DNSFilter
Roadmap
Feedback
Changelog

Changelog

Follow up on the latest improvements and updates.

RSS

new

Windows Roaming Client

RC Release Channels

08/26 August 26 – Windows Roaming Client v3.7.11 Production

Version 3.7.11 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
DNS PreCheck v2 — Filtering That Holds on Networks That Hijack DNS
Some networks don't leave DNS alone. Hotel Wi-Fi, captive portals, and ISPs that quietly intercept resolvers can redirect DNS traffic before it ever reaches DNSFilter — and on those networks, blocked domains could resolve anyway, with neither the admin nor the end user aware the gap existed. DNS PreCheck v2 detects that interference and keeps policy enforced regardless of what the local network does with DNS.
  • Rollout complete — now the default
    – Introduced in v3.6.10, PreCheck v2 has finished rolling out and is the default for all Windows Roaming Clients on 3.6 and later.
  • No action required
    – The transition was handled automatically. Nothing to enable, configure, or reinstall.
  • Confirm it's active
    – Devices display
    DNS PreCheck v2
    as the filtering mode in the system tray, and PreCheck v2 queries appear with the
    HTTP/2.0
    protocol in your DNS query log. See Manage Connection and Filtering Modes for details.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.

new

Windows Roaming Client

RC Release Channels

Beta

08/17 August 17 – Windows Roaming Client v3.7.11 Beta

Version 3.7.11 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.

new

Windows Roaming Client

RC Release Channels

08/10 August 10 – Windows Roaming Client v3.6.10

Version 3.6.10 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
DNS PreCheck v2
– DNS PreCheck now maintains policy enforcement even on networks that hijack or redirect DNS traffic — closing a gap where certain network conditions could allow content through that should have been blocked. PreCheck v2 is being rolled out gradually and is not automatically enabled with this agent update. Once enabled, the tray will update to show "DNS PreCheck v2" to confirm the active mode.
Automatic Tray Process Recovery
– The system tray process now automatically restarts if it stops unexpectedly, keeping tray status and controls available without requiring a manual restart of the client or machine.
🛠️
Improvements
Network Adapter DNS Restoration on Service Stop
– The agent now correctly restores DNS settings on all network adapters when the service stops, including on machines with multiple adapters such as a VPN or virtual adapter alongside Wi-Fi.
DNS Filtering Recovery After Network Interruption
– The agent now reliably resumes filtering through PreCheck and Transparent Proxy modes after a network interruption or sleep/resume cycle without requiring a service restart.
Loopback Proxy Isolation in Transparent Proxy and PreCheck Modes
– The loopback proxy no longer starts when the client is running in Transparent Proxy or PreCheck mode, preventing the two filtering paths from conflicting.
🪲
Bug Fixes
Agent Stability on Wake from Sleep
– Resolved an issue where the agent could crash or enter repeated service restart cycles after waking from sleep, causing intermittent DNS resolution failures until the service recovered.
DNS Delay in Classic Filtering Mode
– Resolved an issue where the agent returned SERVFAIL instead of NXDOMAIN for non-existent records in Classic (Loopback) mode, causing browser retry behavior and extended DNS delays on page loads.
Tray Last Sync Timestamp
– Resolved an issue where the Last Sync timestamp in the system tray froze after agent startup and never updated, even while the device was online and actively filtering.
GlobalProtect VPN Compatibility
– Resolved a conflict between the Roaming Client and GlobalProtect VPN that could cause DNS resolution failures and in some cases an agent crash.
Dashboard Config Not Delivered When Browser Extension Field Is Null
– Resolved an issue where a null value for the browser extension setting in the API response caused the agent's configuration sync to fail on every cycle, preventing local domains and other dashboard settings from reaching the agent.

