08/26 August 26 – Windows Roaming Client v3.7.11 Production

Version 3.7.11 of the Windows Roaming Client is now available on the

Production channel

. The latest installer is available in the dashboard under

Deployments → Roaming Clients

✨

What's New

SecureTransit — Digital Privacy, Enforced as Policy

DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.

Encrypted in transit
– Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
Trackers blocked at the source
– Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
Set by policy
– Admins choose
Always On
,
Manual
, or
Disabled
, per organization or per device, from the same dashboard they already use for DNS filtering.
Nothing for users to install
– Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
Available as a per-device add-on
– License only the devices that need it, with a 14-day free trial for existing customers.

DNSFilter One Agent Preview

The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.

Filtering
– Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
SecureTransit
– Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
Settings
– Version, hostname, diagnostics, and logs in one place.

DNS PreCheck v2 — Filtering That Holds on Networks That Hijack DNS

Some networks don't leave DNS alone. Hotel Wi-Fi, captive portals, and ISPs that quietly intercept resolvers can redirect DNS traffic before it ever reaches DNSFilter — and on those networks, blocked domains could resolve anyway, with neither the admin nor the end user aware the gap existed. DNS PreCheck v2 detects that interference and keeps policy enforced regardless of what the local network does with DNS.

Rollout complete — now the default
– Introduced in v3.6.10, PreCheck v2 has finished rolling out and is the default for all Windows Roaming Clients on 3.6 and later.
No action required
– The transition was handled automatically. Nothing to enable, configure, or reinstall.
Confirm it's active
– Devices display
DNS PreCheck v2
as the filtering mode in the system tray, and PreCheck v2 queries appear with the
HTTP/2.0
protocol in your DNS query log. See Manage Connection and Filtering Modes for details.

🪲

Bug Fixes

Block Page on IPv6 and Dual-Stack Networks
– Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.