In this article

Adjust settings in Avast Antivirus, Webroot, Panda security products, and ThreatLocker to prevent conflicts with DNSFilter.

Disable Real Site in Avast Antivirus

The Real Site feature in Avast Antivirus proxies DNS queries to Avast DNS servers. Disable Real Site to use DNSFilter.

Real Site is not available in all versions of Avast Antivirus.

To disable Real Site:

1. From the Avast app, navigate to Components.
2. Navigate to Real Site and toggle the feature to disabled.

Turn off DNS Protection in Webroot

Webroot endpoint products have DNS Protection, which is a setting that sends DNS requests to Webroot servers. Turn off this setting so DNS traffic goes to DNSFilter instead of Webroot. Webroot products still provide antivirus and anti-malware protection with this setting off.

To turn off DNS Protection in the policy:

1. From the Webroot app, navigate to Endpoint Protection or Policies, depending on the app version, and select Recommended Defaults.
2. Select DNS Protection.
3. Turn off Install DNS Protection.

This change updates the policy only. Apply the policy to the endpoints to resolve the conflict.

To apply the policy to endpoints:

1. From the Webroot app, select Groups.
2. Create or edit a group that contains all the endpoints with the DNSFilter Roaming Client.
3. Select Edit Policy.
4. Select the policy and apply it to the endpoints.

The policy change takes effect within the next few hours, depending on the polling interval set in the Webroot software. After the change takes effect, DNS traffic can reach DNSFilter, and the Roaming Client, if in use, runs without conflict.

For more information, see the Webroot DNS Protection Administrator Guide.

Disable Panda Safe Web

Panda Antivirus and Panda Dome include Panda Safe Web. On Windows, this feature runs a URL filtering service that conflicts with the DNSFilter Roaming Client proxy, which the Roaming Client needs to function.

To avoid the conflict during installation, clear the Install Panda Safe Web protection against malicious websites checkbox in the installation window. If Panda Safe Web is already installed, disable the service.

To disable Panda Safe Web:

1. From the Windows search bar, search for services.msc
2. In the list of services, right-click panda_url_filtering Service.
3. Select Properties.
4. Set Startup Type to disabled and stop the service.
5. Restart DNSFilter and test DNS resolution.

Allowlist DNSFilter in ThreatLocker

ThreatLocker uses a Zero Trust approach that blocks threats by default. Additional security measures, such as adding the DNSFilter Roaming Client to the network environment, require allowlisting in ThreatLocker to avoid conflicts.

Signs that ThreatLocker is blocking the Roaming Client

If the Roaming Client is not allowlisted and ThreatLocker quarantines it, these issues can occur:

• End users can lose internet connectivity.
• Some elements of DNSFilter policies, such as the SSL certificate, can fail to install.
• Query traffic to internal servers can stop.

Resolve the conflict

If ThreatLocker is the cause, adjust the ThreatLocker account settings to allow DNSFilter. The DNSFilter processes and file paths to allowlist are listed under Application allowlisting in Security best practices for DNSFilter deployments in regulated environments.

If that does not solve the problem, try these troubleshooting steps:

• Review all firewall, VPN, and existing DNS configurations to confirm nothing blocks DNSFilter. For guidance, see Prepare for DNSFilter deployment and Understanding potential conflicts with DNSFilter.
• Confirm DNS traffic resolves through DNSFilter.
• Check IPv6 and local domain settings. A misconfiguration in either can cause lost connectivity for some websites but not others.

Related content

• Understanding potential conflicts with DNSFilter
• Block browser proxy and VPN features to prevent filtering circumvention