DNSFilter

No entries match these filters. Clear filters

1. 11/03 November 3 – Web Application and API Update (2026-11-03) Nov 3, 2026 · issue 130

   DNSFilter adds a Branding settings page for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. with CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin.-based custom domains, replacing the legacy Whitelabel page⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When migrating a CNAME-based MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. white-label setup to the new managed branding subdomain, locate the replaced page in the dashboard.
   📍In the MSP dashboard, go to Settings › Branding (previously Settings › Whitelabel) to upload logos and configure your managed branding subdomain. Existing assets have been carried over automatically.
   • LAN Subnets, Relays, and Roaming Clients grids now show the inherited Policy or Block Page name with an Inherited from Site label, replacing the map-pin icon; global policies show a globe icon beside the name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Roaming Client delete flow now distinguishes between Delete and Delete & Uninstall — the latter appears only when uninstall-capable agents are selected — and single-client deletes now require type-to-confirm.
   • LAN Subnets, Relays, and Roaming Clients grids now show the inherited Policy or Block Page name with an Inherited from Site label, replacing the map-pin icon; global policies show a globe icon beside the name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. 10/28 October 28 – Web Application and API Update (2026-10-28) Oct 28, 2026 · issue 124

   DNSFilter adds unblock request form localization in eight more languages and documents the data export restart API call⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • DNSFilter's block page unblock request form now displays in Italian, Dutch, Portuguese, Russian, Swedish, Czech, Turkish, and Ukrainian when the user's browser is set to one of those languages, joining Spanish, French, and German.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • DNSFilter's API documentation now includes the call to restart a failed Data Export using saved connection settings, so no SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. credentials are needed to retry.
   • DNSFilter's block page unblock request form now displays in Italian, Dutch, Portuguese, Russian, Swedish, Czech, Turkish, and Ukrainian when the user's browser is set to one of those languages, joining Spanish, French, and German.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. changelog Oct 20, 2026 · issue 114

   DNSFilter adds multilingual unblock request forms in Spanish, French, and German, and migrates branded subdomains to app.dnsfilter.io.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports Spanish, French, and German on the Request Access form on block pages, auto-detecting the user's browser language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Migrates managed branded subdomains from app.dnsfilter.app to app.dnsfilter.io automatically with no admin action required.
   • Supports Spanish, French, and German on the Request Access form on block pages, auto-detecting the user's browser language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. 10/13 October 13 – Web Application and API Update (2026-10-13) Oct 13, 2026 · issue 108

   Unblock Request Form now displays in Spanish, French, and German; branded subdomains move from .app.dnsfilter.app to app.dnsfilter.io⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Block page Unblock Request Form now displays in Spanish, French, and German based on the user's browser language setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Managed branded subdomains migrate from .app.dnsfilter.app to app.dnsfilter.io; existing subdomains carry over automatically.
   • Block page Unblock Request Form now displays in Spanish, French, and German based on the user's browser language setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

5. changelog Oct 5, 2026 · issue 095
   └──▷ USE IT
   Prevent split-horizon or internal-zone queries from leaking to DNSFilter when your internal resolvers cannot answer them.
   ini copy

   LocalDomainFallbackEnabled = false

6. changelog Oct 4, 2026 · issue 094

   DNSFilter Windows Roaming Client 3.8.15 adds LocalDomainFallbackEnabled, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. compatibility improvements, and ISP DNS interception fallback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent internal split-horizon or private-zone queries from ever leaking to DNSFilter when your local resolvers can't answer them.
   ini copy

   LocalDomainFallbackEnabled = false

   • Adds LocalDomainFallbackEnabled setting to the Windows Roaming Client to control whether unresolvable local-domain queries fall back to DNSFilter or stay on the network — enabling split-horizon and internal-zone isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Roaming Client now detects ISP DNS interception and automatically moves the query to the next protocol in the configured order (e.g., DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext.) so sites load normally.
   • Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. domain-joined devices in Transparent Proxy and PreCheck modes now register DNS records with the domain controller via secure dynamic updates.
   • Adds a Branding settings page for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. without a custom domain configured, replacing the legacy Whitelabel form, with automatic logo migration.
   • Query Log switches to cursor-based pagination, replacing page-number paging for stable forward/back navigation.

   +6 more show less

   • Adds custom description input to the Diagnostic Tool when Other is selected as the reason.
   • Disable Roaming Clients for Conflicting VPN Agents in Classic DNS Filtering now applies to all devices, and VPN adapter traffic is left to the VPN.
   • Roaming Client now reads device identity, OS version, and adapter DNS settings from Windows APIs instead of WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk., lowering WMI Provider Host CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage on all devices including ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and accelerating startup.
   • Unblock Requests grid Category column now shows domain category information even when a domain was blocked for a non-category reason (Block List, AppAware, or Security block).
   • Blocked HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. sites now show the block page without a certificate warning on MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. organizations created after September 15.
   • License overage warning and critical banners are now visible on Custom Dashboards.
   • Adds LocalDomainFallbackEnabled setting to the Windows Roaming Client to control whether unresolvable local-domain queries fall back to DNSFilter or stay on the network — enabling split-horizon and internal-zone isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Roaming Client now detects ISP DNS interception and automatically moves the query to the next protocol in the configured order (e.g., DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext.) so sites load normally.
   • Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. domain-joined devices in Transparent Proxy and PreCheck modes now register DNS records with the domain controller via secure dynamic updates.
   • Adds a Branding settings page for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. without a custom domain configured, replacing the legacy Whitelabel form, with automatic logo migration.

