Built for Stability: The New Era of DNSFilter Roaming Clients

We’ve listened. We triaged tickets about Roaming Client failures. We evaluated the lack of graceful failover options. We saw users struggling with DNS breakages, VPN conflicts, and deployment surprises.

Those reports didn’t fall on deaf ears. They exposed a deeper truth: Our client architecture needed to evolve.

That’s exactly what set this modernization in motion: Leaning hard into your feedback. Where clients failed, we reverse-engineered. Where gaps formed, we rebuilt. The result is a new foundation built for stability.

This is the most significant evolution of our Roaming Client technology to date, delivering reliable protection, simplified management, and confidence at scale.

And it wouldn’t have been possible without a change: DNSFilter’s acquisition of Zorus. The teams you trusted are now together, a powerhouse of innovation, merging Zorus’ edge filtering and analytics capabilities with DNSFilter’s AI, backbone, and scale.

From here, you’ll see how each platform (Windows, macOS, and ChromeOS) were retooled, hardened, and aligned with your expectations. What follows is proof that we didn’t just talk. We acted.

The Solution: One Strategy, Three Modern Clients

We didn’t just facelift old code. We rebuilt the entire Roaming Client core around four guiding principles: Vendor alignment, privacy and security, manageability, and reducing legacy friction. Those pillars now live in a unified strategy that supports Windows, macOS, and ChromeOS clients through shared core ideals that adapt to each platform’s needs.

Under that architecture, we layered robust foundations:

• Core libraries and build systems have been modernized and consolidated. The result is fewer divergent code paths, easier maintenance, and faster per-platform feature development.
  
  
• Diagnostics and visibility got a major boost. Logs are clearer, better structured, and more informative. Error paths show context. Across platforms, support teams have more insight into failure states rather than chasing ghosts.
  
  
• Update reliability is baked in. Because every client now utilizes a modern code base, releases are far more predictable across operating systems.
  
  
• Privacy-first protocols and intelligent fallback are foundational, not optional. All Roaming Clients will have encrypted DNS available and eventually, full IPv6 support.

Because these improvements are simultaneous, the next step becomes possible!

DNS PreCheck: Coming Soon to Windows

One of the most anticipated updates in this modernization effort is DNS PreCheck, a flagship feature from Zorus that’s now being integrated into DNSFilter’s Roaming Clients, starting with Windows.

DNS PreCheck evaluates DNS queries before they’re resolved. That may sound subtle, but the impact is enormous. By analyzing traffic at this earlier stage, PreCheck prevents the most common sources of disruption that plague traditional filtering agents like VPN conflicts, captive portal breakdowns, and DNS reconfiguration headaches.

When users connect through a hotel or airport Wi-Fi, PreCheck ensures protection stays on without blocking access to the captive portal. When VPNs connect or disconnect, there’s no need to reconfigure DNS or restart the client. Same when switching networks. It simply works.

This feature eliminates entire classes of your support tickets while keeping users protected and connected.

Use Cases & Benefits

No IT Setup Hassles
Changing DNS is no longer required, simplifying setup across organizations. With DNS PreCheck, the Roaming Client connects seamlessly without the need to configure local domains or traditional VPNs.

Conflict-Free
When users hit captive portals (airports, hotels, work ⇔ home, or coworking spaces) they’ll remain protected while connecting, without network interruptions or lockouts.

Resilient Protection
DNS queries to malicious domains are blocked locally, never touching the network. Apps and malware attempting to bypass filtering get stopped at the source.

“PreCheck brings the intelligence of Zorus’ endpoint filtering into DNSFilter’s global network. It’s a leap forward in stability and user experience.” – Brett Cheloff, Chief Product Officer

Windows Roaming Client 3.x

Reinventing Windows Filtering

We rebuilt the Windows client on modern frameworks (including .NET Core) to deliver better consistency, faster updates, and stronger runtime behavior.

Users remain protected transparently. Admins have one less “mystery machine” to troubleshoot.

We added ARM64 builds (for devices like Surface Pro X and Snapdragon laptops), and full IPv6 support. No more clients that “just don’t work” on new hardware or next-gen networks.

We also introduced a Service Manager component. It gives admins centralized install, update, and feature control letting them manage logging, diagnostics, and filtering behavior directly from the dashboard. These updates will be available at a later date, releasing through the end of 2025.

The result: Fewer remote support sessions, faster deployments, and more predictable client behavior at scale.

macOS Roaming Client 2.x

Future-Ready for Apple

Apple’s move away from kernel extensions required a full architectural shift. Our macOS client now runs entirely within Apple’s approved System and Network Extension frameworks—the same technologies used by leading endpoint and VPN providers.

This modernization improves stability, security, and OS compatibility. It eliminates the fragile kernel hooks that often broke after macOS updates and enables seamless deployment and management through MDM tools.

The result: Fewer regressions, smoother upgrades, and a client that’s aligned with Apple’s long-term direction for secure networking—built to adapt as their ecosystem continues to evolve.

ChromeOS Roaming Client 3.x

Private, Compliant, and Modern

ChromeOS clients must align with Manifest V3 rules, which limit how extensions intercept and block traffic.

We built the ChromeOS client to support DNS over HTTPS (DoH), letting us encrypt DNS queries inside Chrome’s native infrastructure. Encrypted DNS (DoH) helps block eavesdropping, tampering, and bypass attempts.

That means DNSFilter filtering works seamlessly, even on unmanaged or untrusted networks, and stays compatible with Google’s roadmap.

For education, hybrid work, and enterprise fleets, that’s a lifeline: Protection without breaking Chrome extensions or user environments.

Why Modernization Wins

For IT teams: Fewer surprise breakages when vendors shift. Deploy once, update confidently. Know that your security client won’t collapse when Windows, macOS, or Chrome change.

For users: Protection that runs silently in the background. No popups, no weird network failures, no “why is my internet broken” confusion.

For organizations: Security that endures. Your investment in DNSFilter’s platform continues to pay off as the OS and browser world evolves.

Confidence at Scale

DNSFilter’s new Roaming Clients are better but more importantly they’re built for the next decade of OS, browser, and network change.

• Modern Clients for modern enterprises
  
  
• Future-proof protective DNS across Windows, macOS, and ChromeOS
  
  
• Aligned with Apple, Google, and Microsoft, ready for what comes next

Next Steps: What to Do Right Now

1. If you’re a customer, login to DNSFilter to join the Windows Roaming Client beta today and start testing on devices. Here is how to ensure you get DNSFilter beta updates.
2. If not a customer yet, start your free trial. DNSFilter customers get end-to-end protective DNS (and more!).
3. Watch for new Roaming Client releases. The latest builds embody this modernization.

Modernization is the foundation for faster fixes, deeper integrations, and true scale.