new

Mac Roaming Client

RC Release Channels

Beta

08/06 August 6 – macOS Roaming Client v2.4.5 Beta

Version 2.4.5 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
⚠️
Minimum macOS Version Update
– Starting with v2.4.4, the macOS Roaming Client requires macOS 13 Ventura or later. macOS 12 Monterey is no longer supported.
🪲 Stability & Connectivity Fixes
  • Fixed a DNS failover issue introduced in the 2.4 series that could cause intermittent resolution failures. When a lookup fell back to a backup server or protocol, the retry could be rejected or dropped — most pronounced with secure DNS (DNS-over-TLS) as the primary protocol, where affected devices could see a large share of queries fail and, with fail-close enabled, lose connectivity until the agent recovered.

new

Windows Roaming Client

RC Release Channels

Beta

07/29 July 29 – Windows Roaming Client v3.6.10 Beta

Version 3.6.10 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
  • DNS PreCheck v2
    – DNS PreCheck now maintains policy enforcement even on networks that hijack or redirect DNS traffic — closing a gap where certain network conditions could allow content through that should have been blocked. PreCheck v2 is being rolled out gradually and is not automatically enabled with this agent update. Once enabled for your organization, the tray will update to show "DNS PreCheck v2" to confirm the active mode.
  • Automatic Tray Process Recovery
    – The system tray process now automatically restarts if it stops unexpectedly, keeping tray status and controls available without requiring a manual restart of the client or machine.
🛠️ Improvements
  • Network Adapter DNS Restoration on Service Stop
    – The agent now correctly restores DNS settings on all network adapters when the service stops, including on machines with multiple adapters such as a VPN or virtual adapter alongside Wi-Fi.
  • DNS Filtering Recovery After Network Interruption
    – The agent now reliably resumes filtering through PreCheck and Transparent Proxy modes after a network interruption or sleep/resume cycle without requiring a service restart.
  • Loopback Proxy Isolation in Transparent Proxy and PreCheck Modes
    – The loopback proxy no longer starts when the client is running in Transparent Proxy or PreCheck mode, preventing the two filtering paths from conflicting.
🪲
Bug Fixes
  • Agent Stability on Wake from Sleep
    – Resolved an issue where the agent could crash or enter repeated service restart cycles after waking from sleep, causing intermittent DNS resolution failures until the service recovered.
  • DNS Delay in Classic Filtering Mode
    – Resolved an issue where the agent returned SERVFAIL instead of NXDOMAIN for non-existent records in Classic (Loopback) mode, causing browser retry behavior and extended DNS delays on page loads.
  • Tray Last Sync Timestamp
    – Resolved an issue where the Last Sync timestamp in the system tray froze after agent startup and never updated, even while the device was online and actively filtering.
  • GlobalProtect VPN Compatibility
    – Resolved a conflict between the Roaming Client and GlobalProtect VPN that could cause DNS resolution failures and in some cases an agent crash.
  • Dashboard Config Not Delivered When Browser Extension Field Is Null
    – Resolved an issue where a null value for the browser extension setting in the API response caused the agent's configuration sync to fail on every cycle, preventing local domains and other dashboard settings from reaching the agent.

new

Mac Roaming Client

RC Release Channels

Beta

07/22 July 22 – macOS Roaming Client v2.4.4 Beta

Version 2.4.4 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
⚠️
Minimum macOS Version Update
– Starting with v2.4.4, the macOS Roaming Client requires macOS 13 Ventura or later. macOS 12 Monterey is no longer supported.
🛠️ Improvements
Live Local Domain and Resolver Sync
– Local domain and resolver configuration changes made in the dashboard now apply without requiring a daemon restart, keeping filtering current as your environment changes.
🪲 Stability & Connectivity Fixes
  • Fixed an issue where large DNS records (such as TXT, SPF, DKIM, and DNSSEC records) could not be resolved while the agent was active, as truncated UDP responses were not being retried over TCP
  • Fixed an issue where local domains defined in the configuration file lost their assigned resolvers, causing matching queries to fall through to public resolvers instead
  • Fixed an issue where the menu bar icon could become unresponsive, particularly when no network connection was available