   7 more in Everything

7. 09/30 September 30 – Windows Roaming Client v3.8.15 Beta (2026-09-30) Prerelease Sep 30, 2026 · issue 090

   Windows Roaming Client v3.8.15 Beta adds LocalDomainFallbackEnabled for split-horizon control and hardened VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. compatibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent internal-only or split-horizon domain queries from ever escaping to DNSFilter when your local resolver cannot answer them.
   ini copy

   LocalDomainFallbackEnabled = false

   • Adds LocalDomainFallbackEnabled setting to control whether local-domain queries that internal resolvers cannot answer fall back to DNSFilter or stay on the local network — enabling correct handling of split-horizon DNS and internal-only zones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends Disable Roaming Clients for Conflicting VPN Agents in Classic DNS Filtering to apply to all devices, leaving VPN adapter traffic exclusively to the VPN agent.
   • Adds a dedicated response window for the device's own resolver during PreCheck on VPN connections, so queries over VPN tunnels resolve reliably even when the tunnel resolver is slower than DNSFilter's policy check.
   • Adds automatic DNS restore via the Service Manager: if a VPN event or unexpected shutdown leaves adapters pointed at the filtering proxy, DNS settings are restored and the device is re-registered automatically.
   • Switches device identity, OS version, and adapter DNS settings reads from WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. to direct Windows APIs, lowering WMI Provider Host CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage on all devices including ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and cellular-connected laptops.

   +1 more show less

   • Adds timeout enforcement on every local resolver check and distinguishes confirmed answers from resolver errors and empty responses, keeping internal name resolution accurate through outages, sleep/wake, and network changes.
   • Adds LocalDomainFallbackEnabled setting to control whether local-domain queries that internal resolvers cannot answer fall back to DNSFilter or stay on the local network — enabling correct handling of split-horizon DNS and internal-only zones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds automatic DNS restore via the Service Manager: if a VPN event or unexpected shutdown leaves adapters pointed at the filtering proxy, DNS settings are restored and the device is re-registered automatically.

   4 more in Everything

8. 09/29 September 29 – Web Application and API Update (2026-09-29) Sep 29, 2026 · issue 089

   DNSFilter expands Branding settings to more MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. and adds richer category data to Unblock Requests reviews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Extends the Branding settings page to MSPs without a custom domain configured, replacing the legacy Whitelabel form, with existing logos carried over automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds domain category information to the Category column in the Unblock Requests grid even when a domain was blocked for a non-category reason (Block List, AppAware, or Security block).
   • Extends the Branding settings page to MSPs without a custom domain configured, replacing the legacy Whitelabel form, with existing logos carried over automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

9. changelog Sep 26, 2026 · issue 086

   DNSFilter macOS Roaming Client 2.4.6 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. fallback, and component mismatch detection; dashboard gains Blocked By column and scoped deployment access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Keep DNS filtering enforced for remote workers whose corporate VPN blocks the DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. port, by enabling DoH fallback at install time.
   dns_agent.conf copy

   ENABLE_DOH_FALLBACK=true

   • Adds a Blocked By column to the Active Requests and Request History grids, showing the reason each domain was blocked (consistent with the Query Log's Method column), also visible in the approval drawer.
   • Adds Last Logged In User as a default column and Friendly Name as an optional column in the CyberSight Top Clients View All grids on Activity Overview and AI Usage.
   • Adds type-to-confirm requirement for Roaming Client delete and cleanup deletion actions to prevent accidental mass deletions.
   • Adds deployment access controls scoped to restricted roles: read-only and policy-only users now have Site Keys hidden, Relay deployment controls disabled, and Roaming Client installer access restricted.
   • Adds direct link to the Unblock Requests page in admin notification emails, with subject line including the requester's organization name.
   • Adds a Blocked By column to the Active Requests and Request History grids, showing the reason each domain was blocked (consistent with the Query Log's Method column), also visible in the approval drawer.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The macOS Roaming Client now requires macOS 13 Ventura or later; devices on earlier macOS versions cannot run v2.4.6.
   • !v2.4.6 checks for the new DNSFilter Root CA G1 certificate; devices with the previous certificate profile will show a Fix Installation Issues prompt until the updated Combined_Certificates.mobileconfig (or branded/white-label equivalent) is pushed via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies..
10. changelog Sep 25, 2026 · issue 085
    └──▷ USE IT
    Enable DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. fallback so filtering stays enforced for remote workers whose VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel blocks DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (port 853).
    dns_agent.conf copy

    ENABLE_DOH_FALLBACK=true

    └──▷ BREAKING ON UPGRADE

    • !The macOS Roaming Client now requires macOS 13 Ventura or later; devices running macOS 12 or earlier will not run v2.4.6.
    • !v2.4.6 checks for the new DNSFilter Root CA G1 certificate; devices without the updated Combined_Certificates.mobileconfig profile will display a Fix Installation Issues prompt in the menu bar after upgrading and must have the new profile pushed via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. to clear it.
11. changelog Sep 24, 2026 · issue 084
    └──▷ USE IT
    Pre-configure Travel Wi-Fi and site key at CLI install time using the now-documented key names in dns_agent.conf.
    dns_agent.conf copy

    ENABLE_DOH_FALLBACK=true

    └──▷ BREAKING ON UPGRADE

    • !The macOS Roaming Client now requires macOS 13 Ventura or later; devices running macOS 12 or earlier will not be able to run v2.4.6.
    • !v2.4.6 checks for the new DNSFilter Root CA G1 certificate; devices without the updated Combined_Certificates.mobileconfig profile will show a Fix Installation Issues prompt in the menu bar after upgrading, requiring an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. push of the updated profile to clear.
12. 09/23 September 23 - macOS Roaming Client v2.4.6 Production (2026-09-23) Sep 23, 2026 · issue 084

    macOS Roaming Client v2.4.6 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. fallback, and a new configuration.json architecture⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. fallback during VPN sessions so remote users stay filtered even when the VPN tunnel blocks DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext..
    env copy

