In short
DNS security is a protective layer that checks every domain name a device looks up against threat intelligence and your policy, then refuses to resolve dangerous or unwanted destinations. It blocks known phishing, malware and command-and-control domains for every app, in the office and, with a roaming client, off site. Forever Systems supplies Cisco DNS-layer security and several alternatives.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What DNS security does
The Domain Name System (DNS) turns the names people and software use, such as example.co.uk, into the IP addresses computers actually connect to. Nearly everything starts with a lookup: a browser opening a page, an email client fetching a link preview, an app checking for updates, and malware contacting the server that controls it.
DNS security uses that first step as a checkpoint. Devices send their lookups to a protective resolver instead of an ordinary one. The resolver checks each domain against threat intelligence and the content categories in your policy. Safe lookups are answered as normal; risky ones are refused or sent to a block page, so the connection does not start. Our guide what is DNS security? explains the mechanics, and DNS-layer security shows where it sits alongside firewalls, proxies and endpoint protection.
Because it works on lookups rather than on the traffic itself, DNS security is usually quick to deploy, needs no new hardware and covers every application on a device that uses the protective resolver, not just the web browser. The UK's National Cyber Security Centre (NCSC) publishes guidance on choosing a protective DNS service for private sector organisations, and runs its own free Protective DNS service for eligible public sector bodies. If you just want to know whether you can get protection without paying, our guide to free DNS protection sets out the options and their limits.
Vendors we supply
What DNS security blocks
- Phishing sites: fake login pages and fraud domains, blocked when someone clicks a link in email, chat or a text message.
- Malware delivery: domains that host malicious downloads or exploit kits, stopped before the file arrives.
- Command and control: callbacks from an infected device to attacker infrastructure, including algorithmically generated (DGA) domains on services that detect them.
- Data leaving over DNS: suspicious DNS tunnelling and DNS exfiltration patterns, on services that analyse query behaviour.
- Brand-new domains: optional categories for newly registered or newly seen domains that have no reputation yet.
- Unwanted content: categories such as adult content, gambling or file sharing, set per group for acceptable use and safeguarding.
Protection follows the device. In the office, the network's DNS points at the protective resolver. On laptops, phones and Chromebooks, a lightweight agent does the same job at home, on hotel Wi-Fi or on mobile data; our guide to DNS roaming clients compares the options. For the wider threat picture, see DNS attacks.
Where to start
This site is organised around the questions we are asked most. Pick the row that matches what you need.
| Topic | What it covers | Start here |
|---|---|---|
| Protective DNS | What PDNS is, the NCSC's free public sector service and how to choose a commercial one | Protective DNS and NCSC PDNS |
| Cisco DNS-layer security | Umbrella's DNS packages and their successor, Secure Access DNS Defense | Cisco DNS-layer security |
| Other options we supply | DNSFilter, Webroot, ThreatDown, Sophos, WatchGuard, SASE, browser and mobile options | DNS security solutions |
| Threats | Tunnelling, exfiltration, hijacking, spoofing and malicious domains | DNS attacks and the malicious domain checker guide |
| Encrypted DNS | DNS over HTTPS and TLS, bypass risks, Encrypted Client Hello and DNSSEC | Encrypted DNS, DNS over HTTPS and DNSSEC |
| Off-site devices | Keeping laptops, phones and Chromebooks protected at home and on public Wi-Fi | DNS roaming clients |
| Schools and colleges | KCSIE, the DfE filtering standards and PDNS for Schools | Web filtering for schools |
| Getting it right | A practical checklist and how to prove it works | DNS security best practices and DNS security test |
Not sure which package fits? Ask us
Tell us what you need and we will help you choose the right package.
Cisco DNS-layer security: Umbrella and Secure Access DNS Defense
Cisco Umbrella grew out of OpenDNS, which Cisco bought in 2015, and uses threat intelligence from Cisco Talos. Its two DNS packages work at the DNS layer: DNS Security Essentials blocks threats and unwanted content categories when a domain is looked up, and DNS Security Advantage adds an intelligent proxy that inspects URLs and files on risky domains. The SIG packages go beyond the DNS layer with a full secure web gateway, cloud-delivered firewall and CASB.
Cisco has announced the end of sale and end of life of Umbrella SIG and DNS. The last day to order is 31 January 2027, the last day to renew or add to a subscription is 31 January 2028 and the last date of support is 31 January 2029. Cisco's Umbrella website now says Umbrella has evolved to Cisco Secure Access, and Cisco's notice names Secure Access DNS Defense packages (DNS Essentials, DNS Advantage and DNS EDU Essentials for education) as the migration products for the Umbrella DNS packages. Cisco says DNS Defense gives you all Umbrella DNS features and more, including AI-based DNS tunnelling and domain generation algorithm (DGA) detection.
Forever Systems is a Cisco Partner. Our Cisco DNS-layer security page maps every Umbrella variant to what it does at the DNS layer, DNS Defense vs Umbrella explains what changes, and Cisco Umbrella vs DNSFilter compares Cisco with a popular standalone alternative. Package, pricing and set-up detail lives on our specialist Cisco Umbrella site, including its end of life guide, and DNS Defense is covered on Cisco Secure.
