In short: DNSFilter is a cloud DNS security and content filtering service. It checks every domain lookup against AI-driven threat detection and content categories, blocks malicious or disallowed sites, and applies policy on and off the network through roaming clients for Windows, macOS, iOS, Android and Chrome devices. Plans are Core, Plus (which replaced Pro) and Enterprise.
What DNSFilter does
DNSFilter replaces your organisation's DNS resolver with its own dual anycast network, which answers each lookup at the nearest point of presence. Each lookup is checked in real time, and anything malicious or outside your policy is blocked before a connection is made. The core capabilities are:
- Threat protection against phishing, malware, botnet and command-and-control domains, using AI-driven threat detection
- Content filtering across more than 40 categories, with allow and block lists
- AI-driven website categorisation, so new and obscure sites are classified rather than left uncategorised
- AppAware, for one-click blocking of risky applications rather than hunting down their domains
- DNSSEC validation, plus encryption of DNS traffic for off-network users on untrusted networks
- CyberSight user behaviour analytics, including shadow IT and AI usage reporting
On 27 October 2026 DNSFilter launched LUMINATE by DNSFilter, which presents the service as five suites on one DNS-first engine: Advanced Filtering, Behavior Analytics, AI Governance and Controls, Encryption and Privacy, and Threat Intelligence. The AI Governance and Controls suite brings AI tools in use across the organisation into view with access set by policy, and treats autonomous AI agents as entities with their own policy, including agent connections over MCP (Model Context Protocol). For the bigger picture on governing staff use of AI, see securing generative AI.
Plans: Core, Plus and Enterprise
DNSFilter's current plans are Core, Plus and Enterprise. Plus replaced the earlier Pro plan: it includes everything Pro offered and adds bundled guest Wi-Fi filtering, CyberSight and roaming clients on any platform. Existing subscriptions may still show the Pro name.
| Plan | Typical fit |
|---|---|
| Core | Network-level DNS protection and content filtering for an office or a small team |
| Plus | Most organisations: adds guest Wi-Fi filtering, CyberSight analytics and roaming clients on every platform, so remote devices get the same policy |
| Enterprise | Larger or complex estates, with pricing and terms agreed on request |
Separate programmes exist for managed service providers (with multi-tenancy and branding) and for qualifying education institutions. A 14-day free trial gives access to all generally available capabilities. Log export to a SIEM (Data Export) and premium support are sold as extras. Exact plan contents change, so we confirm them when we quote. For pricing, ask us for a quote; licensing detail is on Software Licensing UK.
Deployment options
DNSFilter can be deployed in several ways, and most organisations combine them:
- Network: point your router, firewall or DHCP server at DNSFilter's resolvers to protect every device on site, including printers and IoT
- Relay: run DNSFilter's relay on site so lookups from individual LAN devices show in the query log without a client on each device, while internal traffic stays private
- Roaming clients: install the agent on Windows, macOS, iOS, Android and Chrome devices so protection and per-user policy follow them off the network
- Guest Wi-Fi: apply a separate policy to visitor and public networks
- Identity: connect Microsoft Entra ID or Active Directory so policies and reports are based on users and groups
Roaming clients are normally deployed through device management such as Microsoft Intune. Single sign-on supports Okta, Microsoft Entra ID (listed by DNSFilter as Azure AD) and OIDC providers.
Reporting and integrations
DNSFilter gives you real-time dashboards, scheduled reports, query logs and exports. With the Data Export add-on, logs can be pushed to your SIEM (Splunk is a listed integration; check the current connector list for others such as Microsoft Sentinel), so DNS activity sits alongside your other security data. An API is available for automation and common integrations.
For schools, DNSFilter's logs and category controls support the reporting side of the DfE filtering and monitoring standards. Our DNS filtering for business and schools guide covers what the standards require and what DNS filtering alone does not provide.
When to move up to a full secure web gateway
DNSFilter is an efficient first layer, but it works on domains. Consider adding or moving to a secure web gateway or SASE platform when you need:
- File and download scanning, not just domain blocking
- URL-level control, for example allowing a cloud storage service for work but blocking personal accounts
- TLS inspection and data loss prevention for uploads and SaaS apps
- Private application access as part of the same service, see ZTNA
Options include Microsoft Entra Internet Access for Microsoft 365 organisations, WatchGuard FireCloud and Todyl. Many organisations keep DNS filtering on the network and guest Wi-Fi even after adding a SWG for managed devices.
How we help
We set DNSFilter up properly rather than just changing a DNS server: site and relay configuration, roaming client deployment, identity integration, category policy for staff, pupils or guests, encrypted DNS bypass controls and scheduled reporting. If DNSFilter is not the right fit, we will say so and compare it with alternatives such as Cisco Umbrella and its successor, Cisco Secure Access. Contact us for a quote or a trial.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is DNSFilter?
DNSFilter is a cloud DNS security and content filtering service. It blocks phishing, malware and unwanted websites at the DNS lookup stage, before they load, and applies policy on and off the network through roaming clients, with Microsoft Entra ID or Active Directory integration for user and group policy.
What happened to DNSFilter Pro?
DNSFilter retired the Pro plan and replaced it with Plus, which includes everything Pro offered and adds guest Wi-Fi filtering, CyberSight analytics and roaming clients on any platform.
What is LUMINATE by DNSFilter?
LUMINATE is the platform DNSFilter launched on 27 October 2026. It groups the service into five suites on one DNS-first engine: Advanced Filtering, Behavior Analytics, AI Governance and Controls, Encryption and Privacy, and Threat Intelligence, with added visibility and policy for AI tools and autonomous AI agents.
Does DNSFilter work on Chromebooks?
DNSFilter lists Chrome devices among its roaming client platforms, alongside Windows, macOS, iOS and Android. Network-level filtering also covers any device on a filtered school network. We confirm support for your Chromebook management set-up before rollout.
Is DNSFilter an alternative to Cisco Umbrella?
Both provide DNS-layer security with roaming clients. Cisco says Umbrella is in a planned end-of-sale and end-of-life transition to Cisco Secure Access, so Umbrella customers are reviewing their options anyway. DNSFilter focuses on DNS-layer protection, analytics and AI governance, while Cisco Secure Access extends to a full cloud security service. The right choice depends on what else you run.