    ENABLE_DOH_FALLBACK=true

    Push the updated combined certificate profile via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. before auto-upgrade rolls out to clear the Fix Installation Issues prompt on managed devices.
    📍In your MDM console, navigate to the macOS Roaming Client install guide › Prerequisites section, download Combined_Certificates.mobileconfig (or your branded/white-label profile), and push it to all managed devices to replace the existing certificate profile in place.
    • Adds ENABLE_DOH_FALLBACK=true install-time flag to keep DNSFilter filtering active over DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. when a corporate VPN blocks the DNS-over-TLS port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Switches agent configuration from legacy daemon.conf to a new configuration.json format; existing installations migrate automatically on upgrade.
    • Travel Wi-Fi settings in dns_agent.conf now apply at CLI install time, and install-time configuration keys use the same Travel Wi-Fi names as the dashboard and documentation.
    • Adds IPv6 filtering and protection for dual-stack and IPv6-only networks; administrators can set upstream resolution to IPv4-only, IPv6-only, or automatic.
    • Adds component version mismatch detection: the client now alerts when the menu bar app, system extension, and daemon are running different versions, with a user-facing fix prompt.

    +2 more show less

    • Local domain and resolver changes made in the dashboard now apply immediately without a daemon restart.
    • macOS certificate profiles now install all DNSFilter roots — including DNSFilter Root CA G1 — in a single Combined_Certificates.mobileconfig push.
    • Adds ENABLE_DOH_FALLBACK=true install-time flag to keep DNSFilter filtering active over DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. when a corporate VPN blocks the DNS-over-TLS port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Switches agent configuration from legacy daemon.conf to a new configuration.json format; existing installations migrate automatically on upgrade.
    • Adds IPv6 filtering and protection for dual-stack and IPv6-only networks; administrators can set upstream resolution to IPv4-only, IPv6-only, or automatic.
    • Adds component version mismatch detection: the client now alerts when the menu bar app, system extension, and daemon are running different versions, with a user-facing fix prompt.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !macOS 13 Ventura is now the minimum required OS version; devices running macOS 12 or earlier will not run the v2.4.6 client.
    • !v2.4.6 checks for the new DNSFilter Root CA G1 certificate; devices that still have the previous certificate profile will show a Fix Installation Issues prompt until the updated Combined_Certificates.mobileconfig (or branded/white-label equivalent) is pushed via MDM.
13. 09/22 September 22 – Web Application and API Update (2026-09-22) Sep 22, 2026 · issue 083

    DNSFilter adds Blocked By column to Unblock Requests grids, type-to-confirm for Roaming Client deletion, and Last Logged In User in CyberSight Top Clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review why a domain was blocked without leaving the Unblock Requests queue — the new Blocked By column surfaces the blocking reason inline.
    📍In the dashboard, go to Unblock Requests › Active Requests or Request History and locate the Blocked By column in the grid, or open the approval drawer for any request to see the blocking reason.
    Identify the person behind a Roaming Client hit in CyberSight without drilling into individual device records.
    📍In the dashboard, go to CyberSight › Activity Overview (or AI Usage) › Top Clients › View All and review the Last Logged In User column; click the column chooser to optionally add Friendly Name.
    • Adds a Blocked By column to the Active Requests and Request History grids showing the reason each domain was blocked, consistent with the Query Log's Method column, and also visible in the approval drawer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Last Logged In User as a default column and Friendly Name as an optional column in the CyberSight Top Clients View All grids on Activity Overview and AI Usage.
    • Introduces type-to-confirm requirement for deleting Roaming Clients and running cleanup deletions, preventing accidental mass deletions.
    • Scopes deployment access controls for read-only and policy-only users across Sites, Relays, and Roaming Clients — hiding Site Keys, disabling Relay deployment controls, and restricting Roaming Client installer access, each with a tooltip directing users to contact a dashboard admin.
    • Adds a Blocked By column to the Active Requests and Request History grids showing the reason each domain was blocked, consistent with the Query Log's Method column, and also visible in the approval drawer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

14. 09/16 September 16 – macOS Roaming Client v2.4.6 Beta (2026-09-16) Prerelease Sep 16, 2026 · issue 077

    macOS Roaming Client v2.4.6 Beta keeps DNSFilter active over VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. via DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. fallback with ENABLE_DOH_FALLBACK=true⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Deploy the updated certificate profile (with DNSFilter Root CA G1 included) to managed Macs via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. to replace the previously installed profile in place.
    📍In the dashboard, go to Deployments → Roaming Clients → Beta Channel, re-download the macOS certificate profile, and push it through your MDM — it replaces the existing profile automatically.
    • Adds ENABLE_DOH_FALLBACK=true install-time flag to maintain DNSFilter enforcement over DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. when a corporate VPN blocks the DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Updated macOS certificate profiles now bundle all DNSFilter roots — including the new DNSFilter Root CA G1 — in a single push profile, replacing prior installs in place.
    • Adds ENABLE_DOH_FALLBACK=true install-time flag to maintain DNSFilter enforcement over DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. when a corporate VPN blocks the DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

15. changelog Sep 16, 2026 · issue 076

    DNSFilter: Launches the DNSFilter MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (GA) under Integrations → AI Connectors, connecting AI assistants (Claude, ChatGPT, Codex) to DNS activity, threat data, policy management, and allow/block lists via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..

    └──▷ HOW TO FIND IT
    Connect an AI assistant to DNSFilter for natural-language policy queries and threat investigation via the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server.
    📍In the DNSFilter dashboard, go to Integrations → AI Connectors, open the DNSFilter MCP Server card, copy the server URL, then paste it into your AI client (Claude, ChatGPT, or Codex) as the MCP server endpoint and complete authentication.
    • Reinstalling the iOS Roaming Client now reuses the existing device record instead of creating a duplicate registration entry.

