disabled | Not described by the NCSC as part of the service | Expected by the DfE standards; ask your provider |
| Separate staff and student profiles | Not described by the NCSC | Expected by the DfE standards |
| Safe search enforcement | Not described by the NCSC | Expected by the DfE standards; ask your provider |
| Logs showing device or user, time and content blocked | Not described for schools | Varies by product; the DfE expects it |
| Monitoring and safeguarding alerts | No: the NCSC presents it as a cyber security service | No: monitoring is a separate job |
So PDNS for Schools belongs in the cyber security part of your plan, and your web filter belongs in the safeguarding part. A school can benefit from both. Our web filtering for schools guide covers the filtering side.
Is school DNS filtering the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How PDNS sits alongside your school's web filter
Because both services work through DNS, how they fit together depends on where your DNS is resolved:
- Your local authority or school ISP provides DNS and filtering. Ask whether PDNS for Schools is already part of their service. If it is, there may be nothing for you to do.
- You run your own DNS servers that forward to the internet. Your provider or IT team may be able to forward to PDNS while your web filter works at another layer, such as a proxy or device client. Check this with whoever designed your network.
- Your web filter is itself a cloud DNS resolver, such as Cisco Umbrella, Cisco Secure Access DNS Defense or DNSFilter. Devices send their lookups to that service, which already blocks malicious domains in its own security categories. Ask your provider how PDNS for Schools fits into that chain before changing anything, so you do not break filtering or create a gap.
Whichever model you have, the same rules apply: make sure every device's DNS really goes where you think it does, block outbound DNS that bypasses it, and control browser DNS over HTTPS, as the NCSC recommends. See should you block DNS over HTTPS?
For devices off site, the NCSC's wider PDNS service offers PDNS Roaming for Windows, macOS and iOS. Chromebooks and Android devices are not on that list, so a school with Chromebooks at home will usually rely on its web filter's Chromebook client; see DNS roaming clients.
How we can help
PDNS for Schools is a sensible, free first layer and we encourage eligible schools to use it. Around it, Forever Systems can help schools, colleges and trusts with:
- Finding out where DNS is resolved today, on every site, on guest Wi-Fi and on devices that go home
- Web filtering for safeguarding, with Cisco DNS-layer security or DNSFilter and staff, student and guest policies
- Closing bypass routes such as other DNS servers, browser DNS over HTTPS, VPNs and proxies
- Roaming and Chromebook clients so school devices stay protected at home
- Testing and recording filtering checks for your annual review; see our school web filter test guide
For the wider school security picture, see Cyber Essentials for schools and security awareness training for schools. Contact us to talk about protective DNS and filtering for your school or trust.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is PDNS for Schools?
PDNS for Schools is the NCSC's free Protective Domain Name Service for UK education. It checks the domains school devices look up against threat intelligence and blocks those known to host malware, ransomware, spyware or phishing, before a connection is made.
Which schools can sign up for PDNS for Schools?
Since October 2024 all UK schools can benefit. The NCSC lists local authorities and devolved public sector networks that provide DNS to schools, school internet service providers in England, and multi-academy trusts, academies and independent schools that run their own DNS and can implement the service.
How do schools sign up for PDNS?
Ask your DNS provider to register for PDNS through MyNCSC. If you are not sure who provides your DNS, ask whoever manages your school's IT or internet connection. The DfE says schools can apply through their local authority, their multi-academy trust or directly through the NCSC.
Is PDNS for Schools a content filter?
No. It blocks known-malicious domains. The NCSC says it complements, but does not replace, the safeguarding filtering schools should already have, so you still need a web filter that blocks inappropriate content under KCSIE and the DfE standards.
Does PDNS for Schools replace our web filter?
No. Keep your web filter for safeguarding and treat PDNS for Schools as a cyber security layer. How the two fit together depends on where your DNS is resolved, so check with your DNS or filtering provider before changing settings.
Is PDNS for Schools free?
Yes. The NCSC offers PDNS for Schools free of charge, and the DfE says it needs no additional hardware.
Still have a question about school DNS filtering?
Ask us and a member of our team will reply by email.