DNS Filtering for Small Business: How It Works and Options

DNS filtering blocks dangerous websites by refusing to look them up. Every time a device visits a site, it first asks a DNS resolver to turn the name into an address. A filtering resolver checks the name against threat lists and, if it is a known phishing or malware domain, declines to answer, so the connection never starts. A small office can turn on basic protection for free in about 15 minutes by changing one setting on the router. Paid services add per-user policies, reporting, and protection for laptops that leave the building.

How Does DNS Filtering Work?

DNS (the Domain Name System) is the internet’s directory. When someone clicks a link, their computer asks a resolver, usually one run by your internet provider, for the numeric address behind the name. Only then does the browser connect.

A filtering resolver adds one step. Before answering, it checks the requested name against lists of known malicious domains and, on paid services, against content categories you choose. If the name is blocked, the device gets no usable answer or is sent to a block page.

This works for more than browsers. Malware that tries to reach its control server also has to look up a name first, so a blocked lookup can cut it off. CISA’s #StopRansomware Guide recommends Protective DNS, its term for this kind of service, noting that it blocks malicious internet activity at the source.

What DNS Filtering Cannot Do

It helps to know the edges before you rely on it.

• It sees names, not content. If a legitimate site is compromised, or an attacker hosts a file on a well-known cloud service, the domain looks fine and the lookup succeeds.
• It can be bypassed. A device that uses a different resolver, a VPN, or a browser with its own encrypted DNS setting (DNS over HTTPS) may skip your filter. Managed browsers and firewall rules can close most of these gaps.
• Phones on cellular data are not covered by a router setting, because that traffic never touches your network.
• New domains take time to classify. A phishing site registered an hour ago may not be on any list yet.

DNS filtering is one layer. It works alongside endpoint protection, a properly configured firewall, email filtering, and multi-factor authentication. It replaces none of them.

Free and Paid DNS Filtering Options

Offerings and prices change, so check each vendor’s page before deciding. This is the picture as of September 2026.

Service	Cost	What you get	Management
Quad9	Free	Malicious domain blocking at 9.9.9.9 and 149.112.112.112, run by a Swiss nonprofit	None. No dashboard, no custom lists, no reports
Cloudflare 1.1.1.1 for Families	Free	1.1.1.2 and 1.0.0.2 block malware. 1.1.1.3 and 1.0.0.3 block malware and adult content	None
Cloudflare Gateway (part of Cloudflare One)	Free plan available, paid plans per user	Custom block and allow policies, security and content categories, DNS logs, device agent	Web dashboard
DNSFilter	Core plan listed at $1.00 per license per month billed annually, with a $23 monthly minimum. Plus plan at $2.25	Category filtering, reporting, roaming agents (Windows and macOS on Core, all platforms on Plus)	Web dashboard
Cisco Umbrella	Quote through Cisco or a reseller	Cisco states that Umbrella DNS security has evolved into Cisco Secure Access, DNS Defense. Ask for current packaging	Web dashboard

Two notes on that table. First, Cloudflare lists the current limits of its free plan and its paid per-user pricing on its Zero Trust plans page, so confirm the numbers there. Second, if your office has Microsoft 365 Business Premium, Defender for Business includes web content filtering on managed devices. It works on the device and not at the DNS level, but it covers some of the same ground.

Free or paid: how to choose

A free resolver is a real improvement over the default and costs nothing. Its limits are that you cannot see what was blocked, cannot allow a site that is blocked by mistake, and cannot set different rules for different people.

Pay for a managed service when you need any of these: reports for a compliance or insurance file, content categories (for example, blocking adult sites on a front-desk computer), protection that follows laptops home, or an allow list so one false positive does not stop work.

Router or Per Device: Where Should You Set It Up?

	On the router or firewall	On each device (agent or OS setting)
Covers	Everything on the office network, including guest Wi-Fi, printers, and smart devices	Only devices you configure
Works away from the office	No	Yes
Per-user policies and reports	No, all traffic looks like one source	Yes, with a paid agent
Effort	One change	One install per device, or a push through device management

For most offices the answer is both: the router setting as a safety net for everything, and an agent on company laptops.