    1 more in Everything

16. 09/15 September 15 – Web Application and API Update (2026-09-15) Sep 15, 2026 · issue 076

    DNSFilter adds GA Unblock Request Management with CSV export and a redesigned MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Branding page replacing Whitelabel settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review and act on pending user unblock requests, flagging risky domains before approving — useful during a morning triage workflow.
    📍In the dashboard, go to Unblock Requests › select a pending request › review any threat-category warnings › click Allow or Deny. To investigate traffic context, use the Investigate Mode row action to scope directly to that domain in the Query Log. Export the full queue via the CSV export button for audit records.
    • Adds the Unblock Requests page to the dashboard, providing a full request queue with Allow or Deny actions, threat-category warnings on risky domains, an Investigate Mode row action for quick Query Log scoping, and CSV export of active and historical requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Redesigns the Whitelabel settings page as a dedicated Branding page, exposing Logo, Favicon, Dashboard Name, and Subdomain URL as individual, first-class branding objects — new MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. provisioned after September 15 configure a branded subdomain (yourdomain.dnsfilter.com) with current branding defaults.

    2 details in Everything

17. 09/15 September 15 - iOS Roaming Client v1.4.5 (2026-09-15) Sep 15, 2026 · issue 076

    iOS Roaming Client v1.4.5 embeds root certs in the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profile and reduces background sync to state-change-only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Disable DNS over TLSDNS over TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. from your MDM payload so the setting is enforced from the moment a device first registers.
    DNSFilter_RoamingClient.mobileconfig copy

    dns_over_tls_enabled: false
    userName: jane.doe@example.com
    dhcp_dns_search_domains:
      - example.com
      - corp.example.com

    • The .mobileconfig file now includes DNSFilter root certificates alongside the iOS Roaming Client configuration, so a single MDM profile push installs both.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The dns_over_tls_enabled MDM key now accepts false from first registration and persists the setting across DNS extension restarts.
    • Changes to dhcp_dns_search_domains now take effect within one configuration refresh with no DNS extension restart required.
    • The userName MDM field now populates the Last Logged in User field immediately on initial device registration.
    • Registered devices now sync with the DNSFilter dashboard only on device state changes instead of every 60 seconds.
    • The .mobileconfig file now includes DNSFilter root certificates alongside the iOS Roaming Client configuration, so a single MDM profile push installs both.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    4 more in Everything

18. changelog Sep 15, 2026 · issue 075

    DNSFilter MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. now GA, letting AI assistants query DNS activity, manage policies, and automate reports via natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an AI assistant to DNSFilter so you can query DNS threat data and manage block lists in natural language, without touching the dashboard.
    📍In the DNSFilter console, go to Integrations → AI Connectors, open the DNSFilter MCP Server card, copy the server URL, then follow the MCP Server setup guide to point your client (Claude, ChatGPT, or Codex) at that URL.
    • Adds the DNSFilter MCP Server integration (generally available), allowing AI assistants such as Claude, ChatGPT, and Codex to query DNS activity and threat data, manage policies and allow/block lists, and automate reports and investigations via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. — no dashboard navigation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes MCP Server setup under Integrations → AI Connectors; admin copies the server URL from the DNSFilter MCP Server card to connect a client, which stays authorized for seven days before requiring reconnection.

    2 details in Everything

19. 09/09 September 9 – DNSFilter MCP Server Now Generally Available (2026-09-09) Sep 9, 2026 · issue 070

    DNSFilter MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. is now generally available, letting AI assistants like Claude, ChatGPT, and Codex query DNS data and manage policies in natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an AI assistant to DNSFilter so you can query threat data and manage block lists in natural language without opening the dashboard.
    📍In DNSFilter, go to Integrations → AI Connectors, open the DNSFilter MCP Server card, copy the server URL, then follow the MCP Server setup guide to register that URL as the MCP server in your AI client (Claude, ChatGPT, or Codex). Setup requires an admin account.
    • Adds the DNSFilter MCP Server integration, reachable under Integrations → AI Connectors, enabling AI assistants (Claude, ChatGPT, Codex) to query DNS activity and threat data, manage policies and allow/block lists, and automate reports and investigations via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. — no dashboard navigation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Connected MCP clients stay authorized for seven days before requiring reconnection, and operate under the connecting user's existing DNSFilter permissions.

    2 details in Everything

20. changelog Sep 8, 2026 · issue 068

    DNSFilter makes Dashboards the default landing view, merges filters, adds live status indicators, and improves TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. labeling.

    • Dashboards is now the default landing view for all users; the legacy Overview page is retired and existing bookmarks redirect automatically.
    • Merges Quick Filters and Advanced Filters into a single Filters experience in the dashboard Filters drawer, grouped by Source (Organizations, Sites, Roaming Clients/Relays, Users) and Traffic (Result).
    • Dashboard deployment widgets (Roaming Clients Protected, Sites Protected, Relays, Users, Collections) now show a pulsating green dot with a tooltip to indicate live data not affected by the time range filter.
    • Bare TLD entries (e.g. .ru, .xyz) in Allow/Block lists and the Query Log now display as Top Level Domain instead of Uncategorized, distinguishing intentional TLD-level rules from genuinely uncategorized domains.
    • Dashboard deployment widgets (Roaming Clients Protected, Sites Protected, Relays, Users, Collections) now show a pulsating green dot with a tooltip to indicate live data not affected by the time range filter.

    3 more in Everything

21. 09/01 September 1 – Web Application and API Update (2026-09-01) Sep 1, 2026 · issue 061

    DNSFilter makes Customizable Dashboards the default landing view and adds live status indicators on deployment widgets.

