DNSFilter
Roadmap
Feedback
Changelog

Changelog

Follow up on the latest improvements and updates.

RSS

new

Web App

API

11/10 November 10 – Web Application and API Update

✨
What's New
  • AppAware Library Expansion
    – More than 2,500 new applications have been added to the AppAware library across nine categories, including Technology, Cybersecurity, Remote Desktop, VPN and Proxy, Messaging, and File Sharing. Admins get finer control over remote desktop, VPN and proxy, security, and technology traffic, with the new apps available for policy and reporting alongside other tracked applications.
🛠️
Improvements
  • Clearer Filtering Mode Controls
    – The Roaming Client Control Center drawer and navigation now read "Filtering Mode" instead of "Connection & Filtering Mode." The boxed compatibility banner is replaced with concise helper text and a Show More link that lists compatible Roaming Client versions.
  • Clearer "Ignore Request" Wording in Unblock Requests
    – "Deny Request & Ignore" is now "Ignore Request," so the label matches what it does: clearing a request without notifying the requester, who can submit another one later.
  • Consistent CyberSight Timeline Error Messaging
    – When a Timeline search fails, the Events, Activity Breakdown, and per-device Timeline widgets now show the same clear messages as the rest of CyberSight. Retry appears only when it can succeed, and a failure on one device's row no longer affects the others.
  • Stronger Access and Data Scoping
    – Strengthened access checks on organization license details and policy subnet information so users only see data for organizations they're permitted to access.
🪲
Bug Fixes
  • Policy and Category on the Unblock Request Access Form
    – Resolved an issue where visitors with a non-English browser saw the request access form without the policy name or blocked category. The form now shows the same details in every language.
  • Unblock Request Access Form Tab Title
    – Resolved an issue where the browser tab title stayed in English on translated request access forms. The tab now matches the form's language.
Plus general performance and stability improvements across the dashboard.

new

Web App

API

11/03 November 3 – Web Application and API Update

✨
What's New
Branding Settings for MSPs with Custom Domains
– MSPs using a CNAME-based custom domain are migrating to a managed branding subdomain and the new Branding settings page, replacing the legacy Whitelabel page. Existing branding assets carry over automatically.
🛠️
Improvements
Clearer Policy and Block Page Inheritance
– The LAN Subnets, Relays, and Roaming Clients grids now show the inherited Policy or Block Page name with an "Inherited from Site" label beneath it, replacing the map-pin icon. Global policies show a globe icon beside the name.
Clearer Roaming Client Delete Messaging
– Updated copy across the Clean Up Tool, Actions menu, and delete modal explains the difference between Delete and Delete & Uninstall, which now appears only when uninstall-capable agents are selected. Single Roaming Client deletes also require type-to-confirm.
🪲
Bug Fixes
CyberSight Search and Report Loading
– Resolved an issue where searching Activity Logs could spin for minutes and falsely report "No results found." Slow-loading reports such as Top Categories, Top Risky Users, AI Usage, and the Events chart are improved as well.
CyberSight Short Time Range Reports
– Resolved an issue where Active Time Trend, AI Usage Over Time, Threat Trends, and the Timeline Events chart could fail to load for short time ranges, such as a single hour.
CyberSight Filter Reliability
– Resolved an issue where text filters containing a "<" character were altered before being applied. Filters now search exactly what was typed. Privacy protections for redacted content in CyberSight were also strengthened.
MSP Allow-List Enforcement in CyberSight
– Resolved an issue where MSP users restricted to an allow list of organizations could retrieve CyberSight data outside that list. Configured access restrictions now apply to every CyberSight request.
Plus general performance and stability improvements across the dashboard.

