DNS roaming clients: protecting laptops and mobiles off site

Why network DNS filtering is not enough

The simplest way to deploy DNS security is at the network: point the office router, firewall or internal DNS servers at a protective DNS service, and every device on that network is covered. It is quick, needs nothing on the devices and covers printers and guests too.

The catch is that it only works while a device uses that network. A laptop on home broadband uses the home router's DNS. A phone on mobile data uses the mobile network's resolver. On hotel or café Wi-Fi the device uses whatever the hotspot hands out. In each case the protective resolver does not see the lookup, so neither security blocking nor your acceptable use policy applies.

That gap matters because people are most exposed away from the office: unmanaged networks, more personal browsing, and no firewall in front of them. The NCSC's guidance on protective DNS for the private sector says the same thing, recommending a lightweight client so roaming and home devices resolve DNS through the protective resolvers.

How a roaming client works

A roaming client (also called a roaming agent, DNS agent or secure DNS client) runs on the device and takes charge of its DNS:

1. Intercepts lookups. The agent catches DNS queries from the operating system and applications, whichever network the device is on.
2. Sends them to the protective resolver. Queries go to your DNS security service, often over an encrypted connection, instead of the local network's resolver.
3. Identifies the device and user. The agent tags each query with the device and, where supported, the signed-in user, so the right policy applies and reports show who was affected.
4. Handles internal names. Lookups for your internal domains are passed to internal DNS servers when the device is on the corporate network or VPN, so internal apps keep working.
5. Backs off on protected networks. Some clients, such as Cisco's, can detect when they are already behind a protected network and let the network handle filtering, to avoid double processing.

The result is one policy model: the network protects devices in the office and the agent protects them everywhere else. You can confirm it is working with the checks in our DNS security test guide.

Roaming client options we supply

Cisco's original standalone Umbrella roaming client reached its last date of support on 2 April 2025; the current agent is the Umbrella module in Cisco Secure Client. If any devices still run the old client, they should be moved.

VPNs, encrypted DNS and other agents

Roaming clients have to coexist with everything else that wants to control a device's network traffic. The main interactions to plan for:

VPNs. A full-tunnel VPN sends lookups to the VPN's DNS servers, which may or may not be protected. Vendors handle this differently: Cisco says the Umbrella module does not need Cisco VPN, is highly compatible with third-party VPNs and can stand down while a Cisco full-tunnel VPN session is active; Webroot says DNS Protection protects roaming and VPN users without interfering with the VPN. Test your own VPN with the client before rolling out.

Encrypted DNS. If a browser sends its lookups over DNS over HTTPS to a public resolver, the roaming client may not see them. Some agents handle DoH themselves; others, such as ThreatDown's, need browser and operating system DoH turned off. Either way, set it centrally. See encrypted DNS and should you block DNS over HTTPS?

Other security agents. Two products both trying to intercept DNS on one device will conflict. If you are moving between DNS services, remove the old agent cleanly first and pilot the new one.

Deploying roaming clients with Intune or other MDM

At scale, roaming clients are pushed silently through your device management tool rather than installed by hand. The pattern is similar whatever the vendor:

1. Download the installer and your organisation's configuration from the vendor's console. Cisco, for example, provides Secure Client installers and an OrgInfo.json file that ties each device to your Umbrella organisation.
2. Package it as a Win32 app or macOS package in Microsoft Intune, a Group Policy software installation, or an RMM job.
3. Pre-approve permissions on Macs. macOS agents need system extension and network permissions; approve them through configuration profiles so users are not prompted.
4. Install root certificates where needed, for example if the service shows HTTPS block pages or uses a proxy.
5. Set browser DoH policies at the same time so encrypted DNS goes where you expect.
6. Pilot, then roll out. Check that devices appear in the console, that internal names resolve on and off VPN, and that business apps work.

Chromebooks do not run Windows or Mac agents. Cisco uses Cisco Security for Chromebook, deployed through the Google Admin console, and DNSFilter lists Chrome among its roaming client platforms. Schools with Chromebooks that go home should check this first; our web filtering for schools guide covers off-site filtering expectations.

What to check before you choose

When comparing roaming clients, these are the questions that tend to decide it:

• Platform coverage: does it support every operating system you manage, including macOS versions, mobiles and Chromebooks?
• Identity: can it report and apply policy per user (for example through Microsoft Entra ID or Active Directory), or only per device?
• Encrypted DNS: does the agent handle DNS over HTTPS itself, or must browser DoH be turned off?
• Internal domains and VPN: how does it resolve internal names, and how does it behave with your VPN?
• Tamper resistance: can users disable or uninstall it, and will you be told if they do?
• Licensing: is the client included with the DNS service, or a separate cost? Confirmed at quote.

The NCSC's checklist on our protective DNS page adds logging, allow lists and data handling to that list.

How we help

We can help you choose a roaming client that fits your DNS service, VPN and device management, then package and deploy it, set trusted network and internal domain settings, close encrypted DNS gaps and check the results on real home and public networks.

Contact us with your device counts and the tools you use today, and ask us for a quote.