DNSAFE MSP Portal Docs

Platform Overview#

DNSAFE is a DNS-layer security platform built for Managed Service Providers. You deploy our resolvers as the upstream DNS for your clients' networks, and all queries flow through our filtering engine before being answered. Threats, malware, phishing, and custom-blocked domains are intercepted at the DNS level — before a connection is ever made.

The platform has two portals and a REST API:

Key Concepts

• Partner — An MSP or reseller account. Partners own tenants and are billed per-tenant on a monthly plan.
• Tenant — A client network protected by DNSAFE. Each tenant has its own block/allow rules, IP mappings, and query logs.
• IP Mapping — Associates a client IP or CIDR range with a tenant so the resolver knows which policy to apply.
• IP Group — A named collection of IPs within a tenant that can have their own separate ruleset (e.g. a school's student lab vs. staff network).
• ThreatGrid — DNSAFE's threat intelligence blocklist, aggregated from several public and commercial threat feeds. Applied platform-wide.

How a lookup is filtered#

Every DNS lookup from a protected network goes through the same steps, in this order:

Then the checks below run in this order. The first one that matches decides the answer:

Anything that matches nothing resolves normally. Blocked lookups get the block page.

Changes you make in the portal reach the resolvers in about a minute, with no restart needed.

Quickstart Checklist#

Follow these steps to get a client network protected from scratch. Each step links to the relevant section.

1. 1
   Create your partner accountStart a free trial from dnsafe.net/pricing. The trial is 14 days with every feature, and no card is needed.
2. 2
   Add a client network (tenant)In the portal, open Clients → + New Tenant and give it the client’s name.
3. 3
   Map the client's IP addressesOpen the tenant and use the IP Addresses card → + Add IP to add the client's public IP or CIDR range. This tells the resolver which policy to apply to that network.
4. 4
   Point the client's DNS to DNSAFESet the client's router or firewall to use both addresses of your region's pair (see DNS Setup). For encrypted DNS, use DoH or DoT.
5. 5
   Verify queries are flowingOpen Query logs in the menu and filter by the tenant, or use the tenant's Query Logs tab. Within a minute of the client making any DNS request you should see activity appear.
6. 6
   Configure filtering rulesOpen the tenant → Custom Rules tab. Add block and allow rules as needed. Add a schedule to a rule for time-based access.
7. 7
   Choose content filters(Optional) Open the tenant → Protection tab. Ads & trackers and bandwidth-sharing apps are blocked by default. Switch on SafeSearch or categories like adult content, gambling or social media. They’re included in every plan.

Partner Accounts#

Partners are the top-level entities in the DNSAFE hierarchy. Each partner represents an MSP, reseller, or distribution channel. Partners own tenants and are billed on a monthly plan based on the number of active tenants.

Plans

Extra tenants are counted on active tenants and added to the plan at each monthly renewal, with no charge for part of a month. Switched-off tenants don’t count. Current prices: dnsafe.net/pricing.

Creating a Partner

Sign up at portal.dnsafe.net/partner/signup (or Start free trial on the pricing page). You give:

• Name: your business name (shown in the portal and on invoices)
• Email: your sign-in, contact and billing email

The partner menu in the portal has: Overview, Clients, Query logs, Reports, Domain lookup, White-label, Alerts, Team & security, Integrations, API keys, Billing and Onboarding.

Onboarding Progress

Each partner card shows a 5-step onboarding checklist. This tracks whether the partner has completed: account creation, first tenant added, client IP mapped, first query logged, and first custom rule configured. Use this to identify partners who haven't fully activated.

Partner API Keys

Partners create their own API keys in the portal under API keys. A key acts as the partner that created it and can only reach that partner’s tenants. See API Keys below and the API reference.

Tenant Management#

A tenant represents a single client network. Each tenant has isolated rules, IP mappings, and query logs. Multiple tenants can belong to the same partner.

Creating a Tenant

Open Clients → + New Tenant and give the tenant a name (usually the client's company name).

Tenant Detail View

Clicking a tenant opens its page. At the top are two cards: IP Addresses (add, change and remove the network's public IPs and ranges) and Roaming devices (laptops and phones outside the office). Below them are the tabs:

Disabling a Tenant

Disabling a tenant stops DNS filtering for that network — queries will no longer be matched against the tenant's rules or the ThreatGrid blocklist. The tenant's IPs remain mapped but are inactive. Use this for temporary offboarding or billing holds rather than deleting the tenant.

IP Mapping#

IP mapping is how the DNS resolver identifies which tenant a query belongs to. When a lookup arrives, the resolver matches the client’s public IP to a tenant and applies that tenant’s rules. Lookups from IPs that aren’t registered to any tenant or account are refused, so a network must be mapped before it can use DNSAFE.

