In short
ThreatDown DNS Filtering is the DNS filtering module from ThreatDown, the business brand of Malwarebytes. It blocks malicious websites and categories you choose, such as gambling or adult content, at the DNS lookup. It is an optional add-on available with all ThreatDown bundles, runs through the ThreatDown agent and is managed in Nebula or OneView.
Get a quote for ThreatDown DNS Filtering
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What ThreatDown DNS Filtering is
ThreatDown is the name Malwarebytes uses for its business security products, so you will also see this module called Malwarebytes DNS Filtering on older quotes. It is one of several modules that run on the single ThreatDown agent, alongside endpoint protection, EDR, vulnerability and patch management and others.
DNS filtering checks each lookup a device makes against threat intelligence and category lists and refuses to resolve the ones you do not want, so the connection does not start. ThreatDown positions it in three ways:
- Enhance security: stop staff reaching malicious websites that could lead to a phishing or ransomware attack
- Enforce policies: block prohibited sites such as adult content, gambling and piracy, and restrict non-productive ones such as gaming, social media and video streaming
- Support compliance: limit access to categories of website where your obligations call for it
Because it works on the lookup, it covers every application on the device rather than one browser. It complements the agent's other protection: DNS filtering stops the visit, and endpoint protection deals with anything that arrives another way. For the general idea, see what DNS security is.
Nebula, OneView and how it is bought
ThreatDown has two consoles, and DNS Filtering is managed in whichever you use:
| Console | Who it is for | DNS Filtering |
|---|---|---|
| Nebula | Organisations managing their own security in a single-tenant console | Managed as a module alongside endpoint protection and EDR |
| OneView | IT providers managing many customers from a multi-tenant console | Managed per customer site; this is how we supply ThreatDown |
On ThreatDown's own pricing, DNS Filtering is an optional add-on available with all ThreatDown bundles: Core, Advanced, Elite and Ultimate. ThreatDown's requirements say that outside a bundle you need an active Incident Response, Endpoint Protection or EDR subscription as well as the DNS Filtering module, so it is designed for devices already running ThreatDown endpoint security.
In OneView, ThreatDown's requirements also accept an active Ultimate bundle subscription in place of the separate module. Forever Systems supplies ThreatDown through OneView, and DNS Filtering is added to the devices you choose; billing details are confirmed at quote. See ThreatDown DNS Filtering licensing on our licensing site for more.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Requirements and supported devices
ThreatDown publishes specific requirements for the DNS Filtering module, and they are worth knowing before you switch it on:
| Area | What ThreatDown's requirements say |
|---|---|
| Windows | Windows 11 and Windows 10 version 1607 or later; Windows 11 on ARM |
| macOS | macOS 11 Big Sur and the later versions ThreatDown lists; Macs need a system extension and a certificate allowed |
| Windows Server | Windows Server 2016, 2019, 2022 and 2025; not recommended on Internet Information Services (IIS) or other web servers, where it may block communications |
| Encrypted DNS | DNS over HTTPS or Secure DNS must be disabled in browsers and operating systems for DNS filtering to work properly |
| Protocol | Only UDP DNS traffic is supported |
| Allow and block lists | Fully or partially qualified domain names (such as mail.example.com or example.com), not single-label names |
The encrypted DNS point matters most. If a browser is left to send its lookups over HTTPS to a public resolver, the module cannot filter them, so DoH needs to be turned off centrally through Group Policy or your device management tool. That is in line with the NCSC's advice for protective DNS; see should you block DNS over HTTPS? and the browser setting explained on our secure DNS page.
On Macs, approve the system extension and certificate in advance through your MDM so users are not prompted. ThreatDown updates this list from time to time, so we check the current version with you when we scope.