    • Customizable Dashboards is now the default landing view for all users; the legacy Overview page is retired and existing bookmarks redirect automatically.
    • Dashboard Filters drawer merges Quick Filters and Advanced Filters into a single experience, grouped by Source (Organizations, Sites, Roaming Clients/Relays, Users) and Traffic (Result).
    • Deployment widgets — Roaming Clients Protected, Sites Protected, Relays, Users, and Collections — now show a pulsating green dot indicating live data, unaffected by the dashboard time range filter.
    • Bare TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. entries (e.g. .ru, .xyz) in Allow/Block lists and the Query Log now display as Top Level Domain instead of Uncategorized, distinguishing intentional TLD-level rules from genuinely uncategorized domains.

    4 details in Everything

22. changelog Aug 31, 2026 · issue 060

    DNSFilter adds DNS PreCheck v2 as default, Does Not Include query log filter, and dashboard usability upgrades

    └──▷ HOW TO FIND IT
    Narrow a query log investigation to exclude noisy categories (e.g., hide all News traffic) so only relevant results remain.
    📍In the DNSFilter portal, go to Insights › Query Log, open the Categories filter, select the Does Not Include operator, and choose the categories to suppress (e.g., News).
    • DNS PreCheck v2 is now the default filtering mode for all Windows Roaming Clients on v3.6 and later, detecting and overriding network-level DNS hijacking (hotel Wi-Fi, captive portals, intercepting ISPs); active devices show HTTP/2.0 protocol in the DNS query log.
    • Adds a Does Not Include operator to the Categories filter in the Query Log, letting admins exclude specific categories from view during investigations.
    • Relay Manager v0.2.2 changes the default config file installation path to a shared system location on Windows, preventing configuration loss when user profiles are removed.
    • Customizable Dashboard improvements: dashboards in Manage Dashboards now display Private or Shared visibility status, support updates from the quick actions menu, are clickable from the grid, and the Total Requests widget now opens Insights with Allowed Requests pre-toggled on.

    4 details in Everything

23. 08/25 August 25 – Web Application and API Update (2026-08-25) Aug 25, 2026 · issue 057

    DNSFilter adds Does Not Include category filter in Query Log and improves dashboard usability with shared/private visibility status.

    • Adds Does Not Include operator to the Categories filter in the Query Log, letting admins exclude specific categories from view during investigations.
    • Dashboard cards in the Manage Dashboards view now display Private or Shared visibility status and can be updated directly from the quick actions menu.
    • Dashboards are now clickable directly from the grid view.
    • Clicking the Total Requests widget now opens Insights with Allowed Requests already toggled on.
    • Relay Manager v0.2.2 defaults the config file installation to a shared system location for Windows deployments instead of the installing user's profile folder, preventing configuration loss when user profiles are removed.

    5 details in Everything

24. changelog Aug 24, 2026 · issue 055

    DNSFilter adds SecureTransit encrypted VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-layer privacy policy and a redesigned DNSFilter One Agent with full-window UI

    └──▷ HOW TO FIND IT
    Enforce always-on encrypted transit for a high-risk device group without requiring employees to configure anything.
    📍In the DNSFilter dashboard, go to the policy settings for the target organization or device, locate SecureTransit, set the mode to Always On, choose WireGuard or IKEv2 as the protocol, and save. Credentials and gateway connections are provisioned server-side automatically.
    • New SecureTransit feature enforces DNS-layer traffic encryption through a DNSFilter-managed secure gateway, with a choice of WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. or IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. protocols.
    • SecureTransit policy supports three per-organization or per-device modes: Always On, Manual, or Disabled, configurable from the existing DNS filtering dashboard.
    • SecureTransit blocks location trackers, mail trackers, data brokers, and ad networks on-path before data leaves the device, on any network.
    • SecureTransit is available as a per-device add-on with a 14-day free trial for existing customers; no client-side credential setup required.
    • New DNSFilter One Agent (Windows) replaces the tray right-click menu with a full-window UI themed to system light or dark mode.

    +7 more show less

    • DNSFilter One Agent Filtering panel shows protection state, filtering mode, last sync time, and an activity view of blocked and allowed queries over the past hour.
    • DNSFilter One Agent SecureTransit panel shows connection status, connected server on a map, region, protocol, session uptime, data transferred, and Connect/Disconnect controls (visible when SecureTransit is enabled).
    • DNSFilter One Agent Settings panel consolidates version, hostname, diagnostics, and logs in one place.
    • Query Log filters consolidated into a single top-level panel with a unified Apply button, eliminating the need to set filters across multiple locations.
    • Dashboard widget placement now drops newly added widgets into the next available grid slot without overlapping or displacing existing widgets.
    • A persistent time range indicator remains visible while scrolling or switching dashboard views.
    • The destructive Reset to Default option has been removed from the Dashboard Actions menu.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Reset to Default option has been removed from the Dashboard Actions menu — any workflow relying on it to reset dashboard layout will no longer find this control.
25. 08/17 August 17 – Windows Roaming Client v3.7.11 Beta (2026-08-17) Prerelease Aug 17, 2026 · issue 049

    DNSFilter Windows Roaming Client v3.7.11 Beta adds SecureTransit encrypted VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-layer privacy enforcement and a new DNSFilter One Agent UI.

    • Adds SecureTransit, a policy-enforced encrypted privacy layer supporting WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. or IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. protocols, routing traffic through a DNSFilter-managed secure gateway to prevent network-level visibility of destinations on untrusted networks.
    • Adds admin-controlled SecureTransit policy modes — Always On, Manual, or Disabled — configurable per organization or per device from the existing DNS filtering dashboard.
    • Adds tracker blocking at the network layer via SecureTransit, cutting off location trackers, mail trackers, data brokers, and ad networks before data leaves the device, on any network.
    • Introduces the DNSFilter One Agent, replacing the right-click tray menu with a full UI window supporting system light/dark mode, showing protection state, filtering mode, last sync, and an activity view of blocked and allowed queries over the past hour.
    • Adds a SecureTransit panel in the DNSFilter One Agent displaying connection status, connected server on a map, region, protocol, session uptime, data transferred, and Connect/Disconnect controls.

