In this article

Review answers to common questions about DNSFilter configuration, filtering, reporting, security, and DNS behavior.

How easy is DNSFilter to configure?

Setup is simple. Forward your DNS to us, usually on your router, firewall, or Domain Controller as a forwarding zone. After your DNS settings send queries to us, you can manage everything from the dashboard, including reporting, a near real-time stream of query traffic, and several reporting views.

Can I have multiple policies on the same network?

Yes. Use NAT IPs to apply different policies to traffic leaving from separate public IP addresses mapped to different Sites. Create LAN Subnets in the dashboard to assign policies to specific internal IP ranges within the same Site. Deploy DNSFilter Relay to enforce policies per internal IP range, or install Roaming Clients on specific devices to assign policies individually.

Can I set different policies for different times of the day or different days of the week?

Yes. Filtering Schedules enable you to apply different policies on a calendar, by time of day and day of the week.

How can I tell which users are accessing which websites?

Filter reports and query logs per user for detailed reporting and troubleshooting. The Users feature also enables administrators to apply specific policies, schedules, and Block Pages to individual users.

Is my information safe on the DNSFilter network?

Yes. DNSFilter works like a constantly changing phonebook, matching internet names to IP addresses. Connections are blocked when a name is a security threat or when your policy blocks it. After a connection is made, DNSFilter has no further part in it, so the information you transfer never touches our servers.

How can I block social media and other time-wasters?

Use the Social Media category to block Facebook, Instagram, Pinterest, and similar sites. 

How quickly does DNSFilter recategorize sites?

In most cases, a submitted domain is recategorized in 24 to 48 hours. You can add the domain to your Allow List or Block List for an immediate change.

Does DNSFilter integrate with Active Directory?

Yes. See Active Directory for more details.

Does DNSFilter support SafeSearch?

Yes. SafeSearch is enforced for Google, Bing, DuckDuckGo, Ecosia, and Yandex. For YouTube, you can also set the level of restriction.

What is DNSFilter's value from a security standpoint?

DNSFilter is the first line of defense in protecting your business. It blocks threats before users reach them, preventing requests to malicious domains, illegal activity, and phishing. Security feeds update our servers within a second, so new threat data protects all customers without any software or definition files to install.

Does DNSFilter offer Multi-factor authentication (or 2FA) for account security?

Yes. Multi-factor authentication (MFA) secures your DNSFilter account by requiring more than a username and password. Since July 1, 2025, MFA is required for all DNSFilter accounts. Set up MFA with an email or device-generated authentication method.

How does DNSFilter handle DNS requests to a large service or CDN provider?

DNSFilter uses the largest public Anycast network. Our transit provider has more than 2,300 BGP peers, more than 19 Internet Exchange memberships, and an open peering policy. The Anycast network automatically reroutes to the next nearest node if one goes offline.

Does DNSFilter send the eDNS0 Client Subnet (ECS) header?

No. DNSFilter does not send the eDNS0 Client Subnet (ECS) header to authoritative servers by default, because that would share client IP information with upstream resolvers. Submit a feature request to vote for this.

Does DNSFilter support DNSSEC?

Yes. DNSFilter supports DNSSEC through two DNSSEC-enabled resolvers on the DNSFilter Anycast network: 103.247.36.9 and 103.247.37.9. These resolvers can be used in place of the standard resolvers (103.247.36.36 and 103.247.37.37), which do not enforce DNSSEC validation by default, without additional configuration. DNSSEC support is currently limited to network-level and DNS Relay deployments and is not yet available through Roaming Clients. For network deployments, see Configure DNS Forwarding on a Network. For DNS Relay, see DNSSEC configuration in Optional Relay configuration parameters. Before switching, note that even domains that support DNSSEC have been known to have failures that last several days or weeks.

Does DNSFilter support DNS over HTTPS (DoH)?

Yes. DNSFilter supports DoH through the resolver endpoint https://doh.dnsfilter.com/dns-query. DoH encrypts DNS requests to improve privacy and security in network-based deployments. NAT IPs are not supported with DoH. For setup steps, see Configure DNS over HTTPS (DoH) with DNSFilter.

Does DNSFilter do HTTPS or SSL scanning?

No. SSL scanning decrypts encrypted traffic, scans it for malware or confidential data, and re-encrypts it before it reaches the destination server. DNSFilter resolves and filters DNS queries and does not have access to web traffic packets, so it cannot inspect encrypted traffic. SSL inspection happens at a layer above DNS resolution and is typically handled by a hardware firewall, often paired with an Intrusion Detection System (IDS).