Changelog

Follow up on the latest improvements and updates.

RSS

improved

fixed

Windows Roaming Client

RC Release Channels

10/08 October 8 – Windows Roaming Client v3.8.15 Production

Version 3.8.15 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15

improved

fixed

Windows Roaming Client

RC Release Channels

Beta

09/30 September 30 – Windows Roaming Client v3.8.15 Beta

Version 3.8.15 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🛠️ Improvements
  • Lower CPU Usage, Including on ARM64
    : The Roaming Client now reads device identity, OS version, and adapter DNS settings directly from Windows APIs instead of WMI. WMI Provider Host CPU usage stays low on all devices, including cellular-connected laptops, and startup is faster.
  • Resilient Local Resolver Handling
    : The Roaming Client now tells confirmed answers apart from resolver errors and empty responses, and every local resolver check has a timeout. Internal name resolution stays accurate through resolver outages, sleep and wake, and network changes.
  • Local Domain Fallback Control
    : The new
    LocalDomainFallbackEnabled
    setting controls whether local-domain queries your internal resolvers can't answer go to DNSFilter or stay on your network. Use it for split-horizon domains and internal zones that should never resolve publicly.
🔒 VPN Compatibility
  • Conflicting VPN Agents in Classic Mode
    : In Classic DNS Filtering,
    Disable Roaming Clients for Conflicting VPN Agents
    now applies to all devices, and VPN adapter traffic is left to the VPN.
  • PreCheck on VPN Connections
    : PreCheck now gives the device's resolver its own response window, so queries over VPN tunnels resolve reliably even when the tunnel's resolver is slower than DNSFilter's policy check.
  • Automatic DNS Restore
    : If a VPN connecting or disconnecting, or an unexpected shutdown, leaves network adapters pointed at the filtering proxy, the Service Manager restores DNS and re-registers the device automatically.
🪲 Bug Fixes
  • ISP DNS interception:
    On networks where the ISP intercepts DNS, the Roaming Client moves the query to the next protocol in your configured order (for example, DNS-over-TLS) so sites load normally
  • Active Directory:
    Domain-joined devices in Transparent Proxy and PreCheck modes now register their DNS records with the domain controller using secure dynamic updates
  • Diagnostic Tool:
    Selecting
    Other
    as the reason now lets you enter a custom description and run diagnostics
  • Block Page:
    Blocked HTTPS sites now show the block page with no certificate warning on MSP organizations created after September 15

new

Windows Roaming Client

RC Release Channels

08/26 August 26 – Windows Roaming Client v3.7.11 Production

Version 3.7.11 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
DNS PreCheck v2 — Filtering That Holds on Networks That Hijack DNS
Some networks don't leave DNS alone. Hotel Wi-Fi, captive portals, and ISPs that quietly intercept resolvers can redirect DNS traffic before it ever reaches DNSFilter — and on those networks, blocked domains could resolve anyway, with neither the admin nor the end user aware the gap existed. DNS PreCheck v2 detects that interference and keeps policy enforced regardless of what the local network does with DNS.
  • Rollout complete — now the default
    – Introduced in v3.6.10, PreCheck v2 has finished rolling out and is the default for all Windows Roaming Clients on 3.6 and later.
  • No action required
    – The transition was handled automatically. Nothing to enable, configure, or reinstall.
  • Confirm it's active
    – Devices display
    DNS PreCheck v2
    as the filtering mode in the system tray, and PreCheck v2 queries appear with the
    HTTP/2.0
    protocol in your DNS query log. See Manage Connection and Filtering Modes for details.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.

new

Windows Roaming Client

RC Release Channels

Beta

08/17 August 17 – Windows Roaming Client v3.7.11 Beta

Version 3.7.11 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
SecureTransit — Digital Privacy, Enforced as Policy
DNSFilter's DNS-layer protection already follows users onto any network, but being covered is not the same as being private. On hotel Wi-Fi, in airport lounges, and on the home connections where hybrid work actually happens, the destinations a device reaches stay visible to whoever runs the network — and to the ad networks, location trackers, and data brokers collecting alongside. SecureTransit closes that gap by making privacy a policy the organization enforces, not a choice each user has to remember to switch on.
  • Encrypted in transit
    – Traffic is encrypted before it leaves the device, through a DNSFilter-managed secure gateway with a choice of WireGuard or IKEv2.
  • Trackers blocked at the source
    – Location trackers, mail trackers, data brokers, and ad networks are cut off on the path, before data leaves — on any network, including your own.
  • Set by policy
    – Admins choose
    Always On
    ,
    Manual
    , or
    Disabled
    , per organization or per device, from the same dashboard they already use for DNS filtering.
  • Nothing for users to install
    – Credentials and connections are managed server-side, so there is nothing for employees to set up or misconfigure.
  • Available as a per-device add-on
    – License only the devices that need it, with a 14-day free trial for existing customers.
DNSFilter One Agent Preview
The Windows agent replaces the right-click tray menu with a full DNSFilter One window, themed to match your system's light or dark mode.
  • Filtering
    – Protection state, filtering mode, and last sync, with an activity view showing blocked and allowed queries over the past hour.
  • SecureTransit
    – Connection status, the connected server on a map, region, protocol, session uptime, and data transferred, with Connect and Disconnect controls. Appears when SecureTransit is enabled.
  • Settings
    – Version, hostname, diagnostics, and logs in one place.
🪲
Bug Fixes
  • Block Page on IPv6 and Dual-Stack Networks
    – Resolved an issue where blocked domains did not return the block page on IPv6 and dual-stack networks. Requests for blocked domains were refused rather than resolved to the block page, so users saw a connection error instead of the block page.

