Skip to main content

How can we help you?

Search

help Knowledge Base
forum Community
checklist Release Notes
event Events

Install Windows Roaming Client

Minetta Gould
  • Updated

    In this article

Install the Windows Roaming Client to protect roaming Windows devices with DNS filtering. Admins use this article to install the Roaming Client and confirm that it is filtering. 

Because the Roaming Client does not need a known IP address, it also works on networks where the Internet service provider (ISP) uses Carrier-Grade Network Address Translation (CGNAT). Related content links to other deployment methods.

Prerequisites

Installing the Windows Roaming Client requires:

  • Windows 10 or higher (x64)
  • .NET Framework 4.8.1 or higher
  • .NET Desktop Runtime 8.0, for agent v2.1.0 and higher
  • A Site to associate with the Roaming Client
  • Devices that are turned on and connected to the internet during installation

The Roaming Client does not support Windows Server, domain controllers, shared desktop environments, or Windows 365 Cloud PC. Review supported OS versions and known environment limitations before proceeding.

Prepare the network environment

Preparing the network environment for deployment can prevent errors, misconfigurations, and internet connectivity issues. These articles help the deployment run smoothly from the start:

Confirm VPN compatibility so the Roaming Client and the VPN work together smoothly. VPN compatibility differs between connection and filtering mode selections. Consult these known conflicts and configuration setups for more details:

Install the Windows Roaming Client

Ensure devices are on and connected to the internet during the installation process.

Before installation, create a Site to associate with the Roaming Client.

Step one: Download the installer and copy the Site Key

  1. From the DNSFilter dashboard, navigate to Deployments > Roaming Clients.
  2. Select Install Roaming Client.
  3. Select the Site to associate with the agent.
  4. Choose the Roaming Client OS.

  5. Download the DNSFilter installer.

    Installers are available for x64 and ARM64 systems, and are labeled Production or Beta when applicable.

  6. Copy the Site Key.

After a new Roaming Client release, the installer file may take up to 24 hours to become available. The dashboard always provides the versioned link for the current release.

Step two: Run the installer

  1. Run the installer package.
    1. Paste in the Site Key when prompted by the installer.
    2. Click through the installer and agree to any security prompts.

The Roaming Client is now active and filtering DNS requests. A tray icon appears and shows active status. If the tray icon shows an error (the icon appears red or offline), see Roaming Client troubleshooting.

Step three: Update the Filtering Mode (optional)

As of agent version 3.0.0, the Windows Roaming Client supports Connection and Filtering modifications for greater flexibility in how roaming devices are protected. This step is optional; newly deployed agents default to Classic DNS Filtering mode.

Filtering Mode changes apply only to supported agent operating systems. The setting does not apply to unsupported agents.

Before selecting DNS PreCheck, review DNS PreCheck Software Conflicts and Known Limitations.

To update the Filtering Mode:

  1. From the DNSFilter dashboard, navigate to Deployments > Roaming Clients.
  2. Open Control Center to update the entire Organization, or select the checkbox next to Hostname to modify individual agents.
  3. Select Filtering Mode.
  4. Select the configuration that fits the deployment:
    • Classic DNS Filtering: Enforces filtering at all times, ensuring strong security and privacy in fail-closed mode
    • DNS PreCheck: Balances filtering and connectivity using PreCheck with fail-open mode
    • Custom (Advanced): Allows administrators to define connection, filtering, and failover behavior directly

After the agent’s next check-in, typically within five minutes, filtering and connectivity follow the selected mode. To confirm the change, check the tray icon. The Connection Mode and Filtering Mode shown there reflect the dashboard selections.

Switch to DNS PreCheck after updating to v3.x.x

Switching to DNS PreCheck after updating from an earlier agent version does not require removing existing agent-applied DNS settings. The agent automatically cleans up loopback entries during the upgrade.

Step four: Test the connection

  1. Visit debug.dnsfilter.com to verify that the Roaming Client is active and filtering the desired categories.
  2. Browse to a well-known domain that the agent’s policy allows, such as google.com.
  3. In Incognito Mode, visit a domain on the policy Block List.

DNSFilter recommends testing the policy with a small, mixed group of users before a mass deployment. Include users from different departments, permission levels, or experience levels, and test for one to two days with multiple devices to fine-tune settings and confirm smooth operation.

Send local DNS traffic to internal resources (optional)

Adding Local Domains is optional and required only for agents that use loopback-based routing.
When Local Domains are configured, the agent sends matching DNS queries to the internal DNS resolver instead of DNSFilter. This helps networks with Split-Horizon DNS, internal-only domains, or corporate systems that return different IP addresses inside the local area network (LAN).

Loopback (Classic DNS Filtering) mode requires Local Domains and Local Resolvers configuration.

Transparent Proxy (DNS PreCheck) mode does not require this configuration. Internal DNS routing follows the DNS resolver that the device’s network or VPN provides.

Avoid filtering interruptions with DNS-over-TLS (optional)

The Roaming Client can use DNS-over-TLS (DoT) when communicating with DNSFilter. DoT prevents DNS interception or modification by third-party software or middleboxes, and improves reliability in environments where DNS traffic may be inspected, modified, or rate-limited.

DoT is supported only in Classic DNS Filtering agent mode. DoT keeps filtered DNS traffic between the agent and DNSFilter encrypted and less vulnerable to interference.

The article on enabling DNS-over-TLS explains how to configure this feature for Roaming Clients.

Other ways to deploy the Windows Roaming Client, including with remote monitoring and management (RMM) tools, mobile device management (MDM) tools, and Active Directory:

Moving to DNSFilter from another filtering service? The Migrating to DNSFilter section has onboarding materials to help streamline the process.

Learn more about Roaming Clients

Was this article helpful?
11 out of 18 found this helpful
Return to top

Comments

0 comments

Please sign in to leave a comment.