In short: DNS filtering software checks every website a device tries to reach against threat intelligence and content categories, and blocks bad or unsuitable sites before a connection is made. It protects office networks and roaming devices with a lightweight agent. Web filtering adds deeper inspection. Products are licensed per user or device, and schools use them to meet DfE filtering standards.
What is DNS and web filtering?
Every time someone visits a website, their device first asks a DNS server to turn the name into an address. DNS filtering uses that moment to check the destination: if the domain is known to host malware or phishing, or falls into a category you have chosen to block, the request is refused and the user sees a block page instead.
Because it works at the DNS layer, filtering is fast, protects every application rather than just the browser, and can be applied to a whole office by changing a router setting, or to individual laptops with a small roaming agent that works on any network.
Web filtering goes further, inspecting the full web address and sometimes the content, often through a proxy or secure web gateway. It gives finer control, for example allowing a site but blocking uploads, but takes more effort to deploy.
Examples include DNSFilter, Webroot DNS Protection, DefensX, Cisco Umbrella and the DNS filtering modules offered with several endpoint platforms.
DNS and web filtering: vendors and products we supply
- Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
- Check Point Harmony Browse: In-browser zero-phishing and download protection, licensed per user.
- Check Point Harmony SASE: Secure internet access and zero trust private access, licensed per user.
- DefensX: Browser security with DNS protection, phishing and credential defence, AI data controls and ZTNA.
- DefensX Browser security: Core, Core Plus, Premium and Premium+ editions compared, licensed per user.
- DNSFilter: Cloud DNS security and content filtering for offices, schools and remote workers.
- DNSFilter Core and Plus plans: Core and Plus compared, what replaced Pro, add-ons and deployment.
- Exium: SASE, software firewall, XDR and identity on one platform, licensed per user.
- Exium SASE: Zero trust access and web, DNS and SaaS security, per user.
- Nord Security: NordLayer network access, NordPass password management and NordStellar threat exposure monitoring.
- Nord Security NordLayer: Business VPN, ZTNA, cloud firewall and DNS filtering, licensed per user with no hardware.
- Perception Point Advanced Browser Security: Browser extension for phishing protection, DLP and governance, per user.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos Firewall: Base Licence, protection modules and the Xstream Protection bundle, licensed per firewall.
- Sophos Workspace Protection: Protected Browser, ZTNA, DNS Protection and Email Monitoring System in one per-user licence.
- ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
- ThreatDown DNS Filtering: Block malicious and unwanted web categories at DNS level, managed with your endpoints.
- Timus Networks: Timus SASE: zero trust access, cloud firewall and web filtering in one per-user subscription.
- Timus Networks Timus SASE: Zero trust access, always-on agent, cloud firewall and web filtering, licensed per user.
- Todyl: Modular SASE, EDR, SIEM, 24/7 MXDR and GRC on one agent, billed monthly per device.
- Todyl SASE: Zero trust access, web gateway and cloud firewall through one always-on agent.
- Trend Micro Zero Trust Secure Access: ZTNA private access, secure web gateway and AI service access with risk-based policy.
- WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
- WatchGuard FireCloud: Cloud firewall and secure web gateway for remote users, with ZTNA in Total Access.
- Webroot: Lightweight cloud endpoint protection, DNS filtering and awareness training.
- Webroot DNS Protection: Cloud DNS filtering with category policies, DoH and roaming protection.
What to look for
- Threat intelligence quality, including newly registered and lookalike domains
- Category filtering that is accurate and easy to adjust, with safe search enforcement
- Roaming protection for laptops and mobile devices outside the office
- Per-group policies by user, device or location
- Reporting that shows blocked threats and browsing trends without overwhelming you
- Education features where relevant: alignment with UK Safer Internet Centre guidance on appropriate filtering, and alerting for safeguarding concerns
DNS filtering is one of the simplest security layers to deploy, which makes it popular with small businesses that want quick, measurable protection. Because it blocks connections before they start, it also stops many phishing pages from loading even if someone clicks a link that email filtering missed.
How DNS filtering is licensed
DNS filtering is usually licensed per user or per device, often in two or three tiers that add features such as roaming agents, advanced reporting or longer log retention. Some products license by network or site for guest Wi-Fi. Monthly terms are widely available. For schools and colleges, some vendors offer education terms: our education and charity licensing guide explains what to ask about.
How to choose
- Decide what you need to filter: threats only, or content categories as well.
- Check where users work: office-only filtering is simple, roaming users need an agent.
- For schools, check the product against the Department for Education's filtering and monitoring standards and Keeping Children Safe in Education.
- Consider whether a wider SASE or secure web gateway is a better fit if you also need data protection and app controls.
- Pilot with a group of users to tune categories before rolling out.
- Review block reports after the first month: they often show both blocked threats and legitimate sites that need allowing, and they make a useful report for management or governors.
Our Cisco Umbrella site covers DNS security in depth, and Cloud Security explains secure web gateways.
How we help
We supply DNS and web filtering subscriptions on your Forever Systems account, set up policies for each group and deploy roaming agents through your device management tools. Contact us and ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is DNS filtering?
DNS filtering blocks access to malicious or unwanted websites by checking each domain a device looks up and refusing those that are dangerous or in blocked categories, before any connection is made.
Does DNS filtering work for remote workers?
Yes, with a roaming agent installed on each device. The agent sends DNS requests to the filtering service from any network, including home broadband and public Wi-Fi.
Do schools have to use web filtering?
Keeping Children Safe in Education expects schools and colleges in England to have appropriate filtering and monitoring, and the DfE publishes filtering and monitoring standards to help them meet that duty.