In short: DNS filtering is a security control that checks every domain a device looks up against threat intelligence and content categories, and blocks malicious or disallowed sites. It is fast to deploy and covers every app on the device, but it cannot inspect pages or files, so it complements rather than replaces a secure web gateway.
How DNS filtering works
Before a browser, app or piece of malware connects to a website, the device asks a DNS resolver to turn the name (example.co.uk) into an IP address. A DNS filtering service replaces your normal resolver. For every lookup it checks the domain against threat feeds and category lists and either answers normally or returns a block page.
Because it acts at the very first step, DNS filtering:
- Stops phishing, malware and command-and-control domains before any content downloads
- Enforces acceptable use by category: adult content, gambling, file sharing, newly registered domains and so on
- Covers every application, not just the browser
- Adds almost no latency and needs no certificates on devices
- Produces a log of who looked up what, which is useful for investigations and safeguarding
Limits of DNS filtering
DNS filtering is a first layer, not a complete web security answer. Know its limits before relying on it:
- It sees domains, not content. It cannot block one bad page on an otherwise trusted site, scan a download or stop data being uploaded.
- It can be bypassed by devices using encrypted DNS (DNS over HTTPS) to an outside resolver, a VPN, or by connecting straight to an IP address. Good services detect and block common bypass methods, and device policy should disable unmanaged DoH.
- It does not inspect encrypted traffic, so it cannot apply data loss prevention.
- Off-site devices need a client, otherwise they fall back to whatever resolver the home or hotel network provides.
When you need file scanning, URL-level control or inline DLP, step up to a full secure web gateway or a SASE platform. Our secure web gateway guide compares the two approaches in detail.
Deployment: network, roaming clients and guest Wi-Fi
There are three common ways to apply DNS filtering, and most organisations use more than one:
| Method | How it works | Best for |
|---|---|---|
| Network level | Point the router, firewall or DHCP server at the filtering service, usually with a relay so internal names still resolve | Office networks and every device on them, including printers and IoT |
| Roaming client | A lightweight agent on Windows, macOS, iOS, Android or ChromeOS sends lookups to the service wherever the device is and identifies the user | Laptops and mobiles that leave the building, and per-user policy |
| Guest and public Wi-Fi | A separate policy applied to guest networks | Visitors, BYOD and public access |
Roaming clients are usually pushed through device management such as Microsoft Intune. Integration with Microsoft Entra ID or Active Directory lets you apply policy and report by user or group rather than by IP address.
DNS filtering for UK schools
Schools and colleges must have appropriate filtering and monitoring under Keeping children safe in education (KCSIE). The 2026 edition came into force on 1 September 2026. The Department for Education's filtering and monitoring standards (last updated 16 September 2026) set out what appropriate looks like. For filtering, they expect:
- A member of the senior leadership team and a governor made responsible for meeting the standards, with the designated safeguarding lead and IT support (in-house or external) sharing the day-to-day work
- A review of filtering and monitoring at least once every academic year, and whenever risks or the set-up change, for example new devices, BYOD, generative AI tools, major software updates or network changes, with results and actions recorded
- The Internet Watch Foundation (IWF) and Counter-Terrorism Internet Referral Unit (CTIRU) block lists implemented so that no user, including system administrators, can disable, override or alter them
- Filtering on school-managed devices including when they are used off site, on unmanaged BYOD devices and for guests, with unmanaged devices kept on a separate virtual network, and on every internet feed, including backup connections and portable Wi-Fi devices
- Blocking of VPNs, proxy services and other circumvention methods
- Logs that record the device name or ID, IP address, the individual where possible, the time and date, and the search term or content blocked
- Safe search enabled by default and locked, with users unable to install other browsers or unauthorised plugins
- Regular, documented checks that the filter works, for example with the South West Grid for Learning (SWGfL) test tool, covering at least child abuse material, terrorist content and adult content
DNS filtering with a roaming client is a common way to meet the device and off-site requirements. The standards expect your provider to be an IWF member, signed up to CTIRU and regularly updating its lists, so check those points, and that it can apply different policies for staff and pupils. Pair it with monitoring, which DNS filtering alone does not provide, and with security awareness training for staff.
DNS filtering options compared
| Option | What it is | Notes |
|---|---|---|
| DNSFilter | Dedicated DNS security service with AI-driven domain categorisation, roaming clients and per-user policy | Separate business and education programmes. See our DNSFilter page |
| Cisco Umbrella and Cisco Secure Access | Cisco's DNS-layer security. Cisco says Umbrella has evolved into Cisco Secure Access and is in a planned end-of-sale and end-of-life transition; the Secure Access DNS Defense package covers the Umbrella DNS features | Existing Umbrella services continue under their subscription terms. See Cisco Umbrella and Cisco Umbrella end of life |
| ThreatDown DNS Filtering | Optional add-on available with all ThreatDown endpoint bundles, centrally managed and built for multi-tenant use | Suits ThreatDown endpoint customers |
| DefensX | Browser-layer protection that includes advanced DNS security, secure browsing and credential theft protection | See DefensX |
| WatchGuard DNSWatch | WatchGuard's DNS-level filtering service | Fits WatchGuard estates; FireCloud adds full cloud web security |
| DNS filtering inside SASE | Most SASE and SSE services include DNS filtering alongside other controls | For example NordLayer and Todyl |
We do not rank these on catch rates. The right choice depends on what you already run, whether you need per-user reporting, and whether schools' safeguarding requirements apply.
How we help
We review how DNS is resolved across your sites and devices today, find the gaps (home working, guest Wi-Fi, backup connections, encrypted DNS bypass), recommend a service and roll it out: network configuration, roaming client deployment, identity integration, category policy and reporting. For schools we map the set-up to the DfE standards so your annual review has the evidence it needs. Contact us to get started.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is DNS filtering?
DNS filtering checks each website name a device looks up against threat intelligence and content categories, and blocks the lookup if the site is malicious or not permitted. Because it works before a connection is made, it stops many phishing and malware sites from loading at all.
Is DNS filtering enough on its own?
For many small organisations it is a strong first layer, but it cannot scan files, block individual pages on trusted sites or prevent data uploads. Organisations that need those controls add a secure web gateway or SASE platform.
Can DNS filtering be bypassed?
Yes, by using an outside encrypted DNS resolver, a VPN or a direct IP address. A good service detects common bypass methods, and device policies should block unmanaged encrypted DNS and VPN apps.
Does DNS filtering work for remote workers?
Yes, if devices run a roaming client. The client sends DNS lookups to the filtering service from any network and identifies the user, so policy and reporting follow the device.
What filtering do UK schools need?
Schools and colleges must have appropriate filtering and monitoring under KCSIE 2026. The DfE filtering and monitoring standards expect IWF and CTIRU block lists that no one can switch off, filtering on and off site and for BYOD and guests, bypass prevention, detailed logging, regular testing, a review at least every academic year and a named senior leader and governor responsible.
How much does DNS filtering cost?
DNS filtering is usually licensed per user or per device, and some providers have separate education programmes. Ask us for a quote based on your users, devices and sites.