Filter laptops and phones away from the office with a private encrypted DNS link
The office router filters everything that connects to it. The moment a laptop goes home, to a client or to a hotel, it uses someone else's DNS. This page explains how the managed DNS filter keeps the same rules on those devices, and how to set it up in a few minutes.
Working from home
The home router knows nothing about your policy.
Hotels and public Wi-Fi
Unknown networks, sometimes with DNS rewritten by the operator.
Client sites
Another organisation's network and rules, not yours.
Phone hotspots
Mobile data with the carrier's own DNS servers.
How the private encrypted link works
Every network in the dashboard has its own encrypted DNS link. A device that uses the link sends its lookups straight to the filter over an encrypted web connection, wherever it is.
One link per network
The link belongs to a network, so a device using it gets that network's profile: categories, lists and schedules.
Encrypted on the way
Lookups travel inside an encrypted connection, so a hotel or provider cannot read or rewrite them.
Same activity log
Lookups through the link appear in that network's activity and reports, next to the office traffic.
The office rules on every connection the laptop joins
Copy the network's encrypted link from the dashboard into the device, and the managed filter answers its lookups from home, a hotel or a phone hotspot. Nothing else is installed, and the rules stay the ones you set for that network.
- Chrome, Edge and Firefox take the link in their secure DNS setting.
- Macs, iPhones and iPads install a profile from the dashboard.
- Managed browsers can be locked to the link by policy.
Setting it up on each kind of device
Copy the link from the network's page in the dashboard first. It looks like a web address, but it is not a page to open: opening it in a browser just shows an explanation.
Chrome
This browser- Open Settings, then Privacy and security, then Security.
- Turn on "Use secure DNS" and choose a custom provider.
- Paste the link and close Settings.
Microsoft Edge
This browser- Open Settings, then Privacy, search and services, then Security.
- Turn on "Use secure DNS" and choose a service provider.
- Enter the link as a custom provider.
Firefox
This browser- Open Settings, then Privacy and Security, and find DNS over HTTPS.
- Choose the strictest protection level and a custom provider.
- Paste the link.
Mac, iPhone and iPad
Whole device- Download the profile from the network's page in the dashboard.
- On a Mac open System Settings, then the downloaded profile, and click Install.
- On an iPhone or iPad open Settings, tap Profile Downloaded and tap Install.
The same secure DNS setting exists in Chrome on Android, so phones can use the link in the browser. On a Mac, iPhone or iPad the profile covers every app, not only the browser.
Locking the link on managed devices
If you manage browsers with Group Policy, Intune or Google Admin, set the link by policy so users cannot change it. These are the browser policies to use:
| Browser | Policy | Value |
|---|---|---|
| Chrome | DnsOverHttpsMode and DnsOverHttpsTemplates | Mode set to secure, template set to the network's link |
| Microsoft Edge | DnsOverHttpsMode and DnsOverHttpsTemplates | Same as Chrome; the template must be set when the mode is secure |
| Firefox | DNSOverHTTPS | Enabled, provider address set to the link, locked |
On office networks, the dashboard's bypass guidance sets these browsers to use the network's DNS instead. Laptops that travel need the link policy above; desktops that never leave can keep the office setting.
Five sites a travelling laptop often reaches, and how the rules treat them
Real rows from our data. With the encrypted link in place, each one gets the same decision at home as it does at the office.
| Site | Categories in our data | Under a typical office profile |
|---|---|---|
| expressvpn.com | VPN / Proxy / Anonymizers | Blocked by the VPN / Proxy switch |
| surfshark.com | VPN / Proxy / Anonymizers | Blocked by the VPN / Proxy switch |
| roblox.com | Gaming | Blocked where Gaming is switched off |
| perplexity.ai | AI / LLM Tools | Follows your AI tools decision |
| mega.nz | Cloud Storage / File Hosting | Open: file storage is not a blocking switch; add it to always-block if needed |
Office rules, or a separate travel profile
Because each link belongs to a network, you decide which rules a device takes with it. Three common setups:
Same as the office
Use the office network's link. Simplest, and staff see one set of rules everywhere.
A travel profile
Create a network with no addresses, only a link, and give it its own profile, for example lighter rules for evenings at home.
Per team
A separate link-only network for the finance team or for contractors, each with the rules that suit them.
See profiles and networks for how networks and profiles fit together, and time schedules for rules that change by the hour.
What the link does not do
Knowing the limits avoids surprises. None of these is unusual for DNS filtering; they are worth saying plainly to whoever approves the rollout.
A browser setting covers that browser
Other apps on a Windows laptop use the connection's normal DNS. Set the link in every browser people use, or use the device profile where available.
