In short
Cisco Umbrella and DNSFilter both block phishing, malware and unwanted content at the DNS layer, on and off site with roaming clients. Umbrella uses Cisco Talos intelligence and can grow into a proxy and full cloud security service through Cisco Secure Access. DNSFilter focuses on DNS, with its own AI categorisation. Umbrella reaches end of sale on 31 January 2027.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The short answer
Both services do the same core job: they replace your ordinary DNS resolver with a protective one, check every lookup against threat intelligence and your content policy, and block harmful or unwanted domains before a connection starts. Both have roaming clients for devices off site, identity integration, reporting and programmes for schools and managed service providers.
The real differences are elsewhere:
- Where you are heading. Cisco's DNS layer sits inside a wider platform. If you may later want a secure web gateway, cloud firewall, data loss prevention or zero trust access from one vendor, Cisco Secure Access offers that path. DNSFilter is built around DNS.
- Lifecycle. Cisco is ending sales of Umbrella on 31 January 2027 and names Secure Access DNS Defense as the successor. A Cisco DNS decision today is really a DNS Defense decision. DNSFilter has refreshed its platform as LUMINATE by DNSFilter while keeping its Core, Plus and Enterprise plans.
- How it decides. Umbrella's verdicts draw on Cisco Talos, Cisco's threat intelligence group. DNSFilter classifies domains with its own machine learning in real time.
- Proxy or DNS only. Umbrella DNS Security Advantage adds an intelligent proxy that inspects full URLs and files on risky domains. DNSFilter's plans make decisions at the domain level.
If you are not sure DNS-layer protection is the right category at all, start with DNS security solutions or our guide to protective DNS.
Side-by-side comparison
This table compares the current published plans and features of each service, from Cisco's and DNSFilter's own material, as at November 2026. Exact contents change, so we confirm them when we quote.
| Feature | Cisco Umbrella (and DNS Defense) | DNSFilter |
|---|---|---|
| Type of service | Cloud protective DNS with Cisco's recursive resolvers | Cloud protective DNS with its own anycast resolver network |
| Threat intelligence | Cisco Talos, plus Cisco's own DNS data | DNSFilter's machine-learning domain categorisation |
| Current plans | Umbrella DNS Security Essentials and Advantage (until 31 January 2027); Secure Access DNS Defense Essentials and Advantage | Core, Plus (which replaced Pro) and Enterprise |
| Content filtering | More than 100 content categories, with Low, Moderate and High presets | AI-categorised content categories, plus AppAware for blocking risky apps |
| Office networks | Network forwarding and virtual appliances | Network deployment and a relay application |
| Roaming clients | Roaming Security Module in Cisco Secure Client | Roaming clients for Windows, macOS, iOS, Android and Chrome |
| Chromebooks | Cisco Security for Chromebook, over DNS over HTTPS | Chrome roaming client |
| Identity | Active Directory via virtual appliances and the AD Connector; Microsoft Entra ID and Okta | Microsoft Entra ID or Active Directory |
| Encrypted DNS | DNS over HTTPS endpoint; Chromebook client uses DoH | DNS encryption including DNS over TLS |
| URL-level inspection | Intelligent proxy on risky domains in Advantage; full gateway in SIG | Domain-level decisions |
| Tunnelling and DGA detection | DNS tunnelling protection in every package; DNS Defense adds AI-based tunnelling enhancements and DGA detection, per Cisco | Not listed as a separate feature on DNSFilter's plan table |
| Logs to a SIEM | Log export to a Cisco-managed or your own Amazon S3 bucket, included in the DNS packages | Data Export add-on to a SIEM such as Splunk or Microsoft Sentinel |
| Investigation tools | Umbrella Investigate in DNS Security Advantage | CyberSight user behaviour analytics in Plus |
| Schools | Education packages; DNS Defense EDU Essentials | Education pricing programme, including iOS and Android roaming clients |
| Managed service providers | Multi-org and MSP consoles | MSP programme with multi-tenancy and branding |
| Lifecycle | Umbrella end of sale 31 January 2027; support to 31 January 2029 | Current; DNSFilter now presents its platform as LUMINATE by DNSFilter |
| Price | Ask us for a quote | Ask us for a quote |
For more on each product, see our Cisco Umbrella specialist site and the DNSFilter page on our cloud security site. Licensing detail for DNSFilter, including how network and roaming licences are counted, is on DNSFilter plans.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Threat protection at the DNS layer
At the DNS layer both services block the same broad classes of threat: phishing and fraud domains, malware hosting, command-and-control callbacks and newly seen domains. The difference is in where the verdicts come from.
Cisco feeds its resolvers with intelligence from Cisco Talos and the DNS traffic Cisco's resolvers handle. Security categories such as malware, phishing, command and control and cryptomining sit alongside content categories, and domains can be disputed through Umbrella or Talos. Cisco lists DNS tunnelling protection in its Umbrella DNS packages, and on Secure Access DNS Defense it adds AI-based DNS tunnelling enhancements and detection of domain generation algorithm (DGA) domains, two techniques malware uses to hide data theft and command traffic inside DNS.