new

Mac Roaming Client

RC Release Channels

07/16 July 16 – macOS Roaming Client v2.4.3 Beta

Version 2.4.3 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🪲
Stability & Connectivity Fixes
  • Fixed an issue where device hostnames were not automatically reported to the dashboard on fresh installs of v2.4.2, causing devices to appear with no hostname in the device list
  • Fixed an issue where reinstalling or upgrading the agent could create duplicate device entries in the dashboard
  • Resolved an issue where reassigning a device to a different site by changing the Site Key did not correctly update the device's site assignment and policy in the dashboard — the device now registers to the new site as expected on both live key changes and clean reinstalls
  • Fixed an issue where Travel Wi-Fi configuration settings (
    ALLOW_MANUAL_CAPTIVE_PORTAL
    ,
    ALLOW_PROXY_DISABLE
    , and
    CAPTIVE_PORTAL_DELAY
    ) were silently ignored when set in the
    dns_agent.conf
    file during CLI installation. These settings are now correctly applied on install

new

iOS Roaming Client

RC Release Channels

7/14 July 14 - iOS Roaming Client v1.4.4

A new version of the iOS Roaming Client is now available in the App Store and will begin rolling out to devices via Apple auto-updates today.
This release includes improvements to reliability, registration behavior, and MDM management.
✨
What's New
  • Improved MDM Support
    User name, hostname, and device tag changes in the configuration profile now sync to the Dashboard without requiring a Site Secret Key change
  • Automatic Site Reassignment from MDM
    A Site Secret Key change in the configuration profile now re-associates the device to the new site automatically, enabling fleet migrations without reinstalls or policy gaps
  • Stronger Admin PIN Protection
    Progressive delays are now applied between incorrect admin PIN attempts, making automated guessing impractical while keeping legitimate retries fast
  • Refreshed Branding
    App icons, visuals, and UI elements have been updated to match current DNSFilter branding
🪲
Bug Fixes
  • AirPrint and printer discovery
    Single-label and DNS-SD queries now route to Local Resolvers when configured, so discovered printers appear reliably while the Roaming Client is active
  • More reliable filtering after login
    Configuration now refreshes on a short interval instead of on every DNS query, fixing a brief window where a device could show blocked content right after login
  • Diagnostic logging on by default
    New installs now capture debug logs from the first run so Support can diagnose early issues; users can still disable it in the app

new

Android Roaming Client

RC Release Channels

07/09 July 9 – Android Roaming Client v1.22.1

We've released
Android Roaming Client v1.22.1
with bug fix. Navigate to the Google Play store to download.
🪲
Bug Fixes
Android Client Stability When Switching Display Modes
– Resolved an issue where the Android Roaming Client would crash without notification when switching between tablet and desktop/PC mode (e.g. Samsung DeX). The client now handles display configuration changes correctly and remains active across mode switches.

new

Mac Roaming Client

RC Release Channels

06/23 June 23 - macOS Roaming Client v2.4.2 Production

Version 2.4.2 of the macOS Roaming Client is now available on the
Production
channel. To install, download the latest production installer from the dashboard under
Deployments → Roaming Clients
.
✨ What's New
Component Version Mismatch Detection
– The Roaming Client now detects when the menu bar app, system extension, and daemon are running mismatched versions — a scenario that can cause features to behave unexpectedly after upgrades or MDM-managed installs. When a mismatch is detected, users are alerted and can resolve it directly from the menu.
🪲 Stability & Connectivity Fixes
  • Fixed an issue where the agent could fail to start correctly on macOS boot due to a stale local DNS configuration file from a previous session, causing it to get stuck and never recover without a manual restart
  • Addressed an intermittent offline issue where some endpoints could go offline after waking from sleep or switching networks and require a reboot to recover
  • Corrected a regression where Travel Wi-Fi mode would disappear from the menu after rebooting with Wi-Fi disabled, on machines with certain network extensions present
  • Restored the allow_proxy_disable configuration setting, which was silently dropped when upgrading from 2.3.x to 2.4.x — the setting is now correctly carried forward
  • The menu bar icon now correctly shows the offline state when the device has no network connection, without surfacing a spurious "Fix Installation Issues" warning that doesn't apply in that context
Load More
→