Follow up on the latest improvements and updates.

RSS

November 3, 2026

new

Web App

API

11/03 November 3 – Web Application and API Update

✨ What's New
Branding Settings for MSPs with Custom Domains
 – MSPs using a CNAME-based custom domain are migrating to a managed branding subdomain and the new Branding settings page, replacing the legacy Whitelabel page. Existing branding assets carry over automatically.
🛠️ Improvements
Clearer Policy and Block Page Inheritance
 – The LAN Subnets, Relays, and Roaming Clients grids now show the inherited Policy or Block Page name with an "Inherited from Site" label beneath it, replacing the map-pin icon. Global policies show a globe icon beside the name.
Clearer Roaming Client Delete Messaging
 – Updated copy across the Clean Up Tool, Actions menu, and delete modal explains the difference between Delete and Delete & Uninstall, which now appears only when uninstall-capable agents are selected. Single Roaming Client deletes also require type-to-confirm.
🪲 Bug Fixes
CyberSight Search and Report Loading
 – Resolved an issue where searching Activity Logs could spin for minutes and falsely report "No results found." Slow-loading reports such as Top Categories, Top Risky Users, AI Usage, and the Events chart are improved as well.
CyberSight Short Time Range Reports
 – Resolved an issue where Active Time Trend, AI Usage Over Time, Threat Trends, and the Timeline Events chart could fail to load for short time ranges, such as a single hour.
CyberSight Filter Reliability
 – Resolved an issue where text filters containing a "<" character were altered before being applied. Filters now search exactly what was typed. Privacy protections for redacted content in CyberSight were also strengthened.
MSP Allow-List Enforcement in CyberSight
 – Resolved an issue where MSP users restricted to an allow list of organizations could retrieve CyberSight data outside that list. Configured access restrictions now apply to every CyberSight request.
Plus general performance and stability improvements across the dashboard.

October 28, 2026

new

Web App

API

10/28 October 28 – Web Application and API Update

✨

What's New

Unblock Request Form in Eight More Languages
– The Request Access form on block pages now displays in Italian, Dutch, Portuguese, Russian, Swedish, Czech, Turkish, and Ukrainian when the user's browser is set to one of those languages, joining Spanish, French, and German.

🛠️

Improvements

Data Export Restart in API Documentation
– The API docs now include the call to restart a failed Data Export, using the saved connection settings so no SIEM credentials are needed.
Query Log Page Size and Email Delivery
– The Query Logs report now caps page size at 1,000 rows for more consistent performance. Outgoing notification, report, and alert emails are also retried automatically if delivery fails, so fewer messages get dropped.

🪲

Bug Fixes

Identity Connection Management
– Resolved issues where canceling an organization left its Identity Connection in an orphaned state, and where deleting an Identity Connection returned a 404 error. Collection description edits also now save as expected.
DNS Query Log Reliability
– Resolved several Query Log issues: narrowly filtered views now show all matching rows and page correctly, exiting Investigate mode no longer leaves stale rows on the Blocked tab, and exports with the Threat filter applied no longer fail with an "exceeds 50,000 records" error.
Dark Mode Hidden Text
– Resolved an issue where text typed into the signup goal field and the Add IP/Hostname drawer was invisible in dark mode.
Clearer Validation Messages
– Saving a profile with an invalid name or phone number, and adding a user through the API with a missing or unrecognized role, now return clear validation messages instead of generic or server errors.
Wi-Fi Count After Pro to Plus Migration
– Fixed an issue where Pro to Plus migrations kept the old Wi-Fi (access point) count instead of removing it, since Plus includes access points. The leftover count caused later subscription changes to be rejected.
Relay Now Available on Core Plan
– Core plan organizations can now access the Relays page and deploy Relay from the dashboard, since Relay is included in Core.

Plus general performance and stability improvements across the dashboard.

October 20, 2026

new

Web App

API

10/20 October 20 – Web Application and API Update

🪲 Bug Fixes
Email Two-Factor Authentication Login Reliability
 — Resolved an issue where users with email as their only two-factor method were intermittently sent back to the login screen mid-flow, causing the first emailed code to be rejected and requiring multiple login attempts to get in.
API Boolean False Values Now Honored
 — Resolved an issue where sending JSON false
 for certain API options — including clear_registry
 on Roaming Client delete requests — was silently treated as true
, causing the registry to be cleared even when explicitly set not to. Explicit false
 values are now respected as intended.
Query Log Deployment Type Column for Site Traffic
 — Resolved an issue where filtering the Query Log by Deployment Type = Site returned correct results but left the Deployment Type column blank for every row. Site traffic now correctly displays "Site" in the column, consistent with how other deployment types appear.
CyberSight Reports Stability Under High Load
 — Resolved an issue where CyberSight reports — including Top Active Clients — could fail to load during periods of high concurrent report activity, returning an error instead of results.
Plus general performance and stability improvements across the dashboard.

