DNSFilter
Roadmap
Feedback
Changelog

Changelog

Follow up on the latest improvements and updates.

RSS

FixedMac Roaming ClientRC Release Channels

10/15 October 15 – macOS Roaming Client v2.4.7 Production

Version 2.4.7 of the macOS Roaming Client is now available on the
Production
channel. To install, download the latest production installer from the dashboard under
Deployments → Roaming Clients
. Auto-upgrades will roll out gradually.
🪲 Bug Fixes
  • Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.
FixedMac Roaming ClientRC Release ChannelsBeta

10/14 October 14 – macOS Roaming Client v2.4.7 Beta

Version 2.4.7 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🪲 Bug Fixes
  • Fixed an issue on macOS 27 where devices stopped checking in with the dashboard after a restart. Filtering was not affected.
ImprovedfixedWindows Roaming ClientRC Release Channels

10/08 October 8 – Windows Roaming Client v3.8.15 Production

Version 3.8.15 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15
ImprovedfixedWindows Roaming ClientRC Release ChannelsBeta

09/30 September 30 – Windows Roaming Client v3.8.15 Beta

Version 3.8.15 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15
NewfixedimprovedMac Roaming ClientRC Release Channels

09/23 September 23 - macOS Roaming Client v2.4.6 Production

Version 2.4.6 of the macOS Roaming Client is now available on the
Production
channel. This release brings together every update from the 2.4 Beta series (v2.4.0 through v2.4.6). To install, download the latest production installer from the dashboard under
Deployments → Roaming Clients
. Auto-upgrades will roll out gradually.
⚠️ Action Required: Redeploy the Updated Certificate Profile
v2.4.6 checks for the new
DNSFilter Root CA G1
certificate. Devices that still have the previous certificate profile will show a
Fix Installation Issues
prompt in the menu bar after upgrading.
Filtering and protection keep working normally while the prompt is showing.
To clear the prompt, download the updated
Combined_Certificates.mobileconfig
(or the branded or white-label profile you deploy) from the Prerequisites section of the macOS Roaming Client install guide and push it through your MDM. The updated profile replaces the installed one in place. We recommend pushing it before auto-upgrade reaches your devices.
⚠️
Minimum macOS Version:
The macOS Roaming Client now requires macOS 13 Ventura or later.
✨ What's New
  • IPv6 Support
    : Filtering and protection now cover IPv6 networks, so users on dual-stack and IPv6-only networks stay protected. Administrators can set upstream resolution to IPv4-only, IPv6-only, or automatic.
  • Filtering Stays On Through a VPN (Opt-In)
    : Devices using encrypted DNS now keep DNSFilter filtering on while a corporate VPN is connected, even when the tunnel blocks the DNS-over-TLS port. Filtering switches to DNS-over-HTTPS, so remote and hybrid users on VPN stay protected and keep encrypted DNS. To turn it on for an install, set
    ENABLE_DOH_FALLBACK=true
    . The deployment guide covers setup and network requirements.
  • Component Version Mismatch Detection
    : The Roaming Client now detects when the menu bar app, system extension, and daemon are running different versions, which can happen after upgrades or MDM-managed installs. When it finds a mismatch, it alerts the user, who can fix it from the menu.
  • Modernized Configuration Architecture
    : The agent now uses a more resilient
    configuration.json
    format in place of the legacy
    daemon.conf
    . Configuration changes apply more reliably without restarting the agent, and existing installations migrate automatically on upgrade. Upstream protocol order settings, including DNS-over-TLS, now apply as configured.
  • Local Domains Stay Current
    : Changes to local domains and resolvers made in the dashboard now apply right away, with no daemon restart needed, and internal domains stay on their assigned local resolvers after restarts and upgrades.
🛠️ Improvements
  • Every Certificate Root in One Profile
    : The macOS certificate profiles now install all DNSFilter roots in a single push, including DNSFilter Root CA G1.
  • Travel Wi-Fi Keys Match the Docs
    : Install-time configuration keys now use the same Travel Wi-Fi names as the dashboard and documentation, and Travel Wi-Fi settings in
    dns_agent.conf
    apply at CLI install. Existing scripts that use the previous names keep working.
  • More Resilient Connectivity
    : The agent's connection handling and upstream failover have been rebuilt, so devices stay filtered as networks change, with less need for a manual restart.
🪲 Bug Fixes
  • Captive portals:
    Captive portal detection is more accurate, the Access Captive Network option clears once you're connected, and Travel Wi-Fi appears as expected when configured through JSON
  • Site assignment:
    Changing a device's Site Key now properly updates its site and policy in the dashboard
  • Menu bar:
    The menu bar icon stays responsive and shows the right state when there's no network connection, and Travel Wi-Fi mode stays in the menu after a reboot
  • Diagnostics:
    Diagnostics are collected more securely and include more complete information
NewimprovedfixedMac Roaming ClientRC Release ChannelsBeta

