DNS filtering for MSPs: 27 products compared

DNS filtering is a security layer you can roll out to a whole client quickly: DNSFilter says most organisations deploy it in under an hour. Every device asks a DNS resolver where a domain lives before it connects. A filtering resolver refuses to answer for domains known to host malware or phishing, or for categories the client has blocked, so the connection never starts. The catalog's DNS Security category lists 27 products from 19 vendors as of October 2026. This guide covers how the products differ, where the free resolvers fit, and what to ask before you pick one for every client.

Key facts, October 2026

• 27 products from 19 vendors are listed under DNS Security, and all of them filter DNS traffic.
• 24 are client-facing: 20 run by the MSP and paid for by the client, 4 resold. 3 are free tools used as-is.
• 7 expose a public API and 3 have a verified MCP server, 2 of them from Infoblox.
• None lists a verified PSA integration.
• 19 of the 27 come from US vendors, 3 from Canada, 2 from Denmark and 1 each from Switzerland and the UK.

What DNS filtering does and doesn't do

A DNS filter blocks lookups. It stops a user reaching a phishing page from an email link, stops malware calling home to a known command-and-control domain, and enforces content rules such as blocking gambling sites on a school network. It does this before any traffic to the site flows.

It can't inspect what happens after a connection is made, and it can't see traffic that skips the filtering resolver: a device using a hard-coded IP address, or a browser sending encrypted DNS over HTTPS to a resolver of its own. Vendors answer this with roaming agents and support for DNS over HTTPS (DoH). ScoutDNS and CyberFOX list DoH support, and Heimdal's DNS Security Endpoint filters DNS over HTTPS traffic itself.

DNS filtering adds to endpoint protection and doesn't replace it. Some SASE platforms also include it, and our SASE guide covers them. Kaseya's Secure Edge lists DNS filtering alongside ZTNA and a next-gen firewall. If a client already runs one of those, check what you would be duplicating.

Free resolvers and MSP platforms

Three products in the category are free and used as-is.

• Quad9 is a free, non-profit recursive resolver that blocks malicious domains. It has resolver clusters in more than 110 countries and no sign-up, account or contract.
• CIRA Canadian Shield is a free service from the Canadian Internet Registration Authority, operated in Canada, with apps for Windows and macOS.
• CleanBrowsing Free Security Filter is described by CleanBrowsing itself as free DNS filtering "for parents, not organizations". Its business plan adds a management console for MSPs.

A free resolver is a good baseline for a home office or a guest network. For a managed client it is missing what you sell: per-client policies, reports, a dashboard and someone to call. Quad9 has no accounts by design, so it has nothing to report from. CIRA also lists a separate product, CIRA DNS Firewall.

The MSP platforms include DNSFilter, which says it has more than 6,000 MSP partners, N-able DNS Filtering, WebTitan DNS Filter from TitanHQ, ScoutDNS, DNS Filtering by CyberFOX, Zorus Filtering with CyberSight, Cisco Umbrella, HYAS Protect and Judy DNS Filtering, which is part of Judy's wider platform.

Three ways to deploy it

1. Point the network at the filter. Change the DNS forwarders on the client's firewall or DHCP server to the vendor's resolver. ThreatSTOP DNS Defense Cloud and threatER EnforceDNS both work this way with no agents. It covers every device on the office network and nothing that leaves the building.
2. Install a roaming agent. A small client on each laptop sends DNS to the filter wherever the device is. DNSFilter calls it the Roaming Client. N-able lists a roaming client for Windows, macOS, Android and iOS. ScoutDNS lists desktop OS agents. Zorus describes its product as device-based filtering. For hybrid workforces this is the version that matters, and you deploy it through your RMM like any other agent.
3. Filter at the client's own DNS server. For clients that run their own DNS, ThreatSTOP DNS Defense works with BIND, Windows DNS and Infoblox, and Heimdal's DNS Security Network filters on local DNS servers.

The first two combine well: forwarders at the office, agents on laptops, one policy across both.

