Webroot DNS Protection explained

What Webroot DNS Protection is

Webroot, part of OpenText, makes cloud-managed security for businesses built around a lightweight endpoint agent. Webroot DNS Protection is its DNS-layer filtering service: devices send their DNS lookups to Webroot's cloud resolvers, which check each domain against Webroot's web classification and reputation data and refuse to resolve it if it is malicious or against your policy.

Because the decision is made at the lookup, before any connection starts, it covers browsers, email links, desktop apps and background processes alike. That makes it a useful first layer against phishing sites, malware downloads and command-and-control traffic, sitting in front of the endpoint protection that deals with anything arriving another way. For how this layer works in general, see what DNS security is.

Webroot describes the service as fully cloud-based, with no hardware or software to install beyond the agent, and managed from the same Webroot console as your endpoint protection. You may see it listed under its older name, Webroot SecureAnywhere DNS Protection, on invoices and in reseller catalogues.

What it includes

What it does not do: like any DNS-only service, it decides whether a whole domain may be resolved. It does not inspect page content or files, and it does not see connections made straight to an IP address. Our guide to DNS filtering vs URL filtering explains when you need a proxy as well.

The DNS Protection agent and encrypted DNS

The Webroot DNS Protection agent is what keeps a laptop filtered once it leaves the office. It runs on devices already protected by Webroot endpoint protection and is enabled from the Webroot console, so there is no separate product to roll out.

Webroot highlights two design points. The agent supports IPv6, so lookups are not missed on networks that prefer IPv6. And it supports DNS over HTTPS, which matters because browsers and operating systems increasingly encrypt DNS. A DNS filter that only listens for traditional DNS on port 53 can be bypassed when a browser sends its lookups over HTTPS to a public resolver; Webroot says its agent's DoH support lets you protect users at the DNS layer on modern networks without giving up security, privacy, visibility or admin control. Our encrypted DNS hub and the page on blocking DNS over HTTPS explain the wider issue and the NCSC's advice.

For networks rather than devices, such as an office LAN or guest Wi-Fi, filtering is set up at network level by pointing the network's DNS at Webroot's service. We confirm the exact steps for each site when we scope.

Licensing: an add-on to Webroot Business Endpoint Protection

Webroot DNS Protection is licensed per device, and through us it is added to an account that has Webroot Business Endpoint Protection. That keeps deployment simple: the devices you already protect with the endpoint agent are the ones covered for DNS filtering.

Full licensing detail, including billing, is on our sister site: Webroot DNS Protection licensing. If you do not run Webroot endpoint protection and only want DNS filtering, a standalone service such as DNSFilter or Cisco Secure Access DNS Defense is usually a better fit; compare them on our DNS security solutions page.

Webroot also offers a free 30-day trial of DNS Protection on its website, and our page on free DNS protection compares free options with paid ones.

Who it suits

Webroot DNS Protection makes most sense when:

• you already run Webroot Business Endpoint Protection and want another layer against phishing and malicious sites without a new console
• you need to enforce an acceptable use policy, for example blocking adult content, gambling or streaming
• staff work from home, client sites or public Wi-Fi and you want the same policy off the office network
• you provide guest or public Wi-Fi and want it filtered at network level

Schools and colleges can use category filtering as part of their approach, but a DNS filter on its own may not meet every expectation in the Department for Education's filtering and monitoring standards. Our guide to web filtering for schools explains what DNS filtering covers well and what it leaves to other tools.

Webroot DNS Protection vs other DNS security options

Webroot DNS Protection is one of several DNS options we supply, and the right one depends mostly on what is already on your devices:

If you are already a Webroot customer, keeping DNS filtering in the same console is the main attraction. If you are reviewing endpoint protection anyway, or run a mix of security vendors, a standalone service keeps DNS policy independent of the endpoint product. Our DNS security solutions page compares every option side by side, and DNS roaming clients covers the off-site agents in more depth.

How we deploy it

1. Scope: count devices and sites, confirm they run Webroot Business Endpoint Protection, and note networks such as guest Wi-Fi that need network-level filtering.
2. Agree the policy: threat categories blocked for everyone, content categories by group, and a simple route for staff to ask for a wrongly blocked site to be allowed.
3. Handle encrypted DNS: decide how browsers' own DNS over HTTPS settings will be managed so lookups go where you expect.
4. Pilot: enable the agent on a small group, check that business sites and line-of-business apps still work, and review the reports.
5. Roll out and review: extend to everyone, then check reports so the policy keeps up with how people work.

Once it is running, test that your DNS protection works on and off site. Contact us to add DNS Protection to your Webroot account or to compare it with other options, and ask us for a quote.