What DNS and Web Filtering Is
Written by MSP Outpost.
In Short
DNS and web filtering blocks a user's device from reaching known malicious or unwanted sites, by refusing to look up the address or by inspecting the request before the page loads. It works on and off the office network, which is where it differs from the filtering on a firewall, and it stops the connection before endpoint protection has anything to catch.
What It Does
- Threat blocking. Known malicious, phishing and newly registered domains refused before a connection is made.
- Content policy. Categories of sites allowed or blocked per client, per group or per user.
- Roaming protection. A lightweight agent keeps filtering laptops outside the office network.
- Reporting. Blocked requests per client, useful as evidence of value in a quarterly review.
- Multi-tenant management. Every client's policies managed from one console, with templates you apply to new clients.
- Deeper inspection. Some products go further than DNS and inspect web traffic itself, at more cost and complexity.
When You Need One
Cheap, quick to deploy and blocks a lot of trouble, so it is worth including in your security stack from the start. A DNS based product with a roaming agent and templates is enough.
Standard policies per client and reporting you can show in reviews matter now. Check it deploys through your RMM, so new devices are covered without a separate step.
Expect clients who want per group policies, deeper web inspection and logs kept for their own audits. Some MSPs at this size move to a broader secure web gateway, which is a bigger product and a bigger bill.
What to Look For
Must Have
- Roaming Agent
- Multi-Tenant Console
- Policy Templates
- Category Filtering
- RMM Deployment
- Per Client Reporting
Worth Having
- Directory Integration
- Block Page Customisation
- Log Export
- Newly Registered Domain Blocking
How It Is Priced
Most products charge per user or per device per month, and the larger platforms quote only. Watch for monthly minimum spend per plan, whether a user with a laptop and a phone counts once or twice, and whether roaming agents or deeper inspection sit in a higher tier.
Switching
Switching is one of the easier moves in the security stack: you replace an agent and change where DNS points. Before you sign, settle how the agent is removed at scale, whether policies can be exported, and how long logs are kept after you leave.
Questions to Ask a Vendor
- Is pricing per user or per device, and how are shared devices counted?
- What is the minimum monthly spend, and does it apply per client or across my account?
- Can the agent be deployed and removed silently through my RMM?
- What happens when a user is on a network that blocks your resolver?
- How long are request logs kept, and can I export them for a client's audit?
- Which features are in the base tier, and which need an upgrade?
