Security & Backup

DNSFilter

Run protective DNS from chat - review and change filtering policies, allow/block lists, sites, and roaming clients, with every change held for approval.

Dex connects to DNSFilter, the protective-DNS service, so admins can run web filtering conversationally - review and edit filtering policies, category and application blocks, explicit allow/block lists, sites (networks), roaming clients, collections, block pages, and scheduled policies, and read traffic reports and the DNS query log to confirm whether a domain was blocked, when, and for whom. Employees can ask why a website is blocked and get an answer based on the actual filtering policy instead of filing a ticket. DNSFilter is an MSP global app: one shared API token covers the whole account, and each Dex tenant is confined to its own DNSFilter Organization by organization_id, so an MSP can serve every client from a single connection without crossover.

Start with $100 free →See Dex Live

What Dex does with DNSFilter

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List and read filtering policies - blocked categories, allow/block lists, SafeSearch and YouTube posture, and unknown-domain handling
Add or remove single domains on a policy allowlist or blocklist, one entry at a time with an audit note
Block or unblock content categories and applications on a policy
Create, update, and delete policies, and put a policy into temporary permissive mode
Manage sites (networks) and their site IPs, roaming clients, collections and their precedence, and block pages
Create and manage scheduled (time-of-day) policies
Look up how DNSFilter classifies a domain, and read traffic reports and the DNS query log
Manage the organization profile, agent settings, and dashboard users
Deploy as an MSP global app - one shared API token, each customer confined to its DNSFilter Organization by organization_id

For employees (self-service)

Ask why a website is blocked and get the specific policy and category that filters it
Have Dex classify the domain you are asking about (category and application)
Confirm from the query log whether your request was actually blocked and when
Request that a domain be allowlisted - held for approval, or handed to IT as a complete ticket

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Why is poker.com blocked, and which policy blocks it?
>Allowlist shop.example.com on the Staff policy with a note that IT approved it
>Block the Social Media category on the Contractors policy
>Which sites are unprotected or have no policy assigned?
>Show me the top blocked domains for this organization over the last week

Employee prompts

>Why can't I get to this website?
>Is this site blocked by our filtering, or is it just down?
>Can you allowlist this site for me? Here is the business reason.

Policy actions

Every action Dex can take on DNSFilter is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`dnsfilter_list_policies`	List the organization's DNS filtering policies	—
`dnsfilter_read_policy`	Read one filtering policy, including its allow/block lists and blocked categories	—
`dnsfilter_list_networks`	List the organization's sites (networks) and the policy each one uses	—
`dnsfilter_list_roaming_clients`	List installed roaming clients (agents) and their protection state	—
`dnsfilter_list_collections`	List collections (user/device groups) and their policy precedence	—
`dnsfilter_view_reports`	Read traffic reports and the DNS query log to confirm whether a domain was blocked, when, and for whom	—
`dnsfilter_lookup_domain`	Look up how DNSFilter classifies a domain (categories and applications)	—
`dnsfilter_allow_domain`	Add a single domain to a policy allowlist - affects every user assigned to that policy	approval
`dnsfilter_block_domain`	Add a single domain to a policy blocklist	approval
`dnsfilter_remove_allowlist_domain`	Remove a domain from a policy allowlist	approval
`dnsfilter_remove_blocklist_domain`	Remove a domain from a policy blocklist - re-allows a previously blocked domain	approval
`dnsfilter_manage_policy_categories`	Block a content category on a policy - org-wide filtering change	approval
`dnsfilter_remove_policy_category`	Unblock a content category on a policy - org-wide filtering change	approval
`dnsfilter_manage_policy_applications`	Block an application on a policy - org-wide filtering change	approval
`dnsfilter_unblock_policy_application`	Unblock an application on a policy - org-wide filtering change	approval
`dnsfilter_allow_policy_application`	Explicitly allow an application on a policy - org-wide filtering change	approval
`dnsfilter_remove_allowed_application`	Remove an application from a policy allow list - org-wide filtering change	approval
`dnsfilter_set_permissive_mode`	Put a policy into permissive mode - temporarily relaxes filtering for everyone on that policy	approval
`dnsfilter_create_policy`	Create a new filtering policy	approval
`dnsfilter_update_policy`	Update a policy's settings (SafeSearch, unknown-domain handling, interstitial, YouTube restriction)	approval
`dnsfilter_delete_policy`	Delete a filtering policy - sites and agents using it lose their filtering rules	approval
`dnsfilter_create_network`	Create a site (network) - a new IP-identified location for this organization	approval
`dnsfilter_manage_network`	Update an existing site (network), including which policy and block page it uses	approval
`dnsfilter_delete_network`	Delete a site (network) - that location stops being filtered	approval
`dnsfilter_create_site_ip`	Register a public IP address against a site - that IP starts resolving through DNSFilter	approval
`dnsfilter_manage_roaming_client`	Update a roaming client: assign its policy, scheduled policy or tags	approval
`dnsfilter_manage_roaming_client_settings`	Change a roaming client's agent-side settings	approval
`dnsfilter_delete_roaming_client`	Remove a roaming client record - that device stops being filtered	approval
`dnsfilter_create_collection`	Create a collection (user/device group) that carries its own policy	approval
`dnsfilter_manage_collection`	Update an existing collection, including policy precedence (order)	approval
`dnsfilter_add_collection_member`	Add a user to a collection - that user picks up the collection's policy	approval
`dnsfilter_remove_collection_member`	Remove a user from a collection - that user falls back to a broader policy	approval
`dnsfilter_create_block_page`	Create a block page (branding, contact address, redirect URL)	—
`dnsfilter_manage_block_page`	Update an existing block page (branding, contact address, redirect URL)	—
`dnsfilter_create_scheduled_policy`	Create a scheduled (time-of-day) policy	approval
`dnsfilter_manage_scheduled_policy`	Update an existing scheduled (time-of-day) policy	approval
`dnsfilter_manage_org_settings`	Update the organization's DNSFilter profile and agent settings	approval
`dnsfilter_manage_org_users`	Invite or manage the organization's DNSFilter dashboard users	approval

How to configure DNSFilter

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the DNSFilter dashboard, go to Account Settings > API Keys and create an API token for Dex.
2
On an MSP account, create the token under an MSP-level admin so every sub-organization is reachable.
3
In Dex, enable the DNSFilter integration and paste the API token, leaving organization_id blank on the MSP-master connection.
4
On the MSP-master connection, run GET /v1/organizations/all to find each customer's numeric Organization ID.
5
Set the numeric Organization ID on each tenant's own connection to confine every read and write to that customer. Dex validates the token and organization with a live call before saving.

Credentials required

api_key: DNSFilter API token from Account Settings > API Keys - inherits the permissions of the user who created it, so on an MSP account create it under an MSP-level admin
organization_id: This tenant's numeric DNSFilter Organization ID - leave blank on the MSP-master connection, set it on each tenant connection to confine access to that organization

Requirements

•A DNSFilter account with API access and an API token
•On an MSP account, a token created under an MSP-level admin so sub-organizations are reachable
•The numeric DNSFilter Organization ID for each tenant, found via GET /v1/organizations/all on the MSP-master connection
•DNSFilter is an MSP global app: one shared token, each tenant scoped per organization by organization_id

Related integrations

See Dex run DNSFilter

Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.

Start with $100 free →See Dex Live Browse all integrations →