The landscape in numbers

• Mostly small vendors. 15 of the 27 products come from vendors with 50 people or fewer, 6 from mid-sized vendors, 3 from vendors with more than a thousand staff, and 3 have no headcount on file.
• Infoblox brings the MCP servers. BloxOne Threat Defense and Infoblox Network Security have verified MCP servers, as does N-able DNS Filtering. The products with a public API are DNSFilter, N-able DNS Filtering, HYAS Protect, Zorus, both ThreatSTOP products and EnforceDNS.
• No verified PSA integrations. None of the 27 has a verified ConnectWise, Autotask or Halo integration in the catalog. CloudRadial DNS runs ScoutDNS inside CloudRadial's client portal; its page says MSPs on ConnectWise, Autotask, Syncro, HaloPSA and BMS use CloudRadial, but it lists no PSA integration for the DNS product itself. Otherwise, blocked-threat alerts reach your service desk through email rules, your RMM or a SIEM.
• DNS hosting is a different shelf. Domain registration, DNS hosting, dynamic DNS and DDI tools such as BloxOne DDI are listed under Domains & DNS, not here.

What separates products

1. The multi-tenant console. ScoutDNS lists multi-tenant management. Check how a new client is added, whether policies can be templated across clients, and whether a technician can be limited to some clients.
2. Roaming coverage. Which operating systems the agent supports, how it is deployed through your RMM, and what happens when a user is on a network that blocks outbound DNS.
3. Reporting for the client. N-able lists on-demand reports on blocked threats, user activity and blocked categories that you can schedule for client reviews. This report is what the client sees each quarter, so look at a real one.
4. Encrypted DNS handling. Whether the agent forces DNS through the filter when a browser tries DNS over HTTPS, or whether it can filter DoH itself.
5. Content categories and policies. Some clients only want threats blocked. Schools and others need content categories, schedules and per-group rules. ScoutDNS lists more than 67 content categories for its content filtering.
6. Pricing unit. Per user, per device or per site changes the economics for clients with shared devices or guest Wi-Fi. Ask before you quote.

Questions to ask in the demo

• Show me adding a new client, applying my standard policy and deploying the agent through my RMM.
• What does a user see on a blocked page, and can I brand it?
• How do you handle a browser using its own DNS over HTTPS resolver?
• Show me the report I would send a client each quarter.
• Can I get blocked-threat alerts per client into my PSA or SIEM, through an API or otherwise?
• How do you price: per user, per device, per site, or per query volume?

How to use the catalog for this

The category page lists all 27 products with their flags. Each product page links the evidence behind its API and MCP flags, and the vendor page shows what else that vendor sells. Related shelves are SASE / SSE, for platforms that bundle DNS filtering with secure access, and Firewall & Network Security. If a DNS filter you use is missing, paste its URL and the system will classify and add it.

Frequently asked questions

What is DNS filtering?

A DNS filter is a resolver that refuses to answer lookups for malicious domains or blocked content categories. The device never gets an address for the site, so the connection never starts. It stops phishing links, malware callbacks and unwanted content before any traffic flows.

Is Quad9 enough for a business?

Quad9 is free, blocks malicious domains and keeps no personal data, so it is a sound baseline. It has no accounts, so you get no per-client policies, no reports and no dashboard. Those are the reasons to use a paid filter for managed clients.

How does DNS filtering protect remote workers?

Through a roaming agent on the device that sends DNS to the filter on any network. DNSFilter, N-able, ScoutDNS and Zorus all list a device agent. Network-level filtering only protects devices on the office network.

Do DNS filtering products integrate with PSAs?

None of the 27 products in the catalog lists a verified ConnectWise, Autotask or Halo PSA integration in October 2026. Seven expose a public API, which is the usual route for getting alerts into your own tools.

Which DNS filters have an MCP server?

Three, verified against documentation: N-able DNS Filtering and two Infoblox products, BloxOne Threat Defense and Network Security.

---

Numbers are from the MSP Navigator catalog on 19 October 2026: 27 published products in DNS Security. Product details come from each vendor's own website, checked on 19 October 2026. Capability flags are verified against vendor documentation and linked on each product page. The use-or-resell verdict is produced by a classifier reading each product's description and reviewed by hand in samples. Related guides: SASE vendors for MSPs, Dark web monitoring for MSPs, Email security for MSPs.