Adding IP Addresses

Open a tenant → IP Addresses card → + Add IP. You can enter:

• Single IPv4 — e.g. 203.0.113.42
• IPv4 CIDR range — e.g. 203.0.113.0/24
• Single IPv6 — e.g. 2001:db8::1

IP Conflicts

The same IP cannot be mapped to two different tenants simultaneously. If you attempt to add an IP that's already assigned to another tenant, you'll receive a conflict error. You must remove it from the existing tenant first.

Dynamic IPs

For clients whose public IP changes (residential or small business connections):

• Auto-update (recommended): on the network's IP Addresses list, click Auto-update → Turn on for a single IP. You get a private link for the client's router (Dynamic DNS with a custom URL, add ?ip= plus the router's address placeholder) or for an always-on PC or Mac: on Windows, the DNSAFE IP Updater tray app (signed by Admiresty Corporation; paste the link from its menu) or a scheduled task that runs silently in the background; on Mac and Linux, a cron line. The list shows when it last ran and what happened; you get a notice whenever it changes the IP. If auto-update ever reports an address from a different internet provider (most often because the computer running it is connected to a VPN), DNSAFE keeps the current address and asks you first: you get a notice, and the portal shows Keep or Use. A new address from the same provider still updates by itself. Treat the link like a password; New link replaces it.
• Change: edit the IP in place. It keeps its note, history and auto-update link. Changes are recorded in the Activity log.
• If someone opens the portal from the office on a new address, it offers to switch the network to it (after they confirm they're there). The portal, sign-in and your white-label portal domain always load on that network, even before the IP is updated.
• Use a CIDR range that covers the ISP's IP pool for that client
• Add the client’s laptops and phones as Roaming devices (see DoH / DoT). Each gets its own encrypted DNS setup, so it’s recognised whatever IP it’s on

Using a VPN with DNSAFE

DNSAFE recognises a network by its public IP. When a computer turns on a VPN, its lookups arrive from the VPN's address instead, so DNSAFE doesn't recognise them and websites stop loading on that computer (everyone else at the office is unaffected).

• Recommended: add that computer as a Roaming device (Laptops and phones outside the office, on the network's page). It gets its own DNS ID and encrypted DNS setup, so DNSAFE recognises it on any VPN or network and it stays protected and filtered under that network. Each one counts as one IP on the plan.
• Or let the VPN app handle DNS while it's on (“use VPN DNS”). That computer then isn't filtered by DNSAFE while the VPN is on.
• If the computer running auto-update is on a VPN, DNSAFE holds the change instead of moving the whole network to the VPN's address, and the notice links straight to adding a DNS ID.

Propagation Time

New or changed IP mappings reach the resolvers in about a minute.

Device Groups (IP groups)#

IP Groups let you apply different filtering policies to different segments of the same tenant's network. For example, a school might have one group for student devices (strict filtering) and another for staff (relaxed filtering).

Creating a Group

Tenant detail → Device Groups tab → + New Group. Give it a name, then add the IPs or CIDR ranges that belong to it. These IPs must already be mapped to the parent tenant.

Group Rule Priority

When an IP belongs to a group, the resolver applies rules in this order (first match wins):

1. SafeSearch rewrite (if on)
2. Group allow rules, including scheduled allows
3. Group block rules, including scheduled blocks
4. Network allow rules
5. Network scheduled rules (US Eastern time)
6. Network block rules
7. ThreatGrid threats (never-block list exempt)
8. Ads & trackers (if on)
9. Bandwidth-sharing apps (if on)
10. Content filters you switched on

Allow rules beat everything below them, including threats. See How a lookup is filtered.

DNS Resolver Setup#

Set the client's router, firewall or DHCP server to hand out your region's pair of DNSAFE addresses as the upstream DNS. Set both: the second one keeps lookups filtered if the first can't be reached.

Standard DNS (UDP/TCP port 53)

Encrypted DNS

Where the resolvers are and how they're run: dnsafe.net/network.

Per-Platform Configuration

DNS-over-HTTPS (DoH) & DNS-over-TLS (DoT)#

DNSAFE supports encrypted DNS for clients that need privacy or where port 53 is blocked.

With these plain addresses, encrypted lookups are matched to tenants by the client’s public IP, so the network must be registered.

Roaming devices (per-device DNS IDs)

For laptops and phones that leave the office, open the tenant in the portal and use Roaming devices → Add device. Each device gets its own 8-character ID and is matched to the tenant by that ID instead of its IP, on any network:

The portal shows the steps for each device type: a profile link for iPhone, iPad and Mac, Private DNS for Android, and the DoH template for Windows 11 and Chromebook. Each roaming device counts as one IP on the plan. If a device is lost or its setup is shared, use Reset its setup: the old ID stops working at once. Lookups from roaming devices show in the logs as Roaming device <id>.