    +1 more show less

    • SecureTransit is available as a per-device add-on with a 14-day free trial for existing customers; installed via the dashboard under Deployments → Roaming Clients → Beta Channel.

    6 details in Everything

26. changelog Aug 17, 2026 · issue 048

    DNSFilter adds DNS PreCheck v2 for policy enforcement on DNS-hijacking networks, plus policy dropdown organization headers.

    • Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic, closing a gap where certain network conditions could allow content through that should have been blocked; the agent tray updates to show DNS PreCheck v2 when active.
    • Policy/Schedule dropdown now groups an organization's own policies under an Organization header, with sections ordered Organization, Global, then Scheduled, across Sites, Roaming Clients, Relays, Subnets, Users, and Collections.

    2 details in Everything

27. 08/10 August 10 – Windows Roaming Client v3.6.10 (2026-08-10) Aug 10, 2026 · issue 042

    DNSFilter Windows Roaming Client v3.6.10 adds DNS PreCheck v2 for policy enforcement on DNS-hijacking networks and automatic tray process recovery.

    • Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic; rolls out gradually and is not automatically enabled on upgrade — tray updates to show DNS PreCheck v2 to confirm the active mode.
    • Adds automatic tray process recovery so the system tray process restarts itself if it stops unexpectedly, keeping tray status and controls available without a manual client or machine restart.

    2 details in Everything

28. changelog Aug 9, 2026 · issue 040

    DNSFilter adds one-click Investigate Mode, a Policies filter in Query Log, customizable dashboards, and Splashtop AppAware support.

    • Adds Investigate Mode to the Query Log — a one-click control that scopes the log to a specific query's timestamp and deployment context with ±5s, ±10s, and ±15s selectable time windows.
    • Adds a Policies filter to the Query Log, letting admins scope traffic to one or more active policies alongside existing filters.
    • Introduces a preview of Customizable Dashboards: build and rearrange widget layouts, apply dashboard-wide filters, save named views with personal defaults, and share views publicly or across an MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs.'s organizations.
    • Adds Splashtop to the AppAware application library, enabling policy enforcement and reporting on Splashtop remote desktop traffic.
    • Adds conflict validation for Universal and Policy Allow/Block lists that surfaces which list takes precedence and what will happen when a domain exists in multiple lists.

    +1 more show less

    • Relocates the Client admins can create sites toggle from the Whitelabel page to MSP Settings for improved discoverability.

    6 details in Everything

29. changelog Aug 1, 2026 · issue 032

    DNSFilter 3.6.10 adds DNS PreCheck v2, Brave SafeSearch enforcement, redesigned SafeSearch controls, and AppAware Sites filter.

    └──▷ HOW TO FIND IT
    Enable SafeSearch enforcement across all supported search engines at once inside a Filtering Policy.
    📍In the console, go to Filtering Policies › [select a policy] › Privacy tab › SafeSearch section, then click Enforce All to enable enforcement for Google, Bing, DuckDuckGo, Ecosia, Yandex, and Brave simultaneously.
    Find unclassified domains in the Query Log to identify traffic that may need manual categorization or blocking.
    📍In the console, go to Query Log, open the filter panel, and select Uncategorized from the category filter to show only queries DNSFilter has not yet classified.
    Scope AppAware reporting to a specific site in a mixed Core/Pro environment to audit per-site application usage.
    📍In the console, go to AppAware Reporting, open the filter bar, and select the desired site from the new Sites filter to view query data limited to that site.
    • Introduces DNS PreCheck v2 for Windows Roaming Client, maintaining policy enforcement even on networks that hijack or redirect DNS traffic.
    • Adds automatic tray process recovery so the system tray restarts itself if it stops unexpectedly, keeping status and controls available.
    • Adds Sites filter to AppAware Reporting, giving Core plan and mixed Core/Pro environments query data scoped to specific sites.
    • Supports SafeSearch enforcement on Brave browser in Filtering Policies, joining Google, Bing, DuckDuckGo, Ecosia, and Yandex.
    • Redesigns the SafeSearch policy editor section with decoupled enforcement toggles and a new Enforce All shortcut to enable every SafeSearch engine at once.

    +2 more show less

    • Adds Uncategorized filter option to the DNS Query Log for surfacing unclassified queries; updates terminology from Blacklist/Whitelist to Block/Allow throughout.
    • Makes Collections and Users widgets on the MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Overview page clickable, linking directly to their respective management pages.

    7 details in Everything

30. 07/29 July 29 – Windows Roaming Client v3.6.10 Beta (2026-07-29) Prerelease Jul 29, 2026 · issue 029

    DNSFilter Windows Roaming Client v3.6.10 Beta adds DNS PreCheck v2 with hijack-resistant policy enforcement and automatic tray process recovery.

    └──▷ HOW TO FIND IT
    Confirm DNS PreCheck v2 is active for your organization after it has been enabled — the system tray will display DNS PreCheck v2 instead of the previous label.
    📍In the DNSFilter dashboard, go to Deployments → Roaming Clients → Beta Channel, download and install the v3.6.10 beta installer, then check the system tray on enrolled Windows endpoints for the DNS PreCheck v2 indicator once your organization's rollout is enabled.
    • Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic, closing a gap where certain network conditions could allow content through that should have been blocked.
    • Adds automatic tray process recovery so the system tray process self-restarts if it stops unexpectedly, keeping tray status and controls available without manual intervention.

    2 details in Everything

31. 07/28 July 28 – Web Application and API Update (2026-07-28) Jul 28, 2026 · issue 028

    DNSFilter adds Brave SafeSearch enforcement, AppAware Sites filter, clickable MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. widgets, and Query Log Uncategorized filtering.

