In short: DNSFilter's Core plan covers phishing, malware and botnet blocking with content filtering for networks you control. Plus, which replaced Pro, adds roaming clients on every platform, per-user policies and reporting, identity integration, CyberSight analytics, DNS PreCheck and guest Wi-Fi. Both are licensed per user, billed monthly or annually.
What every DNSFilter plan includes
All DNSFilter plans run on the same resolver network and threat intelligence. Whichever you choose, you get:
- Phishing, malware and botnet protection, with real-time threat detection
- Malicious domain protection for new and suspicious domains
- Content filtering by category, for acceptable use and safeguarding
- AppAware, one-click blocking of risky or unwanted applications
- DNS encryption, including DNS over TLS
- Network and relay deployment, API access and an MCP connector for AI assistants
- Scheduled reporting, query log export and an administrative audit log
- 90-day report retention and 9-day query log retention
- Email and chat support
The difference between the plans is mainly about *where* protection applies and *how finely* you can set policy.
Core and Plus compared
| Feature | Core | Plus |
|---|---|---|
| Threat protection and content filtering | Yes | Yes |
| AppAware and DNS encryption | Yes | Yes |
| Network and relay deployment | Yes | Yes |
| API access, MCP connector and scheduled reporting | Yes | Yes |
| DNS PreCheck (filtering locally on the device) | No | Yes |
| Roaming clients for Windows and macOS | No | Yes |
| Roaming clients for iOS, Android and Chrome | No | Yes |
| Guest Wi-Fi filtering | No | Yes |
| Identity integration (Microsoft Entra, Active Directory) | No | Yes |
| Per-user policies and per-user reporting | No | Yes |
| CyberSight user behaviour analytics and AI usage report | No | Yes |
| Zapier integration | No | Yes |
| SecureTransit endpoint privacy add-on | No | Optional |
| Data Export to a SIEM | Optional | Optional |
| Premium Support (case prioritisation, enhanced SLA, consultation calls) | No | Optional |
Core suits a single office or school where all devices sit behind a network you control. Plus suits most hybrid organisations, because roaming clients keep laptops protected at home and per-user policy lets you treat, for example, finance staff and students differently. Enterprise follows the Plus feature set on terms for larger organisations. DNSFilter may change the feature split, so we confirm it against its current plan sheet when we quote.
Deployment in practice
A typical DNSFilter rollout follows four steps:
- Create sites and policies: one policy per group of users or locations, with the threat and content categories you want blocked.
- Protect the network: point your router, firewall or DHCP server at DNSFilter, or install the relay where you run internal DNS so private lookups still reach your own servers and on-site devices are covered.
- Deploy roaming clients (Plus): push the agent through Microsoft Intune, Group Policy or an RMM tool, and connect Microsoft Entra or Active Directory for per-user policy.
- Review and tune: check the query log and reports for false positives, add allow-list entries and set scheduled reports for managers or safeguarding leads.
On Plus, DNS PreCheck also lets the device filter locally.
How the plans are licensed
| Option | How it works |
|---|---|
| Per user | Each licence covers a person and their devices |
| Monthly or annual | DNSFilter offers both; annual usually costs less, monthly is more flexible |
| Minimum spend | DNSFilter sets a minimum spend per plan on its standard pricing, which we explain on your quote |
| Add-ons | SecureTransit, Data Export and Premium Support are added on top of the plan, priced per licence per month |
| Education | Qualifying schools and colleges have their own pricing programme |
You can move from Core to Plus when your needs change, for example when you move to hybrid working. Prices depend on plan, quantity and term, so ask us for a quote. See per-user vs per-device licensing for background.
Who each plan suits, and how we help
Core is a good fit for organisations where nearly everyone works on site, such as a single-site school, a shop or a warehouse, and where filtering the network is enough. Plus is the usual choice for hybrid professional services firms, charities and multi-site organisations, where laptops leave the office and different groups need different rules.
We recommend the right plan, set up policies and relays, deploy roaming clients and tune the service in the first weeks. After that, licences, user changes and renewals sit on your Forever Systems invoice. If you need deeper inspection than DNS alone, we can compare DNSFilter with browser-based options such as DefensX browser security. Contact us for a quote or a trial.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between DNSFilter Core and Plus?
Core protects networks with threat blocking and content filtering. Plus adds roaming clients on every platform, per-user policies and reporting, identity integration, CyberSight analytics, DNS PreCheck and guest Wi-Fi filtering.
Do I need roaming clients?
If staff ever work away from a network you control, yes. Without a roaming client, a laptop on home broadband or public Wi-Fi is not filtered by your DNSFilter policy. Roaming clients are part of the Plus and Enterprise plans.
Does DNSFilter work with Microsoft Entra ID?
Yes, on the Plus and Enterprise plans. Identity integration with Microsoft Entra or Active Directory lets you apply policies and reports per user and per group.
Will DNSFilter break internal DNS or Active Directory?
Not if it is set up properly. The DNSFilter relay sends private lookups to your own DNS servers and public lookups to DNSFilter. We configure this as part of deployment.