new

Windows Roaming Client

RC Release Channels

08/10 August 10 – Windows Roaming Client v3.6.10

Version 3.6.10 of the Windows Roaming Client is now available on the
Production channel
. The latest installer is available in the dashboard under
Deployments → Roaming Clients
.
✨
What's New
DNS PreCheck v2
– DNS PreCheck now maintains policy enforcement even on networks that hijack or redirect DNS traffic — closing a gap where certain network conditions could allow content through that should have been blocked. PreCheck v2 is being rolled out gradually and is not automatically enabled with this agent update. Once enabled, the tray will update to show "DNS PreCheck v2" to confirm the active mode.
Automatic Tray Process Recovery
– The system tray process now automatically restarts if it stops unexpectedly, keeping tray status and controls available without requiring a manual restart of the client or machine.
🛠️
Improvements
Network Adapter DNS Restoration on Service Stop
– The agent now correctly restores DNS settings on all network adapters when the service stops, including on machines with multiple adapters such as a VPN or virtual adapter alongside Wi-Fi.
DNS Filtering Recovery After Network Interruption
– The agent now reliably resumes filtering through PreCheck and Transparent Proxy modes after a network interruption or sleep/resume cycle without requiring a service restart.
Loopback Proxy Isolation in Transparent Proxy and PreCheck Modes
– The loopback proxy no longer starts when the client is running in Transparent Proxy or PreCheck mode, preventing the two filtering paths from conflicting.
🪲
Bug Fixes
Agent Stability on Wake from Sleep
– Resolved an issue where the agent could crash or enter repeated service restart cycles after waking from sleep, causing intermittent DNS resolution failures until the service recovered.
DNS Delay in Classic Filtering Mode
– Resolved an issue where the agent returned SERVFAIL instead of NXDOMAIN for non-existent records in Classic (Loopback) mode, causing browser retry behavior and extended DNS delays on page loads.
Tray Last Sync Timestamp
– Resolved an issue where the Last Sync timestamp in the system tray froze after agent startup and never updated, even while the device was online and actively filtering.
GlobalProtect VPN Compatibility
– Resolved a conflict between the Roaming Client and GlobalProtect VPN that could cause DNS resolution failures and in some cases an agent crash.
Dashboard Config Not Delivered When Browser Extension Field Is Null
– Resolved an issue where a null value for the browser extension setting in the API response caused the agent's configuration sync to fail on every cycle, preventing local domains and other dashboard settings from reaching the agent.

new

Windows Roaming Client

RC Release Channels

Beta

07/29 July 29 – Windows Roaming Client v3.6.10 Beta

Version 3.6.10 of the Windows Roaming Client is now available on the
Beta channel
. To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
✨
What's New
  • DNS PreCheck v2
    – DNS PreCheck now maintains policy enforcement even on networks that hijack or redirect DNS traffic — closing a gap where certain network conditions could allow content through that should have been blocked. PreCheck v2 is being rolled out gradually and is not automatically enabled with this agent update. Once enabled for your organization, the tray will update to show "DNS PreCheck v2" to confirm the active mode.
  • Automatic Tray Process Recovery
    – The system tray process now automatically restarts if it stops unexpectedly, keeping tray status and controls available without requiring a manual restart of the client or machine.
🛠️ Improvements
  • Network Adapter DNS Restoration on Service Stop
    – The agent now correctly restores DNS settings on all network adapters when the service stops, including on machines with multiple adapters such as a VPN or virtual adapter alongside Wi-Fi.
  • DNS Filtering Recovery After Network Interruption
    – The agent now reliably resumes filtering through PreCheck and Transparent Proxy modes after a network interruption or sleep/resume cycle without requiring a service restart.
  • Loopback Proxy Isolation in Transparent Proxy and PreCheck Modes
    – The loopback proxy no longer starts when the client is running in Transparent Proxy or PreCheck mode, preventing the two filtering paths from conflicting.
🪲
Bug Fixes
  • Agent Stability on Wake from Sleep
    – Resolved an issue where the agent could crash or enter repeated service restart cycles after waking from sleep, causing intermittent DNS resolution failures until the service recovered.
  • DNS Delay in Classic Filtering Mode
    – Resolved an issue where the agent returned SERVFAIL instead of NXDOMAIN for non-existent records in Classic (Loopback) mode, causing browser retry behavior and extended DNS delays on page loads.
  • Tray Last Sync Timestamp
    – Resolved an issue where the Last Sync timestamp in the system tray froze after agent startup and never updated, even while the device was online and actively filtering.
  • GlobalProtect VPN Compatibility
    – Resolved a conflict between the Roaming Client and GlobalProtect VPN that could cause DNS resolution failures and in some cases an agent crash.
  • Dashboard Config Not Delivered When Browser Extension Field Is Null
    – Resolved an issue where a null value for the browser extension setting in the API response caused the agent's configuration sync to fail on every cycle, preventing local domains and other dashboard settings from reaching the agent.

