What happens if a DNS filter goes down? Main and backup servers explained
Every IT lead considering a hosted filter asks the same thing before saying yes: if your server fails, does our internet stop, or does the filter quietly disappear? This page answers that for the managed DNS filter, and shows the router settings that make the answer work.
The short answer
- If the main server fails
- Devices switch to the backup filter, which has the same rules. Filtering continues.
- If both fail
- Lookups fail and devices show "no internet". The network stays filtered rather than open, and our team is alerted.
- What you set
- Main filter as primary DNS, backup filter as secondary, and nothing else.
Two servers, one set of rules
The managed DNS filter runs on a main and a backup server. Your router knows both, and both answer with your rules.
Your router
Hands out both filter addresses to every device on the network.
Main filter
Answers lookups in normal operation, with your policies.
Backup filter
Takes over automatically when the main server does not answer.
A backup filter with your rules, already on your router
Every plan of the managed DNS filter comes with a main and a backup server. Set the main as your router's primary DNS and the backup as its secondary, and a failure of one server leaves filtering in place on the other.
- Your changes reach the backup within a minute.
- Both servers are checked every minute, around the clock.
- Our team is alerted as soon as a check fails.
Router settings that make failover work
Failover is decided by the devices, using the DNS servers the router gives them. Four settings get it right.
Primary: the main filter
Enter the main filter address as the first DNS server in the router's DHCP settings.
Secondary: the backup filter
Enter the backup filter as the second DNS server. The dashboard shows both addresses.
No third server
Leave any further DNS fields empty. A public server here becomes a way around the filter.
Allow both on the firewall
If you restrict outgoing DNS, allow port 53 to both filter addresses and nothing else.
After changing the router, reconnect a test device and check its DNS servers with ipconfig /all on Windows or scutil --dns on a Mac. Both filter addresses, and only those, should appear.
Why the second DNS server must filter too
Many people believe a secondary DNS server is used only when the first one fails. In practice many devices spread lookups across all the servers they were given, or switch for reasons as small as one slow answer.
| Secondary DNS set to | In normal operation | When the main filter fails |
|---|---|---|
| The backup filter | Every lookup is filtered, whichever server a device asks | Filtering continues on the backup |
| A public DNS service | Some lookups skip the filter every day, without anyone noticing | The network is unfiltered until someone notices |
| The provider's DNS | Same as a public service, plus the provider's own redirects | Unfiltered |
| Left empty | Every lookup is filtered | Lookups fail until the main server returns |
This is the most common cause of a filter that "mostly works". If yours does, look at the second and third DNS fields of the router first.
Four domains devices ask for to decide whether the internet works
Phones and laptops look up these names to test their connection. Real rows from our data: none of them carries a category that is a blocking switch, so a "no internet" warning never comes from your filter's rules.
| Domain | Categories in our data | Who checks it |
|---|---|---|
| msftconnecttest.com | CDN / Hosting / Infrastructure | Windows connection test |
| gstatic.com | Computers & Technology | Android and Chrome connection checks |
| apple.com | Computers & Technology, Shopping | Apple devices' captive portal check |
| gnome.org | Freeware/Software | Linux desktops' network check |
Fail closed or fail open: decide before it happens
If both filter servers were ever unreachable, a network can either stop resolving names or fall back to an unfiltered server. Make the choice deliberately and write it in your policy.
Fail closed (recommended)
Only the two filter addresses are configured. If both are unreachable, lookups fail until one returns.
- The network is never unfiltered
- Right for schools, libraries and children's networks
- Right wherever a policy promises filtering
Fail open
A public resolver is kept as a manual fallback, switched on by a person only during a confirmed outage.
- Keeps a business online at any cost
- Must be a manual step, never a third DNS field
- Record when it was switched on and off
What we watch, so you do not have to
Uptime is mostly about noticing problems early. These checks run day and night, without anyone having to ask for them.
Health checks every minute
Each server is tested with a blocked and an allowed lookup every minute, and each one checks the other.
Alerts to our team
An alert goes out when a server stops answering, slows down, nears its capacity, or runs low on disk or memory.
Rules copied every minute
Your policies, lists, profiles and schedules are copied from the main server to the backup every minute.
One thing we never do on your behalf: point your network at an unfiltered server during an incident. Your router only knows the two filter addresses, so the network stays filtered unless you decide otherwise.
