Skip to main content
Skip to content

Introducing LUMINATE by DNSFilter™: Five security suites on one DNS-first engine.Meet LUMINATE by DNSFilter™

Learn more →
Book a Demo
LUMINATE by DNSFilter

Advanced Filtering

Block it at the lookup, before the connection is made

Firewalls and endpoint agents inspect the connection once it’s made. Advanced Filtering decides earlier, the moment a device asks to resolve a name: Allow, block, or restrict, by user, group, device, or network. Phishing pages, malware hosts, and content your policy doesn’t permit never connect, including on the printer, the sensor, and the contractor’s laptop, because none of them needs an agent to resolve through you.

Get a demo
  • 200 billion DNS queries resolved daily
  • 235 million threats blocked daily
  • 57,000+ organizations protected

Where filtering earns its place

  • Stop threats before the payload executes

    A user clicks a phishing link, a compromised site loads a dropper, or malware reaches for Command and Control. The query is scored and the connection is refused before the TCP handshake, so the malicious server never receives a packet and the incident never gets past the DNS request.

  • Protect unmanaged devices, IoT, and OT without an agent

    Cameras, HVAC controllers, medical equipment, industrial sensors, and guest devices cannot run endpoint software, and they still reach the internet. Point the network's DNS at us and every device on it comes into policy, with nothing installed and no compatibility work.

  • Meet content compliance with evidence you can hand to an auditor

    CIPA, CMMC, HIPAA-adjacent acceptable use, and CIS Controls all require proof that content policy is enforced across every user and device. Policy follows the user through the Roaming Client, and every lookup, allowed or blocked, is recorded and exportable by user, device, and time period.

What you get

Categorize, enforce, configure, investigate

  • Categorization that keeps up with the internet

    Our engine evaluates domain requests as they happen and assigns never-before-seen sites to one of 40 customizable policy groups. Your policy applies from the first lookup, with no list update to wait for.

  • Threats stopped before the handshake

    Every query is scored on domain age, naming patterns, and hosting context, with live phishing, malware, and Botnet feeds as a second checkpoint. The decision lands before any data moves.

  • Policy that follows the user

    Rules by user, group, device, network, and time of day, enforced on-network and off through the Roaming Client. Windows, macOS, iOS, Android, ChromeOS, and IoT endpoints all come into scope.

  • Know what every device reached

    Real-time dashboards, drill-down from a single domain to every device that reached it, scheduled PDFs, CSV export, and raw logs streaming into Splunk, Elastic, or S3.

Point your DNS forwarders or roll out the Roaming Client. No proxies, no hardware, no replatforming.

Who it is for

  • For security and IT teams

    One enforcement point that covers the fleet you manage and the devices you cannot, with no proxy to stand up and no migration attached. When an auditor asks what a device reached on a given afternoon, the answer comes from a record rather than a reconstruction.

  • For MSPs and partners

    Baseline policy applied to a new tenant in seconds, then adjusted per organization without touching global settings, from one multi-tenant console. Every lookup is recorded, so “what did this device access” gets answered without waiting on endpoint telemetry, and quarterly reviews come with evidence attached.

Protect every click, on every device

Decide what your people and your devices are allowed to reach, and have that decision land before anything loads.

Get a demo

FIND OUT MORE

FAQs

Read the answers to the most frequently asked questions. Want to know more? Visit our help desk.

Web filtering is the practice of deciding which sites and categories of content a user or device is allowed to reach, and enforcing that decision before the content loads. It can be enforced at several layers. Advanced Filtering enforces it at the DNS lookup, which is the earliest point in the connection and the only one that reaches devices that cannot run an agent.

Web filtering is the outcome: Unwanted or malicious content does not load. DNS filtering is one way to deliver it, by making the decision when a device resolves a name rather than after a connection is established. DNS filtering covers every device that resolves through you, including unmanaged ones, and it does not require a proxy or TLS inspection.

A secure web gateway proxies traffic and inspects it inline, which requires routing users through it and, in most cases, decrypting TLS. We decide at the lookup, before the session exists, on devices that can never carry an agent or be routed through a proxy. Teams run both, and this is the layer that runs first.

No. We see that a device requested a name and what we categorized that name as. We do not inspect page contents, files, form fields, or messages.

No. Point your DNS forwarders at us, or deploy the Roaming Client through your RMM or MDM. There is no proxy to stand up, no hardware, and no SASE replatform.

Minutes. DNS forwarding brings a whole network into scope in a single change, and the Roaming Client rolls out silently through RMM or MDM. Policies and reporting are live as soon as queries start resolving through us.

Advanced Filtering enforces content and threat policy at the DNS layer and records every lookup, which is the control and the evidence that CIPA, CMMC, HIPAA-adjacent acceptable use, and CIS Controls ask for. Reports export by user, device, and time period for auditors.

Yes. Advanced Filtering is generally available and is the suite existing DNSFilter customers are already using. Adding another suite later does not mean a new agent, a new console, or a new procurement cycle.

One agent. One console. One intelligence model.