Skip to main content
Skip to content

Introducing LUMINATE by DNSFilter™: Five security suites on one DNS-first engine.Meet LUMINATE by DNSFilter™

Learn more →
Book a Demo
LUMINATE by DNSFilter

Encryption & Privacy

Digital privacy, enforced as policy

The moment a device connects from a hotel or an airport, its traffic is readable to whoever is watching that network, and on every network the sites your people visit are quietly building profiles on them. This suite handles both: Encrypted transport for your users' traffic, and trackers and data brokers cut off before they can collect. Set by admins, enforced as policy, on any network including your own.

Get a demo
  • 200 billion DNS queries resolved daily
  • 235 million threats blocked daily
  • 57,000+ organizations protected

Where privacy stops being a user's decision

  • Encrypt traffic for people working on networks you do not control

    Public Wi-Fi, hotel networks, conference halls, and client sites are all networks somebody else operates and somebody else can watch. Encrypted DNS transport ships today in the Roaming Client, and SecureTransit adds full outbound encryption in fall 2026. Coverage follows the user, not the location.

  • Cut off trackers and data brokers as policy, not as a user preference

    Location trackers, mail trackers, data brokers, and ad networks build profiles on your people in the background of every site visit, including on the corporate LAN. Blocking them is set from the same console and the same policy model you already use, with nothing for an end user to enable and nothing for them to switch off.

  • Replace VPN complexity for simple encrypted remote access

    No concentrators, no split tunneling configuration, and no client-side VPN application to manage. For organizations whose need is encrypted DNS and secure remote connectivity rather than site-to-site routing, this covers it through the agent already on the device.

What you get

Encrypt, block, enforce, audit

  • Encrypted DNS transport

    Every DNS query from a Roaming Client can travel over DNS-over-HTTPS or DNS-over-TLS, so the network a device sits on cannot read what it is resolving. Managed devices, BYOD, and remote users.

  • Trackers blocked at resolution

    Location trackers, mail trackers, data brokers, and ad networks are blocked at the DNS layer, before a connection is ever made, everywhere the Roaming Client runs.

  • Privacy as a policy object

    Both of the above are enforced from the same console and the same policy model you use for filtering. Credentials are provisioned server-side, so there is nothing for an end user to configure.

  • Privacy from outsiders, not from you

    Your team keeps the same DNS query visibility it has today. No blind tunnels, no visibility gaps, and no change to your audit trail.

Delivered through the Roaming Client you already deploy. No new agent, no new console, and no new vendor.

Who it is for

  • For security and IT teams

    Private connections wherever your people work, managed from the same console and policy model you use for DNS filtering, with coverage that follows the user rather than the location. Privacy from outsiders, not from you: Every DNS query stays in the same logs you have today, so nothing about your audit trail changes.

  • For MSPs and partners

    Encrypted DNS transport is included in the Roaming Client you already deploy. SecureTransit arrives as a billable, per-device add-on through the same multi-tenant console, so you license only the devices that need it: Remote workers, executives, and compliance-sensitive clients. Cost scales with exposure, not headcount.

Your data should be yours

On hotel Wi-Fi, on the office network, and inside every site your team visits. Encrypted DNS transport and tracker blocking are available now in the Roaming Client you already run, with SecureTransit arriving fall 2026.

Get a demo

FIND OUT MORE

FAQs

Read the answers to the most frequently asked questions. Want to know more? Visit our help desk.

Encrypted DNS transport over DNS-over-HTTPS or DNS-over-TLS, tracker and data broker blocking at the DNS layer, and Guardian for personal devices. SecureTransit, which adds full outbound traffic encryption, arrives in fall 2026. Every module is set by admins and enforced as policy through the Roaming Client you already deploy.

No. Encryption protects queries from the network the device sits on, not from you. Your team keeps the same DNS query logs, reporting, and audit trail it has today.

Both encrypt DNS queries in transit. DoH sends them over the same port as normal web traffic, which makes it harder for a network to single out and block. DoT uses a dedicated port, which is easier for a network to manage and to see. DNSFilter supports both.

A VPN encrypts the path. SecureTransit is enforced as organizational policy rather than left to a user to switch on, and it also blocks the trackers and data brokers profiling your users inside the sites they visit, which a VPN does not do.

SecureTransit tunnels traffic to a DNSFilter-managed secure gateway over IKEv2 with AES-256 encryption or WireGuard, selected by the admin in the console. Policy modes are Always-On, Manual, and Disabled, set per organization or per device.

At the DNS layer, yes, and that is available now. SecureTransit blocks tracker connections at the source as traffic passes through the tunnel, which catches what DNS-layer blocking alone cannot, and adds full traffic encryption. If the tunnel is off, DNS-layer tracker filtering stays in place. Protection degrades gracefully; it never disappears.

Neither. ZTNA controls who reaches which internal applications. DLP inspects outbound content to keep sensitive data from leaving. This suite encrypts traffic and blocks the trackers and data brokers observing it. Different layers, different jobs.

One agent. One console. One intelligence model.