DNSFilter classifies domains with its own machine learning as they are queried, so new and obscure domains can be categorised rather than left unknown. It lists DNSSEC validation, so answers can be checked for tampering (see DNSSEC), and DNS PreCheck, which filters locally at the device level.
Neither service can see a connection that skips DNS, such as malware going straight to an IP address. That limit is common to all DNS-layer security.
Off-site devices, Chromebooks and encrypted DNS
Network-level filtering stops at the office door, so roaming clients matter for any organisation with laptops, phones or school devices that go home.
- Cisco protects Windows and macOS laptops with the Roaming Security Module in Cisco Secure Client, and Chromebooks with Cisco Security for Chromebook, which sends the whole device's DNS to Cisco over DNS over HTTPS. For DNS Defense, Cisco lists Secure Client on Windows, macOS, iOS and Android.
- DNSFilter lists roaming clients for Windows, macOS, iOS, Android and Chrome. On the standard plans, roaming clients on every platform are part of Plus and Enterprise; Core is aimed at networks you control. DNSFilter's education programme includes iOS and Android roaming clients.
Both need a plan for encrypted DNS. A browser using its own DNS over HTTPS provider will skip either service unless you manage it. Our pages on DNS roaming clients and blocking DNS over HTTPS cover how to close that gap with group policy or device management.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
Schools and colleges
Both services suit schools and colleges, because they cover every device on the school network and can follow Chromebooks and laptops home with roaming clients.
Cisco sells education versions of its DNS packages, and names Secure Access DNS EDU Essentials as the successor to Umbrella DNS Security for Education. Umbrella can enforce SafeSearch through DNS for Google, YouTube and Bing. DNSFilter runs a separate education pricing programme for qualifying institutions.
Neither is a complete answer to KCSIE on its own: DNS filtering does not see search terms or individual pages and does not monitor activity, and it is for each school to satisfy itself that its filtering meets DfE and UK Safer Internet Centre expectations. Our hub on web filtering for schools explains what DNS filtering covers and what it does not, and how to test your school web filter.
Which should you choose?
- You already run Cisco, Meraki or Secure Client: Cisco usually fits more neatly, and DNS Defense keeps the same deployment approach.
- You may want a full cloud security service later: Cisco Secure Access gives a single path from DNS Defense to Secure Internet Access and zero trust access.
- You want risky domains inspected, not just allowed or blocked: Cisco's Advantage packages add the selective proxy.
- You want DNS-focused protection with roaming clients on every platform and per-user analytics: DNSFilter Plus is a strong fit.
- You are an Umbrella customer reviewing options before end of sale: compare a move to DNS Defense with a move to DNSFilter on features you actually use, not on headline lists.
The right answer depends on your devices, identity platform, reporting needs and what else you run. See DNS Defense vs Umbrella for the Cisco side of that decision.
How we help you decide
Because Forever Systems supplies both Cisco and DNSFilter, we can compare them on your estate rather than in the abstract. We can look at your current resolver set-up, device mix, Chromebooks, identity platform and reporting needs, suggest a short pilot of either service, and help you move policies across if you switch.
For pricing on either service, ask us for a quote. Contact us for an impartial recommendation.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
Is DNSFilter better than Cisco Umbrella?
Neither is better in every case. Both block threats and unwanted content at the DNS layer with roaming clients. Cisco offers Talos intelligence, a selective proxy and a path to a full cloud security service; DNSFilter focuses on DNS with its own AI categorisation. Umbrella reaches end of sale on 31 January 2027.
Which is better for a school, Umbrella or DNSFilter?
It depends on your devices and how you manage them. Cisco has education packages and a Chromebook client, with DNS Defense EDU Essentials as the successor. DNSFilter has an education pricing programme with iOS and Android roaming clients. Neither is a full KCSIE filtering and monitoring solution on its own.
Do both have roaming clients?
Yes. Cisco uses the Roaming Security Module in Cisco Secure Client and Cisco Security for Chromebook. DNSFilter lists roaming clients for Windows, macOS, iOS, Android and Chrome, included across platforms on its Plus and Enterprise plans.
How do their plans compare?
Umbrella's DNS plans are DNS Security Essentials and Advantage, succeeded by Secure Access DNS Defense Essentials and Advantage. DNSFilter's plans are Core, Plus (which replaced Pro) and Enterprise. For pricing on either, ask us for a quote.
Can I move from Umbrella to DNSFilter?
Yes. Both work by redirecting DNS, so moving means re-creating your policies and allow and block lists, repointing networks and replacing roaming clients. We can audit your Umbrella set-up first so nothing is missed.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.
More DNS security guides
Cisco DNS-layer securityEvery Umbrella and Secure Access DNS Defense package, seen from the DNS layer.DNS Defense vs UmbrellaWhat changes, and what stays the same, when Umbrella DNS becomes DNS Defense.DNS security solutionsEvery DNS-layer security option we supply, compared: standalone DNS, endpoint add-ons, firewall services, SASE, browser and mobile.DNS roaming clientsHow roaming clients keep laptops and mobiles under DNS protection at home and on public Wi-Fi, and the options we supply.Web filtering for schoolsWhy UK schools filter, what DNS filtering covers and misses, and the options for schools, colleges and trusts.