I really appreciate DNSFilter for its ease of use and simple dashboards, which make navigation straightforward. The reporting features are great and provide valuable insights. I find the security policies extremely valuable, offering a range of categories like newly registered domains, P2P, self-harm, weapons, and phishing that help minimize business risk and boost productivity. The setup was very easy; it's as simple as deploying with a binary and secret key, and configuring policies is a breeze. It's a perfect solution that offers everything I need.

I use DNSFilter as a key layer of our cybersecurity program to protect against phishing, malware, and other DNS-based threats. It helps maintain uptime and security, enforces safe browsing, and monitors DNS activity across both on-site and remote users. I appreciate its reliability as a security layer, especially since it operates quietly in the background and requires low maintenance. The deployment process is straightforward, the dashboard is clean, and the threat-blocking accuracy is consistently strong. The combination of simplicity, strong protection, and low maintenance makes DNSFilter especially valuable. The initial setup was very easy, with an intuitive dashboard and well-guided onboarding steps, making it much easier than other tools we've used. This overall effectiveness and ease of use make DNSFilter a reliable part of our security stack.

DNSFilter was extremely quick, but is no longer the quickest option in Atlanta for Comcast users. Comcast’s BGP peering with NetActuate—who DNSFilter appears to be using after a change several months ago—now sends DNS queries to Miami instead of keeping them in Atlanta. I contacted support and they provided a workaround, but it doesn’t allow DNSSEC. Comcast users in the Atlanta area who are considering DNSFilter should be aware that this adds latency to DNS queries. In my case, it was faster than Cloudflare, NextDNS, Quad9, and Google according to GRC’s DNS Benchmark tests. After the BGP changes, it is now the slowest resolver. Comcast users should keep this in mind before switching to DNSFilter. Setup and configuration were easy, and the universal block/allow lists are great. I can upload domain names in CSV format. The reports are detailed and have a very nice layout; it’s clear a lot of design work went into DNSFilter. Overall, it feels much more polished than competitors. Last but not least, DNSFilter’s support staff is excellent. I’ve chatted with them via online chat a few times, and they’re also prompt when responding to emails. DNSFilter also maintains a feature list with updates showing where certain feature requests are in the development process. A previous limitation with DoH has been addressed: DNSFilter now supports DoH for routers. Their relay servers are awesome, and they allow client identification (LAN IP) even when using DoT. DoQ isn’t currently supported. Supposedly, IPv6 support with relay servers is in development, although IPv6 resolvers are already available for DNS. Additionally, profiles can be assigned separate DNS server addresses for plain-text lookups. DNSSEC is supported, but it seems to be actively discouraged. I’m not sure why they don’t encourage broader DNSSEC use. I realize it isn’t the most widely adopted technology, but other resolvers seem to support it by default.