How the managed filter keeps the backup current
When you add an always-allow entry or switch a category, the main server applies it in seconds and the backup receives it within a minute. Category data updates are delivered to both servers, so a failover never brings back yesterday's rules.
If something looks wrong: a short runbook
Three checks tell you in two minutes whether the filter, the router or the internet connection is the problem.
Open any website on a phone using mobile data. If that fails too, the problem is wider than your network.
Ask each filter server directly: nslookup example.com followed by the main address, then the backup address. A normal answer from either one means filtering is available.
Look at the router's internet status. A dropped connection to the provider looks exactly like a DNS failure on every device.
Contact us with the time and the results of the three checks. Do not add a public DNS server to the router as a quick fix; it tends to stay there for months.
What a failover looks like from a device
Nothing dramatic happens on the screen. The sequence below is typical; exact waits differ between operating systems.
| Moment | What the device does | What people notice |
|---|---|---|
| The main server stops answering | A lookup to the main address gets no reply | Nothing yet; recently visited sites still load from cache |
| A few seconds later | The device repeats the lookup on the secondary address, the backup filter | A short pause before the next new site opens |
| While the main is down | The device keeps using the backup, which answers with the same rules | Normal browsing; blocked sites stay blocked |
| The main server returns | The device goes back to its first DNS server over time | Nothing; no setting needs to change |
Six uptime questions to ask any hosted filter
Put these to every provider you consider, including us. The answers tell you how a bad day will go.
How many servers answer for us?
One address means one point of failure, however reliable the server is.
Do they carry the same rules?
Ask how quickly a change on one reaches the other.
What happens if all fail?
Fail closed or fail open, and whether you can choose.
Who notices first?
Monitoring that alerts the provider beats a user complaint every time.
Where do updates go?
Category data and rule changes should reach every server, not only the main one.
Can we test it ourselves?
You should be able to query each address directly and see both answer.
A single-server filter, or main and backup servers
The same outage, on two kinds of setup.
| Situation | One filter server | Managed filter, main and backup |
|---|---|---|
| One server stops answering | Lookups fail, or a public secondary takes over unfiltered | The backup answers with the same rules |
| You change a rule | Applies on the only server | Main in seconds, backup within a minute |
| Someone has to notice | Usually a user complaint | Checks every minute alert our team |
| Router configuration | Tempting to add a public DNS as backup | Two filter addresses, nothing else |
| Category updates | One copy to keep current | Delivered to both servers |
Filter uptime: frequently asked questions
What happens if the DNS filter goes down?
With the main filter as the router's primary DNS and the backup filter as its secondary, devices switch to the backup when the main server stops answering. The backup carries the same rules, so filtering continues.
Does the backup server have the same rules?
Yes. Policies, lists, profiles and schedules are copied from the main server to the backup every minute, so a change you make is in force on both almost at once.
Should I add a public DNS server as a third option?
Not on a filtered network. Many devices use any listed DNS server, not only when the others fail, so a public server becomes a permanent way around the filter.
What happens if both filter servers are unreachable?
Lookups fail and devices report no internet, which keeps the network filtered rather than open. Our team is alerted by the checks that run every minute on both servers.
Will a failover slow the internet down?
Devices wait a moment before they try the secondary DNS server, so the first lookups after a failure can take a little longer. Answers already in device and browser caches keep working meanwhile.
Do I need to change anything when the main server comes back?
No. Devices return to the first DNS server on their own, and both servers hold the same rules, so nothing on the router or the devices needs to change.
Are lookups answered by the backup in our reports?
Yes. Activity from the backup server is copied back to the main server, so lookups answered during a failover appear in the same activity log and monthly reports as the rest.
Can we monitor the filter from our own tools?
Yes. Schedule a lookup of a known domain against each filter address from your own monitoring system and alert when it fails. It is a simple check that works with any DNS-aware monitoring tool.
How do I check which server is answering?
Run nslookup followed by a domain and then the address of each filter server. A normal answer from both means both are working for your network.
Main and backup servers come with every plan of the managed DNS filter, from $99 a month for one site, with several sites quoted together. A pilot lets you set both addresses on your router and test failover yourself.
Ask us anything about uptime before you switch
Tell us how your network is built and what an outage would cost you. We will walk through the failover setup during a pilot on one site.