October 15, 2026

fixed

Mac Roaming Client

RC Release Channels

10/15 October 15 – macOS Roaming Client v2.4.7 Production

Version 2.4.7 of the macOS Roaming Client is now available on the

Production

channel. To install, download the latest production installer from the dashboard under

Deployments → Roaming Clients

. Auto-upgrades will roll out gradually.

🪲 Bug Fixes

Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.

October 14, 2026

fixed

Mac Roaming Client

RC Release Channels

Beta

10/14 October 14 – macOS Roaming Client v2.4.7 Beta

Version 2.4.7 of the macOS Roaming Client is now available on the

Beta channel

. To install, download the latest beta installer from the dashboard under

Deployments → Roaming Clients → Beta Channel

🪲 Bug Fixes

Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.

October 13, 2026

new

Web App

API

10/13 October 13 – Web Application and API Update

🛠️

Improvements

Unblock Request Form Now Available in Additional Languages
– The Request Access form on block pages now displays in Spanish, French, and German when the user’s browser is set to any of those languages, keeping the experience consistent from block page to access request. Additional languages are planned.
Branding Subdomain Updated to .io
– Managed branded subdomains have moved from
.app.dnsfilter.app
to
app.dnsfilter.io
. Existing subdomains carry over automatically — no action required.

🪲

Bug Fixes

Identity Sync User Matching for Entra ID-Joined Devices
– Resolved an issue where users provisioned via Identity Sync on Entra ID-joined (cloud-only) devices were not being matched to their Roaming Client, causing them to remain unmatched and fall back to the Roaming Client policy instead of their assigned Collection policy.
Domain Report Policy Summary and Add/Remove Drawer Inconsistency
– Resolved an issue where the Policy Summary card and the Allow/Block List drawer contradicted each other when a subdomain was searched and its parent domain was the listed entry. The drawer now correctly reflects inherited coverage and clarifies which entry is responsible.
Zapier Integration Broken by Unblock Requests GA
– Resolved an issue where existing Zapier integrations triggered on unblock request admin notification emails stopped firing after the Unblock Requests GA release. Admin email notifications now fire as expected, restoring Zapier trigger compatibility.
SSO Session Expiry Redirect
– Resolved a long-standing issue where expired SSO sessions redirected users to the default DNSFilter login page instead of their organization's SSO vanity URL.
Subscription Page Plan Edit Unresponsive
– Resolved an issue where the plan edit controls on the Subscription page were unresponsive for certain accounts, preventing admins from updating plan assignments.
Billing Page Price Per License Display
– Resolved an issue where the price per license shown on the Billing page did not match actual billing amounts for some accounts with different license quantities across organizations.

Plus general performance and stability improvements across the dashboard.

October 8, 2026

improved

fixed

Windows Roaming Client

RC Release Channels

10/08 October 8 – Windows Roaming Client v3.8.15 Production

Version 3.8.15 of the Windows Roaming Client is now available on the

Production channel

. The latest installer is available in the dashboard under

Deployments → Roaming Clients

🛠️ Improvements

Lower CPU Usage, Including on ARM64
: The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
Resilient Local Resolver Handling
: The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
Local Domain Fallback Control
: The new
LocalDomainFallbackEnabled
setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.

🔒 VPN Compatibility

Conflicting VPN Agents in Classic Mode
: In Classic DNS Filtering,
Disable Roaming Clients for Conflicting VPN Agents
now applies to all devices, and VPN adapter traffic is left to the VPN.
PreCheck on VPN Connections
: PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
Automatic DNS Restore
: If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.