Other DNS security options we supply
Cisco is not the only answer, and sometimes the right DNS protection is already sitting in a product you pay for. These are the options we supply, grouped by how they are delivered.
| Option | How it is delivered | Often a good fit for |
|---|---|---|
| DNSFilter | Standalone cloud DNS security with network, relay and roaming client deployment | Organisations and schools that want DNS-only protection with flexible deployment |
| Webroot DNS Protection | Add-on to Webroot Business Endpoint Protection | Existing Webroot endpoint customers |
| ThreatDown DNS Filtering | Optional add-on to ThreatDown bundles, using the same agent | ThreatDown (Malwarebytes) endpoint customers |
| Sophos DNS Protection | Part of the Sophos Firewall Xstream Protection bundle and of Sophos Workspace Protection | Sophos firewall or endpoint estates |
| WatchGuard DNSWatch | Firebox security service in the Total Security Suite, and in the Prime Security Suite on newer Firebox appliances | Sites protected by a WatchGuard Firebox |
| SASE platforms | DNS filtering inside Check Point SASE Internet Access, Todyl, NordLayer (Core and Premium) and Exium | Teams replacing a VPN who want DNS and web controls together |
| Browser and mobile | DefensX browser-based DNS protection; Secure DNS in Lookout Mobile Endpoint Security Advanced | Browser-centric work and mobile fleets |
Our DNS security solutions page compares all of them side by side. For licensing and quotes by product, see DNS filtering software on Software Licensing UK.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Public sector bodies and schools
If your organisation is eligible for the NCSC's Protective DNS service, start there. The NCSC says it is free and centrally funded, and that the Cabinet Office has mandated it for central government departments; its private sector guidance adds that a commercially procured service should not be considered a substitute where you qualify. We do not run or resell NCSC PDNS; our page on NCSC PDNS explains who it is for and how to sign up through MyNCSC.
In October 2024 the NCSC opened PDNS for Schools to all UK schools, including academies, multi-academy trusts and independent schools, usually by asking their DNS provider to register. It blocks domains known to be malicious, but it is a security service rather than a content filter, so schools still need filtering and monitoring that meets KCSIE and the DfE standards. Our hub on web filtering for schools explains where DNS filtering fits and how to test your school's web filter.
How Forever Systems helps
We are independent of any single DNS vendor, so we start with how DNS works in your organisation today rather than with a product.
- Review: we can check which resolvers answer your lookups, whether laptops and phones are protected off site, whether browsers use their own encrypted DNS, and what you already own that includes DNS protection.
- Recommend: the option that fits your estate, from a standalone service to DNS protection built into your firewall, endpoint or SASE platform.
- Deploy: point networks and internal DNS servers at the protective resolver, keep internal names resolving locally, and roll out roaming clients through Microsoft Intune or your device management tool.
- Tune: we can review the early blocked lookups with you and adjust categories and allow lists so people can work.
- Support: ongoing help and changes if you want them, with the scope confirmed at quote.
Comparing DNS security solutions or DNS protection services from several suppliers? Because we supply more than one, we can explain the trade-offs in plain words and point out where something you already own may cover part of the job. Pricing depends on the product, the number of users or devices and the term, so ask us for a quote.
Explore DNS security
Cisco DNS-layer securityEvery Umbrella and Secure Access DNS Defense package, seen from the DNS layer.DNS security solutionsEvery DNS-layer security option we supply, compared: standalone DNS, endpoint add-ons, firewall services, SASE, browser and mobile.DNS roaming clientsHow roaming clients keep laptops and mobiles under DNS protection at home and on public Wi-Fi, and the options we supply.DNS vs URL filteringDomain-level decisions vs full-URL decisions through a proxy, with Cisco's three layers as a worked example.Web filtering for schoolsWhy UK schools filter, what DNS filtering covers and misses, and the options for schools, colleges and trusts.How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is DNS security?
DNS security is the set of controls that stops the Domain Name System being used against you. Most often it means sending every lookup to a protective resolver that refuses to resolve phishing, malware and command-and-control domains. It also covers protecting your own domains from hijacking and tampering.
Is DNS filtering the same as DNS security?
They overlap. DNS filtering blocks domains by threat and content category. DNS security is the broader goal: it includes filtering, plus detecting DNS tunnelling and DGA domains, logging, controlling encrypted DNS so it cannot bypass your resolver, and securing your own domains with DNSSEC and registrar protection.
Do small businesses need DNS security?
It is one of the simplest protective layers a small business can add. It works for every device that uses your resolver, needs no hardware, and can stop links to known phishing and malware domains before they load. Some endpoint, firewall and SASE products already include DNS filtering, so check what you own first.
Is Cisco Umbrella being replaced?
Cisco has announced the end of sale and end of life of the Umbrella DNS and SIG packages: the last day to order is 31 January 2027, renewals and additions end on 31 January 2028 and support ends on 31 January 2029. Cisco names Secure Access DNS Defense as the migration path for Umbrella's DNS packages.
What is the difference between DNS filtering and web filtering?
DNS filtering decides whether a domain may be looked up, so it blocks whole domains for every app but cannot see individual pages or files. Web filtering through a proxy or secure web gateway sees full URLs and, with HTTPS inspection, content. Many organisations use DNS filtering as the first layer and add a web gateway where they need page-level control.
How much does DNS security cost?
It depends on the product, how it is licensed (per user, per device or by network) and the term. Ask us for a quote and we will compare the options that fit your organisation.
Still have a question about DNS security?
Ask us and a member of our team will reply by email.