Set Up DNS Filtering with Atlas Resolve

How Atlas Resolve filters DNS on devices running the Atlas Reach agent: build named DNS policies, assign them to the tenant or a host pool, and more.

Before you begin

  • Atlas Reach turned on for the tenant, with the Atlas Reach agent installed and approved on each device you want to filter
  • Atlas Resolve turned on for the tenant (it is on by default)
  • The reach.view permission to see Atlas Resolve, and reach.deploy to change policies or the block page

Before you start: what Preview means

You can create and assign DNS policies today. A device starts enforcing them once its Atlas Reach agent reports that it supports DNS filtering. Until then the device shows as Never reported on the Overview tab and on its DNS filtering tab. That is expected, not a fault: the policy is waiting for the agent, and the device starts filtering as soon as the agent is updated and reports in.

Never reported means the agent has not sent a DNS filtering report yet. It does not mean filtering failed. Check that the agent is up to date and online.

Find Atlas Resolve

In the sidebar, go to Atlas Operations → Resolve. The page is titled Atlas Resolve DNS Filtering and has three tabs.

  • Overview: how many devices are enforcing, need attention, have filtering off or are not reporting, a rollup by host pool, every device's status (worst first), and the Activity card.
  • Policies: your library of named DNS policies (DNS policies) and which policy each scope uses (Where policies apply).
  • Block page: the heading, message and contact details people see when a policy shows your block page.

Step 1: Set a default policy

Until a default exists, the page shows a No default DNS policy warning: devices whose host pool has no policy of their own are not filtered. Click Apply recommended policy to fix this in one step, or Choose a policy to pick one of your own.

  • The recommended policy is saved in your library as Recommended security and assigned tenant-wide.
  • It blocks the security categories (Malware, Phishing, Botnet command and control, Cryptomining), answers that blocked sites do not exist, sends lookups to Quad9 over DNS over HTTPS, locks DNS settings and turns off browser secure DNS.
  • It blocks no content categories, so nothing people legitimately use is blocked out of the box.

Step 2: Build your policy library

On the Policies tab, under DNS policies, click New policy. Give the policy a name and, optionally, a description. Policies are reusable: one policy can apply to the tenant and to several host pools, and saving it updates every scope that uses it.

  1. Leave DNS filtering on. When it is off, devices restore their normal DNS settings and filter nothing.
  2. Under Blocked categories, tick the categories to block. Click Security categories only to start from the safe minimum. Categories are grouped into Security, Content, Productivity, and Evasion and risk.
  3. Add domains to Always allow and Always block, one per line. Each entry also covers its subdomains, and Always allow wins over every block.
  4. Turn on Enforce SafeSearch to force the search provider's restricted mode.
  5. Optionally add Schedules to block more at set times (for example social media during working hours). Schedules run on each device's own clock, and your allow list still applies.
  6. Choose Activity reporting: Off, Totals and top blocked sites, or Every lookup.
  7. Click Save.

Some domains can never be blocked, because Windows, Microsoft Entra ID or Azure Virtual Desktop need them to work. If you add one to Always block, the editor flags it and the policy will not save until you remove it. Older agents (below 1.0.133 on Windows, 1.0.106 on macOS and Linux) ignore schedules and keep enforcing the rest of the policy.

Step 3: Choose where each policy applies

Under Where policies apply, choose a policy for each scope. A device uses the most specific policy that applies to it.

  1. Built-in default: the starting point. Filtering is off until you turn it on in a policy.
  2. Tenant-wide: overrides the built-in default for every device in the tenant.
  3. Host pool: a host pool's own policy wins over the tenant-wide policy. A pool without one shows Inherits tenant-wide (or Inherits built-in default).

Connected devices receive a saved policy straight away. Offline devices pick it up when they reconnect. Deleting a policy sends the scopes that used it back to the policy they inherit.

When a lookup is blocked

Each policy decides what a blocked lookup returns, under When a lookup is blocked:

  • Answer that the site does not exist: the browser shows its normal "site can't be reached" error. This is the default.
  • Show your block page: people see the page you set up on the Block page tab, with your heading, message, contact email and phone, and optionally the blocked site and why it was blocked. Leave a field empty to use the default wording. If your managing partner has branded Atlas AVD for you, their branding applies, and they may manage the block page for you.
  • Send to a block page server you host: enter the Block page URL (http:// or https://).

For HTTPS sites, which is most of the web, the browser shows a security warning instead of a block page, because the block page cannot present that site's certificate. The lookup is still blocked.

Encrypted upstream

Lookups that are allowed are sent on to the resolver you choose, encrypted. Under Encrypted upstream, pick DNS over HTTPS (DoH) or DNS over TLS (DoT), then a provider: Quad9, Cloudflare or Google, or Custom to enter your own resolvers. A DoH resolver must be an https:// URL; a DoT resolver is a host name or IP address.

Bypass protection

Filtering only works if lookups go through it. Under Bypass protection, choose how hard the device works to keep them there:

  • Lock DNS settings: keeps every network adapter, including IPv6, pointed at the filter. On by default.
  • Turn off browser secure DNS: stops Chrome, Edge and Firefox sending lookups around the filter with their own secure DNS. On by default.
  • Block other DNS servers: firewalls DNS traffic to any other server. Off by default, because it can break VPNs that bring their own DNS.

Checking that filtering works

The Overview tab grades every device. Enforcing means the device is filtering with the current policy. Degraded, Leak detected and Error need attention; Stale and Never reported mean the device is not reporting; Off means filtering is turned off for it. The Activity card shows lookups, blocked lookups and the block rate for the period you pick, a Blocked lookups per day chart, and the most-blocked sites.

  • Each device has a DNS filtering tab showing which policy it runs and where it came from (host pool, tenant-wide or built-in default), whether it is running the current policy, whether its upstream resolver is reachable, and its recent lookups and blocks.
  • If lookups are getting around the filter, the device tab warns Some lookups are bypassing the filter and names the cause: an IPv6 DNS server, a changed network adapter setting, a VPN's own DNS server, a browser's own secure DNS, or another DNS server. Turning on the matching Bypass protection option usually fixes it.

Billing

Atlas Resolve is included with Atlas Reach on every plan and uses no units of its own. Filtering DNS on a device adds nothing to that device's Atlas Reach unit, so a filtered device costs exactly what Atlas Reach already charges for it, and a device Atlas Reach does not bill filters at no charge too. See What Is an Atlas Unit? for how Atlas Reach counts devices.

To stop using Atlas Resolve, go to Settings → Atlas Reach and turn off Atlas Resolve DNS Filtering. Every device is sent a policy with filtering off at once and returns to its own DNS settings, and policies cannot be changed until you turn it back on. Atlas Resolve cannot be on while Atlas Reach is off.

Troubleshooting

  • Devices show Never reported: the agent does not support DNS filtering yet, or has not reported. Update the Atlas Reach agent and check the device is online.
  • Devices are not filtered and the page warns No default DNS policy: click Apply recommended policy, or assign a policy tenant-wide.
  • A device shows filtering is not happening because of units: Atlas Reach has no units left for it this month, or units are turned off on the Usage Units page. See What Is an Atlas Unit?
  • The page says Atlas Resolve is turned off for this tenant: turn it back on in Settings → Atlas Reach.
  • A VPN stops resolving names: turn off Block other DNS servers in the policy that device uses.
  • You cannot edit policies: your role has reach.view but not reach.deploy. Ask an administrator.

Next steps