    └──▷ HOW TO FIND IT
    Enforce SafeSearch on Brave (and all other supported engines at once) in a Filtering Policy.
    📍In the console, go to Filtering Policies › select a policy › Privacy tab › SafeSearch section › click Enforce All to enable every supported engine including Brave.
    Find unclassified DNS queries that may need custom categorization or blocking.
    📍In the console, go to Query Log › add a filter for Uncategorized to display only queries DNSFilter has not yet classified.
    • Adds Sites filter to AppAware Reporting, giving Core plan and mixed Core/Pro environments query data scoped by site.
    • Supports SafeSearch enforcement on Brave browser in Filtering Policies, joining Google, Bing, DuckDuckGo, Ecosia, and Yandex.
    • Adds Enforce All shortcut in the redesigned SafeSearch policy editor to enable every SafeSearch engine at once; enforcement toggles are no longer nested under Block all search engines.
    • Enables filtering DNS Query Log by Uncategorized to surface unclassified queries.
    • Makes Collections and Users widgets on the MSP Overview page clickable, linking directly to their respective management pages.

    5 details in Everything

32. changelog Jul 24, 2026 · issue 024

    DNSFilter redesigns the Query Log with multi-select filters, cross-org switching, and URL-persistent views, plus live local domain sync in the macOS client.

    └──▷ HOW TO FIND IT
    Investigate DNS activity across multiple organizations simultaneously without losing your filter context — select multiple Sites and Roaming Clients in the filter bar, then switch orgs to compare.
    📍In the console, go to Query Log › top-level filter bar, select multiple Sites/Roaming Clients/Relays/Users, then use the org toggle to switch organizations while filters remain active.
    Share a specific DNS investigation view with a teammate by bookmarking the URL after applying filters — active filters persist in the URL automatically.
    📍In the console, go to Query Log, apply the desired filters and timeline via the custom timeline picker, then copy and share the resulting URL.
    Set the Query Log as your default landing page so it opens immediately on login.
    📍In the console, navigate to the Query Log page, then use the Set as Default Landing Page option to bookmark it as your homepage.
    • Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
    • Introduced a custom timeline picker in the Query Log to narrow search windows down to the second.
    • Active Query Log filters now persist in the URL, enabling bookmarking and sharing of specific filtered views.
    • New Query Log data columns added: Resolved IPs, Query Type, and Roaming Client OS Type.

    +3 more show less

    • Any page in the app can now be set as the default landing page upon login.
    • Live local domain and resolver sync: configuration changes in the dashboard now apply to the macOS Roaming Client without a daemon restart.
    • Automatic Registration toggle for Mobile Agent now displays its 7-day duration and explicit end date at a glance.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Starting with macOS Roaming Client v2.4.4, macOS 13 Ventura or later is required; macOS 12 Monterey is no longer supported.
33. docs update Jul 24, 2026 · docs issue 004

    DNSFilter redesigns the Query Log with multi-select filters, cross-org switching, and URL-persistent views, plus live local domain sync in the macOS client.

    └──▷ HOW TO FIND IT
    Investigate DNS activity across multiple organizations simultaneously without losing your filter context — select multiple Sites and Roaming Clients in the filter bar, then switch orgs to compare.
    📍In the console, go to Query Log › top-level filter bar, select multiple Sites/Roaming Clients/Relays/Users, then use the org toggle to switch organizations while filters remain active.
    Share a specific DNS investigation view with a teammate by bookmarking the URL after applying filters — active filters persist in the URL automatically.
    📍In the console, go to Query Log, apply the desired filters and timeline via the custom timeline picker, then copy and share the resulting URL.
    Set the Query Log as your default landing page so it opens immediately on login.
    📍In the console, navigate to the Query Log page, then use the Set as Default Landing Page option to bookmark it as your homepage.
    • Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
    • Introduced a custom timeline picker in the Query Log to narrow search windows down to the second.
    • Active Query Log filters now persist in the URL, enabling bookmarking and sharing of specific filtered views.
    • New Query Log data columns added: Resolved IPs, Query Type, and Roaming Client OS Type.

    +3 more show less

    • Any page in the app can now be set as the default landing page upon login.
    • Live local domain and resolver sync: configuration changes in the dashboard now apply to the macOS Roaming Client without a daemon restart.
    • Automatic Registration toggle for Mobile Agent now displays its 7-day duration and explicit end date at a glance.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Starting with macOS Roaming Client v2.4.4, macOS 13 Ventura or later is required; macOS 12 Monterey is no longer supported.
34. 07/22 July 22 – macOS Roaming Client v2.4.4 Beta (2026-07-22) Prerelease Jul 22, 2026 · issue 023

    DNSFilter macOS Roaming Client v2.4.4 Beta adds live local domain and resolver sync without daemon restarts.

    └──▷ HOW TO FIND IT
    Install the beta to get live config sync — navigate to the beta channel in the dashboard to download.
    📍In the dashboard, go to Deployments → Roaming Clients → Beta Channel and download the latest beta installer.
    • Enables live sync of local domain and resolver configuration changes from the dashboard without requiring a daemon restart.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !macOS 12 Monterey is no longer supported; v2.4.4 requires macOS 13 Ventura or later.
35. 07/21 July 21 – Web Application and API Update (2026-07-21) Jul 21, 2026 · issue 021

    DNSFilter redesigns the Query Log with multi-select filters, cross-org toggling, second-level timelines, and shareable URLs.

    └──▷ HOW TO FIND IT
    Share a precise cross-org Query Log investigation with a colleague by bookmarking the URL with active filters intact.
    📍In the Query Log, select the target Sites, Roaming Clients, and Users via the filter bar, set a custom timeline down to the second, then copy the URL from your browser — paste it to a colleague or save it as a bookmark to restore the exact view.
    • Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
    • MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
    • New custom timeline picker lets analysts narrow Query Log search windows down to the second.
    • Active filters persist in the URL, making Query Log views bookmarkable and shareable.
    • New Query Log data columns added: Resolved IPs, Query Type, and Roaming Client OS Type.

