In this article

How easy is DNSFilter to configure?

Setup is simple. Forward your DNS to us, usually on your router, firewall, or Domain Controller as a forwarding zone. After your DNS settings send queries to us, you can manage everything from the dashboard, including reporting, a near real-time stream of query traffic, and several reporting views.

Can I have multiple policies on the same network?

Yes. Use NAT IPs to apply different policies to traffic leaving from separate public IP addresses mapped to different Sites. Create LAN Subnets in the dashboard to assign policies to specific internal IP ranges within the same Site. Deploy DNSFilter Relay to enforce policies per internal IP range, or install Roaming Clients on specific devices to assign policies individually.

Can I set different policies for different times of the day or different days of the week?

Yes. Filtering Schedules enable you to apply different policies on a calendar, by time of day and day of the week.

How can I tell which users are accessing which websites?

Filter reports and query logs per user for detailed reporting and troubleshooting. The Users feature also enables administrators to apply specific policies, schedules, and Block Pages to individual users.

Is my information safe on your network?

Yes. DNSFilter works like a constantly changing phonebook, matching internet names to IP addresses. Connections are blocked when a name is a security threat or when your policy blocks it. After a connection is made, DNSFilter has no further part in it, so the information you transfer never touches our servers.

How can I block social media and other time-wasters?

Use the Social Media category to block Facebook, Instagram, Pinterest, and similar sites. We also maintain lists of each of these sites so that you can add any of them to your Allow List if necessary.

How responsive are you to recategorize sites?

In most cases, a submitted domain is recategorized in 24 to 48 hours. You can add the domain to your Allow List or Block List for an immediate change.

Do you integrate with Active Directory?

Yes. See Active Directory for more details.

Do you support SafeSearch?

Yes. SafeSearch is enforced for Google, Bing, DuckDuckGo, Ecosia, and Yandex. For YouTube, you can also set the level of restriction.

What is DNSFilter's value from a security standpoint?

DNSFilter is the first line of defense in protecting your business. It blocks threats before users reach them, preventing requests to malicious domains, illegal activity, and phishing. Security feeds update our servers within a second, so new threat data protects all customers without any software or definition files to install.

Do you offer Multi-Factor Authentication (or 2FA) for account security?

Yes. Multi-factor authentication secures your DNSFilter account by requiring more than a username and password. Since July 1, 2025, MFA is required for all DNSFilter accounts. Set up MFA with an email or device-generated authentication method.

How are my DNS requests to a large service or CDN provider handled?

DNSFilter uses the largest public Anycast network. Our transit provider has more than 2,300 BGP peers, more than 19 Internet Exchange memberships, and an open peering policy. The Anycast network automatically reroutes to the next nearest node if one goes offline.

Does DNSFilter send the eDNS0 Client Subnet (ECS) header?

No. DNSFilter does not send the eDNS0 Client Subnet (ECS) header to authoritative servers by default, because that would share client IP information with upstream resolvers. Submit a feature request to vote for this.

Does DNSFilter support DNS over HTTPS (DoH)?

Yes. DNSFilter supports DoH through the resolver endpoint https://doh.dnsfilter.com/dns-query. DoH encrypts DNS requests to improve privacy and security in network-based deployments. NAT IPs are not supported with DoH. For setup steps, see Configure DNS over HTTPS (DoH) with DNSFilter.

Does DNSFilter do HTTPS or SSL scanning?

No. SSL scanning decrypts encrypted traffic, scans it for malware or confidential data, and re-encrypts it before it reaches the destination server. DNSFilter resolves and filters DNS queries and does not have access to web traffic packets, so it cannot inspect encrypted traffic. SSL inspection happens at a layer above DNS resolution and is typically handled by a hardware firewall, often paired with an Intrusion Detection System (IDS).