new

Windows Roaming Client

RC Release Channels

06/15 June 15 – Windows Roaming Client v3.4.23 Production

Version 3.4.23 of the Windows Roaming Client is now available on the
Production
channel. This release addresses a DNS resolution issue affecting some endpoints on dual-stack (IPv4 + IPv6) networks.
To install, download the latest production installer from the dashboard under Deployments → Roaming Clients.
🛠️ Improvements
Windows Server OS Detection
– When installed on a Windows Server OS, the agent now automatically falls back to Loopback filtering mode rather than attempting to load unsupported filtering modes. Windows Server OS is not an officially supported environment, but this change prevents unexpected behavior on Server deployments.
Device Identification
– Devices are now identified more consistently in the dashboard, reducing missing identifiers after upgrades or reinstalls causing duplicate entries
Installer & Upgrade Reliability
– Improved installer prerequisite validation and upgrade handling — failed upgrades no longer leave the endpoint without the Roaming Client installed.
🪲 Bug Fixes
Dual-Stack Stability
– Resolved issues affecting endpoints on dual-stack (IPv4 + IPv6) networks where the agent could interfere with other networking software, in some cases preventing local or public DNS queries from resolving correctly.
DNS Connectivity in Transparent Proxy
– Resolved scenarios in Transparent Proxy mode that could cause local-name and search-suffix DNS lookups to fail or leave the endpoint without connectivity.
Tray Icon Reliability
– Resolved a conflict that could cause the DNSFilter tray icon to be unreliable on shared/multi-user Windows machines and in environments with certain third-party applications.

new

Windows Roaming Client

RC Release Channels

Beta

06/11 June 11 – Windows Roaming Client v3.4.23 Beta

Version 3.4.23 of the Windows Roaming Client is now available on the
Beta channel
. This release addresses a DNS resolution issue affecting some endpoints on dual-stack (IPv4 + IPv6) networks.
To install, download the latest beta installer from the dashboard under
Deployments → Roaming Clients → Beta Channel
.
🛠️
Improvements
  • Windows Server OS Support
    – When installed on a Windows Server OS, the agent now automatically selects the supported filtering mode for Server deployments.
  • Device Identification
    – Devices are now identified more consistently in the dashboard, reducing missing identifiers after upgrades or reinstalls causing duplicate entries
  • Installer & Upgrade Reliability
    – Improved installer prerequisite validation and upgrade handling — failed upgrades no longer leave the endpoint without the Roaming Client installed.
🪲
Bug Fixes
  • Dual-Stack Stability
    – Resolved issues affecting endpoints on dual-stack (IPv4 + IPv6) networks where the agent could interfere with other networking software, in some cases preventing local or public DNS queries from resolving correctly.
  • DNS Connectivity in Transparent Proxy
    – Resolved scenarios in Transparent Proxy mode that could cause local-name and search-suffix DNS lookups to fail or leave the endpoint without connectivity.
  • Tray Icon Reliability
    – Resolved a conflict that could cause the DNSFilter tray icon to be unreliable on shared/multi-user Windows machines and in environments with certain third-party applications.

new

Windows Roaming Client

RC Release Channels

05/28 May 28 – Windows Roaming Client v3.3.8 Hotfix

We've released Windows Roaming Client v3.3.8 with an improvement to how the agent handles connectivity checks in the background.
🛠️
Improvement
Optimized Background Connectivity Checks
– Reduced the frequency of internal connectivity checks performed by the Windows Roaming Client under steady-state conditions. Checks are now triggered by actual network events rather than on a fixed polling cycle, improving efficiency without impacting connectivity detection or DNS filtering behavior.
🪲
Bug Fixes
Intermittent IPv6 Connectivity Recovery
– Resolved an issue where transient IPv6 route changes could leave the agent in a state where filtering was marked as not working, even though network connectivity had not actually changed. The agent now correctly recovers and resumes filtering when the underlying network state has not changed.

new

Windows Roaming Client

RC Release Channels

04/16 April 16 – Windows Roaming Client v3.3.6 Hotfix

We've released Windows Roaming Client v3.3.6 to address a local domain resolution issue affecting some users on Classic DNS Filtering.
🪲 Hotfix
Local Domain Resolution with Classic Filtering
– Resolved an issue where local network resources were not resolving correctly for some users after updating to Windows Roaming Client v3.3.1 with Classic DNS Filtering enabled. Local domain resolution now works as expected.
Load More
→