Glenn Porter liked the people. He liked where the product was going. Then he left. The president of Nashville managed service provider 5th Gear Technology Concepts had signed up for DNSFilter in 2016, when the company was young. Its features were limited, and its artificial intelligence was still developing. Good intentions did not make the software ready for his customers.
According to DNSFilter’s account, Porter spent roughly ten months with OpenDNS before checking back. What brought him around was concrete: better filtering, fewer false positives and less time preparing deployments. The company had become easier to put to work. “DNSFilter is a constantly evolving product,” he said in the published case study.
That departure and return expose the awkward bargain inside web security. Blocking dangerous destinations is essential. Blocking legitimate work creates another problem, usually delivered to IT as a complaint. DNSFilter has built its business in that narrow space. Its newer ambitions stretch well beyond the domain lookup, but the original customer test remains wonderfully unforgiving: does this make the day easier?
The useful moment before a connection
The Domain Name System translates a readable domain name into the address a device needs to connect. A protective DNS service uses that lookup as a checkpoint. If the requested destination is associated with phishing, malware or a forbidden content category, the service can prevent the connection from proceeding through normal resolution.
DNSFilter sells that checkpoint as a cloud service. Administrators set policies, manage allowed and blocked destinations, and inspect activity through reports and logs. Roaming clients extend protection to devices away from the office. Its application controls group the domains behind an application, saving administrators from assembling every related address by hand.
The expertise is a combination of domain classification, threat intelligence and operating DNS infrastructure. Machine learning helps classify destinations; outside intelligence feeds supplement it. The operational challenge is speed as well as judgment. A useful verdict has to arrive while someone is waiting for a page, and a resolver has to remain available when part of its network fails.
A supplier problem becomes a company
Ken Carnesi encountered filtering while running Anaptyx, his earlier wireless networking business. In a 2025 podcast, he recalled putting an antenna on a Boston apartment building and advertising internet service with tear-off flyers. Networks at hotels and public facilities eventually gave him a close view of what people brought onto shared Wi-Fi.
He also recalled a proposed increase of roughly 700 percent from his filtering supplier. That figure is his retrospective account, not a published price schedule. Fixed customer contracts made a sudden increase difficult to absorb. He began building something for his own needs, then saw an opening to sell it to others.
DNSFilter dates its founding to October 2015. Carnesi’s fellow founders included Brian Gillis and Mike Schroll. The company’s name was deliberately literal, its own history says: it considered fashionable startup naming tricks, then settled on the job description. Nobody needs a brand workshop to guess what DNSFilter does.
The hotel test: will the VPN still work?
Oetker Collection offers a more specific buying story than a list of customer logos. In its 2021 case study, the hotel group described losing content filtering when it changed antivirus products. Remote employees still needed protection. A Cisco Umbrella proof of concept ran into compatibility trouble between the roaming client and the group’s VPN.
IT head Florian Rousselle found DNSFilter through discussions on Reddit. The trial included a feature that paused access to an uncategorized destination while it was scanned. That offered an alternative to allowing every unknown site or blocking all of them and handling the resulting complaints.
The reported rollout reached ten hotel networks in one week and about 1,000 Windows devices in under two months. Those are results from that deployment, not a timetable every buyer can expect. The useful lesson is the sequence: identify the missing protection, test the awkward dependency, then expand. The VPN belonged in the audition.
The invoice is only one cost
DNSFilter’s buyers range from small businesses and schools to enterprise IT departments and managed service providers. Published customer material includes Indiana Wesleyan University and Fresno Unified School District; its business updates have also named Viasat and McKee Foods. These organizations have different budgets, but each needs rules that can be administered across people, devices or locations.
The commercial model is subscription software. At the September 2026 check, standard monthly Core pricing was $1.15 per license with a $23 minimum; Plus was $2.50 with a $62.50 minimum. Enterprise requires a quote. Annual billing has different rates and minimums. The MSP program starts at $150 a month, and qualified education buyers have separate pricing.
For a straightforward 100-license deployment, the displayed monthly rates imply $115 for Core or $250 for Plus before add-ons and taxes. That arithmetic is an illustration, not a customer quote. The licensing guidance allows a person or a device to represent a user depending on the deployment, so counting laptops alone can produce the wrong budget.