new

Web App

API

10/28 October 28 – Web Application and API Update

✨
What's New
  • Unblock Request Form in Eight More Languages
    – The Request Access form on block pages now displays in Italian, Dutch, Portuguese, Russian, Swedish, Czech, Turkish, and Ukrainian when the user's browser is set to one of those languages, joining Spanish, French, and German.
🛠️
Improvements
  • Data Export Restart in API Documentation
    – The API docs now include the call to restart a failed Data Export, using the saved connection settings so no SIEM credentials are needed.
  • Query Log Page Size and Email Delivery
    – The Query Logs report now caps page size at 1,000 rows for more consistent performance. Outgoing notification, report, and alert emails are also retried automatically if delivery fails, so fewer messages get dropped.
🪲
Bug Fixes
  • Identity Connection Management
    – Resolved issues where canceling an organization left its Identity Connection in an orphaned state, and where deleting an Identity Connection returned a 404 error. Collection description edits also now save as expected.
  • DNS Query Log Reliability
    – Resolved several Query Log issues: narrowly filtered views now show all matching rows and page correctly, exiting Investigate mode no longer leaves stale rows on the Blocked tab, and exports with the Threat filter applied no longer fail with an "exceeds 50,000 records" error.
  • Dark Mode Hidden Text
    – Resolved an issue where text typed into the signup goal field and the Add IP/Hostname drawer was invisible in dark mode.
  • Clearer Validation Messages
    – Saving a profile with an invalid name or phone number, and adding a user through the API with a missing or unrecognized role, now return clear validation messages instead of generic or server errors.
  • Wi-Fi Count After Pro to Plus Migration
    – Fixed an issue where Pro to Plus migrations kept the old Wi-Fi (access point) count instead of removing it, since Plus includes access points. The leftover count caused later subscription changes to be rejected.
  • Relay Now Available on Core Plan
    – Core plan organizations can now access the Relays page and deploy Relay from the dashboard, since Relay is included in Core.
Plus general performance and stability improvements across the dashboard.

new

Web App

API

10/20 October 20 – Web Application and API Update

🪲
Bug Fixes
Email Two-Factor Authentication Login Reliability
— Resolved an issue where users with email as their only two-factor method were intermittently sent back to the login screen mid-flow, causing the first emailed code to be rejected and requiring multiple login attempts to get in.
API Boolean False Values Now Honored
— Resolved an issue where sending JSON
false
for certain API options — including
clear_registry
on Roaming Client delete requests — was silently treated as
true
, causing the registry to be cleared even when explicitly set not to. Explicit
false
values are now respected as intended.
Query Log Deployment Type Column for Site Traffic
— Resolved an issue where filtering the Query Log by Deployment Type = Site returned correct results but left the Deployment Type column blank for every row. Site traffic now correctly displays "Site" in the column, consistent with how other deployment types appear.
CyberSight Reports Stability Under High Load
— Resolved an issue where CyberSight reports — including Top Active Clients — could fail to load during periods of high concurrent report activity, returning an error instead of results.
Plus general performance and stability improvements across the dashboard.

fixed

Mac Roaming Client

RC Release Channels

10/15 October 15 – macOS Roaming Client v2.4.7 Production

Version 2.4.7 of the macOS Roaming Client is now available on the
Production
channel. To install, download the latest production installer from the dashboard under
Deployments → Roaming Clients
. Auto-upgrades will roll out gradually.
🪲 Bug Fixes
  • Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.

fixed

Mac Roaming Client

RC Release Channels

Beta

10/14 October 14 – macOS Roaming Client v2.4.7 Beta

Version 2.4.7 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🪲 Bug Fixes
  • Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.