🪲 Bug Fixes

ISP DNS interception:
On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
Active Directory:
Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
Diagnostic Tool:
Selecting
Other
as the reason now lets you enter a custom description and run diagnostics
Block Page:
Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15

October 6, 2026

new

Web App

API

10/06 October 6 – Web Application and API Update

🛠️ Improvements
Query Log Filter Upgrades
 – Two new filter options: a Domain filter, and the Query Type filter upgraded from free-text to a dropdown selector populated with record types present in the log.
UX Enhancements
 – Editing in the Allow/Block List and Organization Privacy Mode Override grids now routes exclusively through the row Actions menu, removing double-click and header pencil affordances for a more intentional editing experience. All data grids now also display a consistent "No results found — adjust the filters or search terms" message when a search or filter returns zero matches.
⚠️ API Deprecation Notice — Traffic Report Filter Parameters
The following filter parameters on /v1/traffic_reports/*
 endpoints are no longer applied and will be fully removed in 60 days:
nat_ips
 · private_ip
 · private_ip_from
 · private_ip_to
 · mac_addresses
These parameters remain supported on the /v1/query_logs
 endpoint, which reads from the raw query log and is unaffected by this change. If your integration uses any of these filters on traffic report endpoints, please update your API calls accordingly before the removal date.
🪲 Bug Fixes
Query Log and Domain Report Allow/Block Actions
 – Resolved an issue where Add/Remove to Allow/Block List used the root domain instead of the exact hostname in the row. Both surfaces now correctly act on the FQDN or subdomain being viewed.
Roaming Client Last Sync Time Accuracy
 – Resolved an issue where duplicate Last Contact entries caused inconsistent Last Sync timestamps in the Roaming Clients grid, leading to endpoints incorrectly appearing under stale-device filters.
Collections Name Field Character Validation
 – Resolved an issue where the Collections Name field rejected characters — such as ampersands — that are accepted in every other Name field across the platform.
CyberSight User Filter Display
 – Resolved an issue where the User filter dropdown reverted to "All Users" after applying a selection, even though results were correctly filtered.
CyberSight Events Chart Date Range
 – Resolved an issue where the Events chart could render bars for dates outside the selected range. Charts now stay correctly bounded to the selected window.
Plus general performance and stability improvements across the dashboard.

September 30, 2026

improved

fixed

Windows Roaming Client

RC Release Channels

Beta

09/30 September 30 – Windows Roaming Client v3.8.15 Beta

Version 3.8.15 of the Windows Roaming Client is now available on the

Beta channel

. To install, download the latest beta installer from the dashboard under

Deployments → Roaming Clients → Beta Channel

🛠️ Improvements

Lower CPU Usage, Including on ARM64
: The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
Resilient Local Resolver Handling
: The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
Local Domain Fallback Control
: The new
LocalDomainFallbackEnabled
setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.

🔒 VPN Compatibility

Conflicting VPN Agents in Classic Mode
: In Classic DNS Filtering,
Disable Roaming Clients for Conflicting VPN Agents
now applies to all devices, and VPN adapter traffic is left to the VPN.
PreCheck on VPN Connections
: PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
Automatic DNS Restore
: If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.

🪲 Bug Fixes

ISP DNS interception:
On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
Active Directory:
Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
Diagnostic Tool:
Selecting
Other
as the reason now lets you enter a custom description and run diagnostics
Block Page:
Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15

September 29, 2026

new

Web App

API

09/29 September 29 – Web Application and API Update

✨ What's New
Branding Settings Now Available to Additional MSPs
 – MSPs without a custom domain configured now have access to the new Branding settings page, replacing the legacy Whitelabel form. Existing logos carry over automatically — no re-upload required.
🛠️ Improvements
Query Log Pagination
 – The Query Log now uses cursor-based pagination, replacing page-number paging. Navigation moves forward and back through results with stable, reliable loads.
Grid Filter UX Cleanup
 – Two filter improvements across deployment and policy grids: the Add Filter button now disables automatically once all available filters have been applied, and the redundant Filters option has been removed from grids where the search bar already covers all filtering (Policies, Allow List, Block List, and Universal Lists).
Unblock Requests Category Data
 – The Category column in the Unblock Requests grid now shows domain category information even when a domain was blocked for a non-category reason (such as a Block List, AppAware, or Security block), giving admins more context when reviewing requests.
License Overage Banner Restored on Dashboards
 – The license overage warning and critical banners are now visible on Custom Dashboards, restoring alert visibility that was lost when the legacy Overview page was retired.
🪲 Bug Fixes
Block Page Preview Restored
 – Resolved an issue where previewing a custom Block Page displayed the default DNSFilter block page instead of the configured one, omitting the organization's logo, name, and Unblock Request button.
Block Page Editor False Unsaved Changes Warning
 – Resolved an issue where opening any Block Page edit view immediately activated the Save and Discard buttons — even with no changes made — prompting an "unsaved changes" warning on every navigation attempt.
Scheduled Reports Logo for Branding MSPs
 – Resolved an issue where net-new MSPs using the Branding settings page saw the default DNSFilter logo on Scheduled Reports instead of their uploaded logo.
Plus general performance and stability improvements across the dashboard.

→