It decides by domain
Like all DNS filtering it allows or blocks whole sites, not single pages inside a site.
A full VPN can route around it
A device-wide VPN sends lookups through its own servers. Blocking VPN sites stops new installs; managed devices should not allow personal VPN apps.
The link is a credential
Anyone who has it gets that network's rules, and their lookups land in its activity. Share it only with devices you manage.
How the encrypted link copes with hotels and providers that intercept lookups
Some public networks and internet providers intercept plain DNS and answer it themselves, which silently disables a normal filter setting. Lookups through the encrypted link travel inside an ordinary encrypted web connection, so they reach the managed filter on those networks too.
Rolling it out to remote staff
A short plan that avoids the classic Monday-morning flood of questions.
| Step | What to do | Why |
|---|---|---|
| 1. Decide the profile | Office link or a separate travel network | Staff should know which rules apply at home |
| 2. Test on one laptop | Set the link, work from home for a day, read the activity | Catches apps that need allow-list entries before everyone has them |
| 3. Update the policy | Add one line: devices are filtered off site too | Staff are told before it happens, not after |
| 4. Push by policy | Browser policies or the Apple profile through your device management | Nobody has to follow manual steps |
| 5. Check the reports | After a week, compare off-site lookups with office ones | Shows which devices are covered and which are not |
When the link does not seem to work
Almost every problem with an encrypted link falls into one of these five cases.
| What you see | Likely cause | What to do |
|---|---|---|
| Sites open that should be blocked | The person uses a second browser without the link | Set the link in every browser, or push it by policy |
| The browser says the secure DNS provider is unavailable | A typing mistake in the link, or a network that blocks encrypted DNS | Paste the link again from the dashboard; test on a phone hotspot |
| The Mac profile does not appear after download | macOS waits for the user to approve it in System Settings | Open System Settings and look for the downloaded profile at the top of the sidebar |
| No lookups from the device in the activity | A personal VPN is running, or the link belongs to another network | Switch the VPN off and check which network's link was used |
| Different results at home and in the office | The laptop uses a travel profile with lighter rules | Compare the two profiles in the dashboard; that is usually intended |
Devices away from the office: without the link, and with it
What happens to the same laptop on the same evening at home.
| Question | Office router filter only | Managed filter with the encrypted link |
|---|---|---|
| Which rules apply at home? | None; the home router decides | The rules of the network the link belongs to |
| Hotel network rewrites DNS | Not applicable; no filter in place | Lookups still reach the filter, encrypted |
| Software to install | Usually an agent on every device | None; a browser setting or a device profile |
| Seeing what happened | No record off site | Lookups in the same activity and reports |
| Different rules for travel | Not possible | A link-only network with its own profile |
Filtering devices away from the office: frequently asked questions
How do I filter a laptop when it is not on the office network?
Give it the network's private encrypted DNS link. In Chrome, Edge or Firefox the link goes into the secure DNS setting; on a Mac, iPhone or iPad you install a profile from the dashboard. Lookups then reach the filter from any connection.
Does the encrypted link filter the whole device?
On a Mac, iPhone or iPad with the profile installed, yes: the system sends its lookups through the link. Set in a browser, it filters that browser; other apps on the device use the connection's normal DNS.
Which rules apply away from the office?
The rules of the network the link belongs to. You can use the office network's link, or create a separate network with its own profile for travelling devices.
Does it work in hotels and on public Wi-Fi?
Yes. The link sends lookups over an encrypted web connection, so it works on ordinary internet connections, including networks where the provider intercepts or redirects plain DNS.
Can I enforce the link on managed browsers?
Yes. Chrome and Edge accept the policies DnsOverHttpsMode set to secure and DnsOverHttpsTemplates set to the link; Firefox has a DNSOverHTTPS policy with a provider address that can be locked.
Can I see which devices use the link?
Lookups through the link appear in the activity of the network it belongs to, with their times. A device that stops appearing there has usually lost the setting or is running a VPN.
Is the link secret?
Treat it like a password. Anyone who has it gets that network's rules, and their lookups appear in that network's activity, so share it only with devices you manage.
The encrypted link comes with the managed DNS filter, which starts at $99 a month for one site, with several sites quoted together. Pilot it with a few remote laptops first and read their lookups in the activity log.
Keep the rules on every device that leaves
Tell us how many staff work away from the office and which devices they use. We will set up a pilot with an encrypted link ready to paste.
Chrome, Android and Google Admin are trademarks of Google LLC. Microsoft Edge and Intune are trademarks of Microsoft Corporation. Firefox is a trademark of the Mozilla Foundation. Mac, iPhone and iPad are trademarks of Apple Inc. They are named here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by these companies.