    +1 more show less

    • Any page in the app can now be set as a custom default landing page, opened automatically upon login.

    6 details in Everything

36. 07/15 July 15 - Identities Connections Release (2026-07-15) Jul 15, 2026 · issue 017

    DNSFilter Identities framework adds direct Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. integration, rebuilt Collections, and MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs.-level identity management.

    └──▷ HOW TO FIND IT
    MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. managing multiple organizations can configure synced policy assignment for all orgs from one place instead of entering each org individually.
    📍From the MSP dashboard, navigate to Identities to create or manage Collections and Identity Connections across all organizations in a single view.
    • New Identities framework in the DNSFilter dashboard unifies users, collections, and policy assignment across identity sources for enterprise and MSP environments.
    • Direct Microsoft Entra ID integration via SCIM provisioning eliminates the AD Sync Tool dependency, with support for Entra Hybrid environments.
    • Rebuilt Collections engine supports large directories, multiple identity sources, and high-complexity group structures.
    • New unified Identities view gives administrators a consolidated picture of all identity sources, user objects, collections, and policy assignments.
    • MSP dashboard now supports managing Users, Collections, and Identity Connections across all organizations from a single view, without navigating into each organization individually.

    5 details in Everything

37. 7/14 July 14 - iOS Roaming Client v1.4.4 (2026-07-14) Jul 14, 2026 · issue 015

    iOS Roaming Client v1.4.4 adds automatic MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. site reassignment, stronger admin PIN protection, and refreshed branding.

    • Supports syncing user name, hostname, and device tag changes from MDM configuration profiles to the Dashboard without requiring a Site Secret Key change.
    • Enables automatic site reassignment when a Site Secret Key changes in the MDM configuration profile, allowing fleet migrations without reinstalls or policy gaps.
    • Adds progressive delays between incorrect admin PIN attempts to make automated guessing impractical while keeping legitimate retries fast.
    • Refreshes app icons, visuals, and UI elements to match current DNSFilter branding.
    • Enables diagnostic logging by default on new installs so Support can diagnose early issues from first run.

    5 details in Everything

38. 07/14 July 14 – Web Application and API Update (2026-07-14) Jul 14, 2026 · issue 015

    DNSFilter adds CyberSight Data Export for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration and clearer Mobile Roaming Client auto-registration status display.

    └──▷ HOW TO FIND IT
    Route CyberSight threat data into your SIEM alongside DNS logs by enabling CyberSight Data Export in the DNSFilter dashboard.
    📍In the console, go to Settings › Data Export and enable CyberSight Data Export to begin forwarding CyberSight data to your configured SIEM destination.
    • Adds CyberSight Data Export to all Data Export customers, enabling SIEM ingestion of CyberSight data alongside existing DNS log exports.
    • Automatic Registration setting now surfaces its 7-day duration and an explicit Ends on [date] status for Mobile Roaming Client, replacing the previous helper text.

    2 details in Everything

39. 06/30 June 30 – Web Application and API Update (2026-06-30) Jun 30, 2026 · issue 014

    DNSFilter Partner Portal relaunched with magic-link access and local lesson progress tracking.

40. 06/24 June 24 – Web Application and API Update (2026-06-24) Jun 24, 2026 · issue 014

    DNSFilter adds a CyberSight Agent compatibility warning banner to flag outdated Roaming Client versions.

    • New compatibility warning banner in CyberSight alerts when the Roaming Client version on a device is incompatible with the current CyberSight feature set, prompting an upgrade before relying on CyberSight data.

    1 detail in Everything

41. 06/23 June 23 - macOS Roaming Client v2.4.2 Production (2026-06-23) Jun 23, 2026 · issue 014

    macOS Roaming Client v2.4.2 adds component version mismatch detection to catch post-upgrade inconsistencies.

    └──▷ HOW TO FIND IT
    After an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed upgrade, verify all components are in sync and resolve any mismatch without a reinstall.
    📍In the macOS menu bar, click the DNSFilter icon → if a version mismatch is detected, select the prompted option to resolve it directly from the menu.
    • Adds component version mismatch detection: alerts users when the menu bar app, system extension, and daemon are running mismatched versions — with an in-menu resolution option.

    1 detail in Everything

42. 06/15 June 15 – Windows Roaming Client v3.4.23 Production (2026-06-15) Jun 15, 2026 · issue 014

    Windows Roaming Client v3.4.23 adds automatic Loopback mode fallback on Windows Server and more consistent device identification.

    • Adds automatic fallback to Loopback filtering mode when installed on Windows Server OS, preventing unexpected behavior on unsupported Server deployments.
    • Improves device identification consistency in the dashboard, reducing duplicate entries caused by missing identifiers after upgrades or reinstalls.
    • Enhances installer prerequisite validation and upgrade handling so failed upgrades no longer leave endpoints without the Roaming Client.

    3 details in Everything

43. 06/15 June 15 – macOS Roaming Client v2.4.2 Beta (2026-06-15) Prerelease Jun 15, 2026 · issue 014

    macOS Roaming Client v2.4.2 Beta adds component version mismatch detection to surface upgrade and MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. install issues.

    └──▷ HOW TO FIND IT
    After an MDM-managed upgrade, verify all Roaming Client components are in sync and resolve any mismatch without manual reinstall.
    📍In the menu bar app, open the DNSFilter menu — if a version mismatch is detected across the menu bar app, system extension, or daemon, an alert will appear with a prompt to resolve it directly from the menu.
    • Adds component version mismatch detection that alerts users when the menu bar app, system extension, and daemon are running different versions — with an in-menu resolution option.

    1 detail in Everything