In this article

Use this article to reduce DNS filtering bypass by preventing end users from installing or accessing unauthorized browsers, including agentic AI browsers and browsers with built-in VPN, proxy, or encrypted DNS features.

Blocking alternative and agentic AI browsers requires endpoint enforcement first. DNSFilter complements this strategy by preventing future access to browser downloads, proxy services, and AI-driven tools, but cannot replace operating system controls.

Why alternative browsers create risk

Alternative and agentic AI browsers may:

• Manage DNS internally
• Use encrypted DNS, proxies, or VPNs
• Bypass DNS-based filtering
• Automate actions with access to corporate resources, creating security risks

Once installed, these tools can reduce policy effectiveness. Prevention is most effective before installation.

Control endpoint access

Windows devices

Prevent browser installation using operating system controls:

• Remove local administrator privileges
• Use AppLocker or Windows Defender Application Control (WDAC)
• Block browser installer executables such as:
  • chrome_installer.exe
  • firefox_setup.exe
  • bravebrowser_setup.exe
  • opera_installer.exe

These controls prevent users from installing unauthorized or agentic AI browsers.

macOS devices

Prevent browser installation using MDM controls:

• Allowlist approved browsers only
• Block execution of unmanaged applications
• Restrict software installation outside managed workflows

Use MDM platforms such as Jamf, Kandji, or Mosyle to enforce these policies.

DNSFilter configuration recommendations

DNSFilter cannot prevent circumvention once an unauthorized browser is installed. However, the following steps reduce future attempts and limit exposure:

• Add known browser and AI browser domains to Policy Block Lists. Here's a source that lists many tools and can assist with discovery
• Block Proxy and Filter Avoidance and Generative AI categories where appropriate
• Add allowed tool domains to Policy Allow Lists

These controls help prevent access to browser download sites, AI-driven browsers, and proxy services that enable DNS filtering bypass.

Important limitations

• DNSFilter cannot block applications already installed on the device
• Portable or user-space browsers may still function without endpoint controls
• Unmanaged or personal devices are outside enforcement scope

Effective prevention requires DNSFilter combined with endpoint management and application control.