new

Web App

API

10/13 October 13 – Web Application and API Update

🛠️
Improvements
  • Unblock Request Form Now Available in Additional Languages
    – The Request Access form on block pages now displays in Spanish, French, and German when the user’s browser is set to any of those languages, keeping the experience consistent from block page to access request. Additional languages are planned.
  • Branding Subdomain Updated to .io
    – Managed branded subdomains have moved from
    .app.dnsfilter.app
    to
    app.dnsfilter.io
    . Existing subdomains carry over automatically — no action required.
🪲
Bug Fixes
  • Identity Sync User Matching for Entra ID-Joined Devices
    – Resolved an issue where users provisioned via Identity Sync on Entra ID-joined (cloud-only) devices were not being matched to their Roaming Client, causing them to remain unmatched and fall back to the Roaming Client policy instead of their assigned Collection policy.
  • Domain Report Policy Summary and Add/Remove Drawer Inconsistency
    – Resolved an issue where the Policy Summary card and the Allow/Block List drawer contradicted each other when a subdomain was searched and its parent domain was the listed entry. The drawer now correctly reflects inherited coverage and clarifies which entry is responsible.
  • Zapier Integration Broken by Unblock Requests GA
    – Resolved an issue where existing Zapier integrations triggered on unblock request admin notification emails stopped firing after the Unblock Requests GA release. Admin email notifications now fire as expected, restoring Zapier trigger compatibility.
  • SSO Session Expiry Redirect
    – Resolved a long-standing issue where expired SSO sessions redirected users to the default DNSFilter login page instead of their organization's SSO vanity URL.
  • Subscription Page Plan Edit Unresponsive
    – Resolved an issue where the plan edit controls on the Subscription page were unresponsive for certain accounts, preventing admins from updating plan assignments.
  • Billing Page Price Per License Display
    – Resolved an issue where the price per license shown on the Billing page did not match actual billing amounts for some accounts with different license quantities across organizations.
Plus general performance and stability improvements across the dashboard.

improved

fixed

Windows Roaming Client

RC Release Channels

10/08 October 8 – Windows Roaming Client v3.8.15 Production

Version 3.8.15 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15

new

Web App

API

10/06 October 6 – Web Application and API Update

🛠️
Improvements
Query Log Filter Upgrades
– Two new filter options: a Domain filter, and the Query Type filter upgraded from free-text to a dropdown selector populated with record types present in the log.
UX Enhancements
– Editing in the Allow/Block List and Organization Privacy Mode Override grids now routes exclusively through the row Actions menu, removing double-click and header pencil affordances for a more intentional editing experience. All data grids now also display a consistent "No results found — adjust the filters or search terms" message when a search or filter returns zero matches.
⚠️ API Deprecation Notice — Traffic Report Filter Parameters
The following filter parameters on
/v1/traffic_reports/*
endpoints are no longer applied and will be fully removed in 60 days:
nat_ips
·
private_ip
·
private_ip_from
·
private_ip_to
·
mac_addresses
These parameters remain supported on the
/v1/query_logs
endpoint, which reads from the raw query log and is unaffected by this change. If your integration uses any of these filters on traffic report endpoints, please update your API calls accordingly before the removal date.
🪲
Bug Fixes
Query Log and Domain Report Allow/Block Actions
– Resolved an issue where Add/Remove to Allow/Block List used the root domain instead of the exact hostname in the row. Both surfaces now correctly act on the FQDN or subdomain being viewed.
Roaming Client Last Sync Time Accuracy
– Resolved an issue where duplicate Last Contact entries caused inconsistent Last Sync timestamps in the Roaming Clients grid, leading to endpoints incorrectly appearing under stale-device filters.
Collections Name Field Character Validation
– Resolved an issue where the Collections Name field rejected characters — such as ampersands — that are accepted in every other Name field across the platform.
CyberSight User Filter Display
– Resolved an issue where the User filter dropdown reverted to "All Users" after applying a selection, even though results were correctly filtered.
CyberSight Events Chart Date Range
– Resolved an issue where the Events chart could render bars for dates outside the selected range. Charts now stay correctly bounded to the selected window.
Plus general performance and stability improvements across the dashboard.

improved

fixed

Windows Roaming Client

RC Release Channels

Beta

09/30 September 30 – Windows Roaming Client v3.8.15 Beta

Version 3.8.15 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15
Load More
→