Who it suits
ThreatDown DNS Filtering is a good fit when:
- you already run ThreatDown (or Malwarebytes) endpoint protection and want web protection without another vendor or console
- you have small offices without a firewall-based web filter
- staff browse from home networks and you want filtering applied by the agent on the device rather than by an office firewall
- you need a straightforward answer to questionnaires that ask whether you filter web access
If you need page-level filtering, TLS inspection or cloud app controls, DNS filtering on its own is not enough: read DNS filtering vs URL filtering and look at a secure web gateway. If you do not run ThreatDown endpoint security at all, compare standalone services on our DNS security solutions page.
Schools should note that DNS filtering may not meet every expectation in the Department for Education's filtering and monitoring standards on its own; see web filtering for schools.
Is ThreatDown DNS Filtering the right fit for you?
We will check it against your systems and requirements and recommend the right option.
DNS Filtering, browser phishing protection and EDR
ThreatDown customers sometimes ask why they need DNS Filtering when other ThreatDown features already deal with phishing and malware. The layers do different jobs:
| Layer | Where it acts | What it catches |
|---|---|---|
| DNS Filtering | At the DNS lookup, for every application on the device | Known malicious domains and content categories you choose, before any connection starts |
| Browser Phishing Protection (part of Core and above) | Inside the browser | Sites with malware and phishing as pages are opened |
| Endpoint protection and EDR | On the device's files, processes and behaviour | Malware that arrives by any route, and suspicious activity after it runs |
DNS Filtering adds two things the others do not: it applies to applications other than the browser, and it lets you enforce an acceptable use policy by category. Running all three gives you defence in depth from the same agent and console. For the threats DNS filtering is best at stopping, see DNS attacks, including DNS tunnelling and command-and-control traffic.
How we deploy it
- Scope: confirm which devices run the ThreatDown agent, which operating systems they use and which groups need different policies.
- Turn off unmanaged encrypted DNS: set browser and Windows DoH policies centrally, and pre-approve the macOS system extension and certificate.
- Agree the policy: threat categories blocked for everyone, content categories by group, and how staff ask for a wrongly blocked site to be allowed.
- Pilot: apply the policy to a small group, check business sites and apps, and keep it off internet-facing web servers.
- Roll out and review: extend to everyone and keep categories under review.
ThreatDown's wider endpoint range is covered on our Cloud Security site under ThreatDown. Contact us to add DNS Filtering to your ThreatDown devices or to compare it with other options, and ask us for a quote.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is ThreatDown DNS Filtering?
ThreatDown DNS Filtering is the DNS filtering module from ThreatDown, Malwarebytes' business brand. It blocks malicious websites and categories you choose at the DNS lookup, using the ThreatDown agent, and is managed in the Nebula or OneView console with your endpoint protection.
Is DNS Filtering included in ThreatDown bundles?
ThreatDown lists DNS Filtering as an optional add-on available with all of its bundles, Core, Advanced, Elite and Ultimate. Outside a bundle it needs an active Incident Response, Endpoint Protection or EDR subscription as well as the DNS Filtering module.
Is ThreatDown DNS Filtering managed from Nebula or OneView?
Both. Nebula is ThreatDown's single-tenant console for organisations managing their own security; OneView is the multi-tenant console IT providers use. Forever Systems supplies ThreatDown through OneView.
Does ThreatDown DNS Filtering work with DNS over HTTPS?
ThreatDown's requirements say DNS over HTTPS or Secure DNS must be disabled in browsers and operating systems for DNS filtering to work properly, and only UDP DNS traffic is supported. We set those policies centrally as part of deployment.
Is Malwarebytes DNS Filtering the same as ThreatDown DNS Filtering?
Yes. ThreatDown is the name Malwarebytes uses for its business products, so older quotes and invoices may say Malwarebytes DNS Filtering for the same module.
Still have a question about ThreatDown DNS Filtering?
Ask us and a member of our team will reply by email.
More DNS security guides
Webroot DNS ProtectionWebroot's cloud DNS filtering add-on: 80+ categories, DNS over HTTPS and IPv6 support, roaming and VPN users.
WatchGuard DNSWatchWatchGuard's Firebox DNS filtering service: how it works, which suites include it, testing and off-site options.