An employee opens a company laptop at the kitchen table, in a hotel room or in a coworking space. The office firewall is nowhere near it.
Businesses spend real money on firewalls and filtering. Those controls protect the traffic that passes through them. When a laptop connects to a home router, most of its traffic never touches the office at all.
DNS filtering for remote workers closes that gap by moving protection from the network to the device.
A Firewall Only Protects the Traffic It Can See
Firewall protection depends on routing. Traffic has to cross the firewall to be inspected. Many companies no longer send everyday traffic through a full-tunnel VPN, because cloud applications work well straight from the internet. That is a sensible design, and our post on remote access modernization covers the connectivity side.
It also means a laptop’s web traffic may go directly from a home network to the internet. We have no control over that network. The same is true in hotels and shared office spaces, where the connection comes from a source we do not manage. If an employee clicks a phishing link there, nothing at the office is in a position to stop it.
How DNS Filtering for Remote Workers Works
Before a device connects to a website, it asks DNS for the address. A DNS filter checks that request against known threats and categories. If the destination is dangerous or against policy, the connection never opens. Because the check happens first, the user never reaches the harmful page. That protects the laptop at the kitchen table as well as the one in the office.
We use DNSFilter, which installs a small roaming client on each laptop. The client sends DNS requests through DNSFilter’s filtering on any network, so the policy follows the device. NIST’s 2026 Secure DNS Deployment Guide describes DNS as an additional layer of network security within a zero trust or defense-in-depth approach. That is how we treat DNS security for business.
What We Block and What Clients Choose
By default, we block the categories we know get people into trouble. Those include malware, phishing, newly registered domains, parked domains, botnets, gambling and crypto, just to name a few.
Social media, streaming and other time-wasters are optional. The client decides. We make recommendations from the start, then ask whether they want anything else blocked or unblocked. Each default category is one we know can cause trouble, so blocking it from the start means few surprises.
Policies can also differ by person. One employee might manage the company’s social media accounts. That user can have access that everyone else lacks, without opening social media across the whole company.
When someone hits a block, a DNSFilter page lets them request that the site be unblocked. The request comes to us. We review the logs to see how the site was categorized, then unblock either the individual site or the whole category.
Where DNS Filtering Stops
DNS filtering works at the domain level. It does not inspect the content of a page, so it cannot catch a threat hosted on a legitimate site. A connection made directly to an IP address also never asks DNS for anything. That is why it is one layer among several, and why our post on the layered IT security model explains that no single control is enough.
Behind a corporate firewall, the firewall does most of the filtering. Some clients keep DNS filtering on anyway, since another layer of the onion costs little and adds protection.
Confirm Protection Is Actually Running
A control that is not installed protects nothing. We push the roaming client through our RMM and receive confirmation of whether the install succeeded or failed. The client upgrades itself as needed, and filters are managed entirely from a web console.
Agent status appears in both the RMM and DNSFilter’s own dashboard, which gives us two places to check. A weekly report lists blocked threats and categories. We treat it as informational, since the right categories are blocked from the start.
Visibility Into AI Tool Usage
DNSFilter’s reporting also shows which machines or users are reaching generative AI tools. If a client has standardized on ChatGPT and the report shows heavy Claude use, that deserves a conversation. Several AI platforms in use at once can be a security risk.
One limit applies. DNS sees requests to known AI domains, so it will not catch every locally installed app. For web-based tools, the report is easy to read.
Why Business Owners Should Care
A single phished credential or malware infection can cost money, time and reputation. On a home network, we have no control over where a laptop can go. Filtering at the DNS level gives better visibility into links before anyone interacts with them, and that is often the difference between a blocked page and an incident.
Our cybersecurity and managed IT services can put this layer on every laptop, wherever it connects.