09/30 September 30 – Windows Roaming Client v3.8.15 Beta

Version 3.8.15 of the Windows Roaming Client is now available on the

Beta channel

. To install, download the latest beta installer from the dashboard under

Deployments → Roaming Clients → Beta Channel

🛠️ Improvements

Lower CPU Usage, Including on ARM64
: The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
Resilient Local Resolver Handling
: The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
Local Domain Fallback Control
: The new
LocalDomainFallbackEnabled
setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.

🔒 VPN Compatibility

Conflicting VPN Agents in Classic Mode
: In Classic DNS Filtering,
Disable Roaming Clients for Conflicting VPN Agents
now applies to all devices, and VPN adapter traffic is left to the VPN.
PreCheck on VPN Connections
: PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
Automatic DNS Restore
: If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.

🪲 Bug Fixes

ISP DNS interception:
On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
Active Directory:
Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
Diagnostic Tool:
Selecting
Other
as the reason now lets you enter a custom description and run diagnostics
Block Page:
Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15