In this article

After successfully testing DNS Forwarding on a single device, use this article to update your network configuration to point all outbound DNS traffic to DNSFilter servers. 

There are different network options available to forward DNS traffic. This article addresses some of the most common configurations and use cases, but ultimately use your best judgement based on your network configuration to complete this step and begin protecting your network from internet threats.

Important Notes

Review these notes before configuring DNS Forwarding on your network.

➡️ Avoid mixing DNS Providers. Many DNS clients are configured to send queries in a round-robin style. Because of this, only list DNSFilter servers in your configuration or some queries will not filter through DNSFilter's servers.

➡️ Do not assign DNSFilter directly to devices. Do not assign DNSFilter's servers directly to your client devices because it will break resolution with local named resources like servers, computers, printers. Set DNSFilter as a DNS forwarder through the means outlined in this article.

Configure DNS Forwarding from any of these network settings:

Router

This configuration uses the router as a DNS forwarder. Queries from network devices go to the router for resolution, and the router then sends WAN queries through the network gateway to DNSFilter.

Router manufacturers have different steps to update DNS forwarding. Consult your router's documentation on DNS Forwarding to add the DNSFilter Anycast IPs to complete this configuration. 

DHCP Server

Configuring DNS Forwarding with a DHCP Server assigns device traffic directly to DNSFilter's IPs.

Note that this configuration will break local by-name resolution (e.g. Jeff-PC; Jane-Printer). On some networks this may not be an issue, such as Guest Wi-Fi.  

DHCP equipment manufacturers have different steps to update DNS forwarding. Consult the manufacturer's documentation on DNS Forwarding to add the DNSFilter Anycast IPs to complete this configuration.

If using a router, this setting is commonly found under the DHCP Server section of the configuration.

Firewall 

Hardware firewalls / virtual appliances can be configured to forward DNS queries to DNSFilter, regardless of what network devices have set on their network adapters.

To set this on your firewall, create either a NAT rule or port-forwarding rule to set all UDP and TCP port 53 traffic to the DNSFilter Anycast IPs.

The Preventing Circumvention and Transparent Proxying articles have example firewall rules.

Active Directory 

Configured DNSFilter as a Forward Zone to protect the entire network by a filtering policy. The recommended minimum Domain Controller size for this deployment is 4 CPUs and 8GB RAM.

Larger organizations also find it useful to install Roaming Clients via Active Directory so individual devices have different filtering policies. This is beneficial in situations where staff or executives need alternate policies from the main site.

When local queries are sent, the Domain Controllers resolve them. When an internet query is sent, the Domain Controller recognizes that it cannot resolve locally, so it will send the query to DNSFilter for resolution. DNSFilter never sees or charges for your local queries.

Follow Microsoft's documentation to set conditional forwarders or configure DNS forwarding by logging on to the Domain Controllers and issuing the PowerShell command below to replace the forwarders with the DNSFilter Anycast IPs. 

# Get the current list of forwarders 
# Useful to save before overwriting 
Get-DnsServerForwarder 

# Set forwarders to DNSFilter 
Set-DnsServerForwarder -IPAddress '103.247.36.36','103.247.37.37' -UseRootHint $False -PassThru

The changes instantly take effect once set. The Domain Controllers will now forward internet queries from all devices through DNSFilter and allow/block based on the filtering policy.

Multi-Site Environments

In a multi-site environment, systems should be configured to use the DNS servers at their local site before those at a different site. This minimizes the amount of DNS traffic crossing slower WAN links.

In a multi-site environment using a single centralized DNS resolver, the Site hosting that resolver determines the policy applied to all DNS traffic.

To enforce site-specific policies based on each Site’s IP address, DNS queries must exit directly to DNSFilter from each Site’s local internet connection rather than traverse the WAN to a central resolver.

If deploying a DNS server at each Site is not feasible, use one of the following approaches to ensure local domains resolve internally and internet traffic does not traverse the WAN unnecessarily:

Deploy Roaming Client

In Classic DNS Filtering mode (default), configure Local Domains so internal queries resolve through the local DNS resolver while internet-bound queries are filtered by the assigned device policy.

In DNS PreCheck mode on supported Windows devices, internal queries follow the DNS resolver provided by the local network or VPN, and internet-bound queries are evaluated locally by the agent. This reduces WAN traversal and maintains site-specific policy enforcement.

Deploy Relay

Install a Relay at each Site without a local DNS resolver and configure Local Domains. Internal queries resolve through the internal DNS server, while internet-bound queries are handled by the Relay. Policies assigned to that Relay and the Site’s LAN Subnet(s) are enforced.