Setting it up on the router

1. Sign in to the router or firewall’s admin page. If the internet provider supplied the router, check that it lets you change DNS settings. Some provider gateways do not, in which case you need your own router behind it.
2. Find the DHCP or LAN settings, where the router tells devices which DNS servers to use. On some models the setting is under WAN or Internet.
3. Replace the existing DNS servers with the filtering resolver’s two addresses, for example 9.9.9.9 and 149.112.112.112. Do not mix a filtering resolver with a non-filtering one as the backup, because devices can end up using either one.
4. Save, then restart a computer or renew its network connection so it picks up the change.
5. Test. Check the service’s documentation for a test page or test domain that should be blocked, and confirm normal sites still load.
6. With a paid service, register your office’s public IP address as a location in the dashboard so your policies apply.

Plan for about 15 minutes, plus time to find the router password.

Setting it up per device

Paid services provide a small agent for Windows and macOS, and usually apps for iOS and Android. Cloudflare’s agent is named the Cloudflare One Client, and DNSFilter’s is the Roaming Client. Install on a few machines by hand, or push the agent to all of them with Intune or another device management tool.

You can also type resolver addresses into each device’s network settings without an agent. That works for a free resolver, but a user with admin rights can change it back.

Closing the bypass routes

• On a business firewall, block outbound DNS (port 53) to anything except your chosen resolver.
• Set browser policy so Chrome, Edge, and Firefox use the system resolver and not their own encrypted DNS provider.
• Put guest Wi-Fi on the filtered resolver too. Network segmentation keeps guests away from business systems either way.

Common Mistakes

• Turning it on and never looking at the logs. Repeated blocked lookups from one machine are an early sign that something on it needs attention.
• No process for false positives. Decide who can add a site to the allow list and how staff ask.
• Blocking too many categories on day one. Start with security categories, then add content categories after talking with staff.
• Forgetting remote workers. A router setting does nothing for a laptop at home.
• Entering only one resolver address. Use both addresses the service provides so a single outage does not take the office offline.

When You Do Not Need a Paid Service

An office of a few people, working mostly in cloud apps protected by multi-factor authentication, with no reporting requirement, can reasonably use a free filtering resolver on the router and stop there. The same is true if your endpoint security already includes web protection that someone reviews. Revisit the decision when staff start working remotely on company laptops or when an insurer or client asks for web filtering reports.

Common Questions

Will DNS filtering slow down our internet?

It should not. A DNS lookup takes milliseconds, and the large public resolvers run servers in many locations. Filtering does not touch the traffic that follows the lookup, so download and video speeds are unaffected. If browsing feels slower after the change, check that both resolver addresses were entered correctly.

Is DNS filtering the same as a firewall?

No. A firewall controls which connections are allowed in and out based on addresses, ports, and applications. DNS filtering decides whether a name gets resolved at all. Many business firewalls include a DNS or web filtering feature, often as a paid subscription, so check what yours already offers before buying a separate service.

Can employees get around it?

Sometimes. Using a personal hotspot, a VPN, or a browser’s built-in encrypted DNS can bypass a router-level filter. An agent on managed devices, browser policies, and a firewall rule that blocks other DNS servers close most of those routes. None of this applies to personal phones on cellular data.

Does DNS filtering help with compliance?

It can support it. Web filtering is one of the protective controls you can map to the NIST Cybersecurity Framework, and an insurer or client security questionnaire may ask about it. A paid service gives you logs and reports to show the control is in place. Check the exact wording of the requirement you are trying to meet.

How We Can Help

Coastal Growth Co. can check what your router or firewall supports, set up a free or paid filtering service, deploy agents to laptops, and agree on who reviews the logs and handles allow-list requests. It fits naturally into our network and security work or an ongoing managed IT arrangement. Licensing costs and scope are agreed before paid work starts. Contact us to talk it through.