09/16 September 16 – macOS Roaming Client v2.4.6 Beta

Version 2.4.6 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
Filtering Stays On Through a VPN (Opt-In)
– Devices using encrypted DNS now keep DNSFilter filtering enforced while a corporate VPN is connected, even when the tunnel blocks the DNS-over-TLS port. Filtering continues over DNS-over-HTTPS, so remote and hybrid users stay protected on VPN without giving up encrypted DNS. Turn it on per install with
ENABLE_DOH_FALLBACK=true
; see the deployment guide for setup and network requirements.
🛠️ Improvements
Every Certificate Root in One Profile
– The published macOS certificate profiles now install all DNSFilter roots in a single push, including the new DNSFilter Root CA G1. Re-download the profile you already deploy and push it, and it replaces the installed one in place.
Travel Wi-Fi Keys Match the Docs
– Install-time configuration keys now use the same Travel Wi-Fi naming as the dashboard and documentation. Existing scripts keep working with the previous names.
🪲 Bug Fixes
  • Fixed an issue where deploying with a configuration override and no site key cleared the existing device configuration.
  • Fixed an issue where the Diagnostic Tool failed on the first run after a clean install.
  • Improved how diagnostics are collected and what the diagnostic bundle includes.
NewWindows Roaming ClientRC Release Channels

08/26 August 26 – Windows Roaming Client v3.7.11 Production

Version 3.7.11 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
DNS PreCheck v2 — Filtering That Holds on Networks That Hijack DNS
Some networks don't leave DNS alone. Hotel Wi-Fi, captive portals, and ISPs that quietly intercept resolvers can redirect DNS traffic before it ever reaches DNSFilter — and on those networks, blocked domains could resolve anyway, with neither the admin nor the end user aware the gap existed. DNS PreCheck v2 detects that interference and keeps policy enforced regardless of what the local network does with DNS.
  • Rollout complete — now the default
    – Introduced in v3.6.10, PreCheck v2 has finished rolling out and is the default for all Windows Roaming Clients on 3.6 and later.
  • No action required
    – The transition was handled automatically. Nothing to enable, configure, or reinstall.
  • Confirm it's active
    – Devices display
    DNS PreCheck v2
    as the filtering mode in the system tray, and PreCheck v2 queries appear with the
    HTTP/2.0
    protocol in your DNS query log. See Manage Connection and Filtering Modes for details.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.
NewWindows Roaming ClientRC Release ChannelsBeta

08/17 August 17 – Windows Roaming Client v3.7.11 Beta

Version 3.7.11 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.
NewWindows Roaming ClientRC Release Channels

08/10 August 10 – Windows Roaming Client v3.6.10

Version 3.6.10 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
DNS PreCheck v2
– DNS PreCheck now maintains policy enforcement even on networks that hijack or redirect DNS traffic — closing a gap where certain network conditions could allow content through that should have been blocked. PreCheck v2 is being rolled out gradually and is not automatically enabled with this agent update. Once enabled, the tray will update to show "DNS PreCheck v2" to confirm the active mode.
Automatic Tray Process Recovery
– The system tray process now automatically restarts if it stops unexpectedly, keeping tray status and controls available without requiring a manual restart of the client or machine.
🛠️
Improvements
Network Adapter DNS Restoration on Service Stop
– The agent now correctly restores DNS settings on all network adapters when the service stops, including on machines with multiple adapters such as a VPN or virtual adapter alongside Wi-Fi.
DNS Filtering Recovery After Network Interruption
– The agent now reliably resumes filtering through PreCheck and Transparent Proxy modes after a network interruption or sleep/resume cycle without requiring a service restart.
Loopback Proxy Isolation in Transparent Proxy and PreCheck Modes
– The loopback proxy no longer starts when the client is running in Transparent Proxy or PreCheck mode, preventing the two filtering paths from conflicting.
🪲
Bug Fixes
Agent Stability on Wake from Sleep
– Resolved an issue where the agent could crash or enter repeated service restart cycles after waking from sleep, causing intermittent DNS resolution failures until the service recovered.
DNS Delay in Classic Filtering Mode
– Resolved an issue where the agent returned SERVFAIL instead of NXDOMAIN for non-existent records in Classic (Loopback) mode, causing browser retry behavior and extended DNS delays on page loads.
Tray Last Sync Timestamp
– Resolved an issue where the Last Sync timestamp in the system tray froze after agent startup and never updated, even while the device was online and actively filtering.
GlobalProtect VPN Compatibility
– Resolved a conflict between the Roaming Client and GlobalProtect VPN that could cause DNS resolution failures and in some cases an agent crash.
Dashboard Config Not Delivered When Browser Extension Field Is Null
– Resolved an issue where a null value for the browser extension setting in the API response caused the agent's configuration sync to fail on every cycle, preventing local domains and other dashboard settings from reaching the agent.
NewMac Roaming ClientRC Release ChannelsBeta

08/06 August 6 – macOS Roaming Client v2.4.5 Beta

Version 2.4.5 of the macOS Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
⚠️
Minimum macOS Version Update
– Starting with v2.4.4, the macOS Roaming Client requires macOS 13 Ventura or later. macOS 12 Monterey is no longer supported.
🪲 Stability & Connectivity Fixes
  • Fixed a DNS failover issue introduced in the 2.4 series that could cause intermittent resolution failures. When a lookup fell back to a backup server or protocol, the retry could be rejected or dropped — most pronounced with secure DNS (DNS-over-TLS) as the primary protocol, where affected devices could see a large share of queries fail and, with fail-close enabled, lose connectivity until the agent recovered.
Load More
→