DNS and web filtering

DNS and web filtering blocks connections to known malicious domains and, optionally, categories of unwanted content, by intercepting the DNS lookup before a device even connects to a destination. A roaming agent extends that protection to laptops off the client network, and some products add a secure web gateway that inspects web traffic more deeply than DNS filtering alone. This category does not scan files or watch endpoint behaviour; it blocks bad destinations before a connection is made, which is a narrower and lighter-weight job than EDR or a full firewall.

Pricing is per user, per protected endpoint, or per site, depending on the vendor and how the product is deployed. Network-wide router deployment, protecting every device at a location without installing an agent on each one, is often priced per site rather than per user.

DNS-layer blocking backed by a current threat intelligence feed is the core of the category; a filter is only as good as the list of malicious domains it checks against. Content category filtering matters for clients who want acceptable-use policies enforced, and a roaming agent is essential if any client has laptops that leave the office network regularly. Per-site policy and a multi-tenant dashboard matter for an MSP managing this across many client sites, and custom block and allow lists let you override the vendor's defaults for a specific client's needs.

RMM integration lets the roaming agent be deployed and monitored alongside everything else on the endpoint, rather than as a separate agent nobody tracks. Reporting and an audit log matter if a client asks what was blocked and when, which comes up more often than expected once filtering is in place.

Ask whether pricing is per user, per endpoint or per site, and how that changes as a client's headcount or device count shifts. Ask about the contract term and whether network-wide router deployment requires specific hardware or configuration the client's existing router may not support.

A small MSP can usually deploy a straightforward DNS filtering product with default categories and a roaming agent, without needing per-site policy differences across a handful of clients. A larger MSP managing many sites with different acceptable-use requirements benefits more from per-site policy control and a multi-tenant dashboard that avoids reconfiguring settings client by client.