Administration belongs in the calculation too. Someone has to investigate blocked destinations, maintain exceptions and help employees whose connection behaves strangely. A cheap subscription can become expensive if it produces hours of avoidable work. Porter’s return makes that cost visible without requiring a speculative return-on-investment spreadsheet.
Buying the pieces beyond DNS
Outside funding helped broaden the company. DNSFilter announced a $30 million Series A led by Insight Partners in July 2021, with Arthur Ventures participating. In August 2023, it raised another $15 million from Insight. The extension announcement said the money would support expansion, research and development, customer success and leadership hiring.
Acquisitions trace the product’s widening job. Webshrinker, acquired in 2018, brought domain-categorization technology. Guardian followed in 2022 with privacy and firewall capabilities. In April 2025, DNSFilter bought Zorus, whose endpoint filtering and user behavior analytics could add visibility and control beyond what a network-level domain check provides.
The Zorus announcement specifically pointed to full-URL and IP-address filtering. That matters because a domain is a coarse unit of judgment. Knowing which domain a device requested does not tell an investigator everything about a person’s activity within a website. Moving closer to the endpoint changes what the security system can observe and act on.
A cheap subscription can become expensive if it produces hours of avoidable work.
THE BUYER’S CALCULATION
In 2026, the endpoint gets a bigger job
DNS PreCheck, launched in March 2026 for the Windows Roaming Client, moves filtering ahead of DNS resolution. The practical target is familiar to anyone who has tried joining hotel Wi-Fi while a corporate security tool objects: captive portals, VPN transitions and settings that change between networks. DNSFilter says the approach avoids requiring DNS configuration changes.
CyberSight arrived the same month with user behavior analytics, including full URLs and application activity. It gives security teams more context about activity that was allowed, not merely requests that were stopped. The launch covered Windows, with macOS support described as planned. Buyers should check platform support for the exact feature they intend to deploy.
The Windows client’s later release notes added SecureTransit, with policy-controlled encryption through a managed gateway using WireGuard or IKEv2. Administrators can determine whether it is always on, manually controlled or disabled. Encryption addresses a different need from domain blocking: protecting traffic in transit on the networks employees use.
In August, Carnesi previewed LUMINATE, a forthcoming platform with shadow AI and AI governance controls. That announcement showed where the company wanted to go; it did not by itself establish general availability. The September 1 changelog, meanwhile, recorded a concrete interface change: customizable dashboards became the default landing experience.
A security vendor inside other vendors
DNSFilter’s July 2026 OEM launch opened another route to market. Internet providers, device makers and software companies can resell, embed or white-label its protection. The offering includes protective DNS and Guardian privacy services, with a developer sandbox intended to let engineers try integration before a lengthy commercial process.
The announcement identified Amazon’s eero as an existing home for Guardian technology and put DNSFilter’s organizational reach above 45,000. These are company-reported measures. They describe a business whose protection can appear under somebody else’s brand, as well as through its own dashboard.
That partner emphasis fits its origins serving other network operators. Relationships announced in its review of 2023 included Pax8, Climb, SolCyber and FokusMSP. Distribution is useful when the customer wants one provider to run several security products. For DNSFilter, it also means earning the confidence of the technician who will inherit the support call.
The workday is the benchmark
The organization building the software describes itself as global and hybrid. Its careers page lists staff across countries, an $800 home-office allowance and unlimited paid time off. Those are employer descriptions, but they reveal a practical connection to the product: a distributed workforce is also the environment its security tools must accommodate.
For a prospective buyer, a sensible trial starts with an ordinary working day. Include essential business applications, an unfamiliar but legitimate website, a remote laptop and the actual VPN. Watch which activities are blocked, whether the explanation is useful, and how quickly an administrator can resolve a mistake. This is a practical inference from the customer stories, not a promised deployment recipe.
The fit weakens when an organization expects domain filtering alone to deliver the detail of full-URL inspection, or assumes every endpoint feature works on every operating system. Policies also depend on deploying and enforcing the intended control. DNSFilter itself argues for layered security. Its filter belongs alongside other defenses, with a clear job and a tested place in the network.
Cisco Umbrella is the recurring alternative in DNSFilter’s history. The strongest comparison is not a sweeping claim about which vendor wins every threat contest. It is the one an IT team can reproduce with its own applications and constraints. Porter left when the product was not ready for his clients. His return is a reminder that the next renewal is earned in all the uneventful hours between incidents.