Browser DoH Configuration

How Blocking Works#

Policy decisions are made in memory on the resolver, in well under a millisecond, so filtering adds no noticeable delay.

When a website is blocked, the lookup returns the address of the DNSAFE block page, so people see a “This site has been blocked” message instead of a browser error. Partners can brand that page with their own name and support email (see White-Label). Other lookup types for a blocked name get an empty answer.

Rules, IP mappings and groups you change in the portal reach the resolvers automatically in about a minute.

Block & Allow Rules#

Custom rules let you extend or override the default ThreatGrid filtering for individual tenants. Rules apply to the entire tenant unless scoped to an IP group.

Adding a Rule

Tenant detail → Custom Rules tab → + Add Rule. Enter the domain and select Block or Allow. The form also has an optional Schedule section (see Scheduled Rules).

• Block — Blocks this domain (and its subdomains) for all IPs in the tenant.
• Allow: passes this domain even if it's on the ThreatGrid blocklist. Use it for a legitimate site that's been flagged by mistake. Allow rules beat threats, so only allow domains you trust.

Domain Format

Enter bare domains without http:// or paths:

• ✅ tiktok.com — blocks the domain and all subdomains
• ✅ ads.example.com — blocks only this subdomain
• ❌ https://tiktok.com/feed — paths are stripped automatically

Bulk Rule Import

Two ways to add many rules at once:

• CSV import: on the Custom Rules tab, click ↑ Import CSV. One rule per line, in the format domain,action,note, where action is block or allow.
• REST API: POST /api/v1/tenants/{id}/rules/bulk. See the API reference.

Scheduled Rules#

Scheduled rules allow you to block or allow a domain only during specific time windows on specific days of the week. This is useful for scenarios like blocking social media during school hours or allowing gaming sites only on weekends.

Creating a Scheduled Rule

Tenant detail → Custom Rules tab → + Add Rule, then fill in the form's Schedule section. Configure:

• Domain: the domain to block or allow
• Action: Block or Allow
• Days: the days the rule is active (for example Mon to Fri)
• Time window: start and end time, in US Eastern time

Device group rules can have a schedule too.

How It Works

Scheduled rules are stored in .sched files in pipe-delimited format:

domain|action|days_bitmask|start_minute|end_minute

The resolver checks the current time (US Eastern) on every lookup and checks if the query falls within the rule's active window. Days are encoded as a bitmask (Mon=1, Tue=2, Wed=4, Thu=8, Fri=16, Sat=32, Sun=64).

Time Zone

Schedule times are US Eastern time on every resolver, wherever the network is. Daylight saving changes are applied automatically. A client in another time zone needs its window converted to Eastern when you enter it.

Overnight windows work. A window like Fri 21:00 to 07:00 covers Friday night into Saturday morning: after midnight it counts as part of the day it started.

Group Rules#

Group rules work identically to tenant-level rules but apply only to IPs that are members of a specific IP group. This lets you have different policies for different departments, floors, or device categories within the same tenant network.

Example Use Cases

• K-12 school: Student group blocks social media and gaming; staff group allows them
• Office: Guest Wi-Fi group applies strict filtering; employee group is more relaxed
• Retail: POS terminal group blocks everything except payment processor domains

Manage group rules from: Tenant detail → Device Groups tab → find the group → + Add Rule.

ThreatGrid Blocklist#

ThreatGrid is DNSAFE's aggregated threat intelligence blocklist. It's applied to every DNS query across the entire platform — for all tenants — regardless of their custom rules.

Feed Sources

The combined blocklist is refreshed automatically every night. DNSAFE’s own domains are never blocked, and addresses on the never-block list (sites a feed would break) are exempt.

Check how DNSAFE treats any site at dnsafe.net/check. If a verdict looks wrong, report it at dnsafe.net/contact?topic=report.

Override with Allow Rules

If a domain is in the ThreatGrid blocklist but you need to allow it for a specific tenant (e.g. a legitimate internal tool that was incorrectly flagged), add an Allow rule for that domain on the tenant. Tenant allow rules take priority over the global blocklist.

Dashboard Feed Status

The dashboard Overview page shows the ThreatGrid Feed card including last update time, sources, and refresh interval. If it hasn’t updated in over a day, contact support.

Content Filters#

The tenant's Protection tab controls what's blocked on top of threats. Everything here is included on every business and MSP plan, with nothing extra to pay. Crypto miners are always blocked as part of threat protection.

Content filters add categories. Each is off until you switch it on:

Switch them on or off from Tenant detail → Protection. Changes reach the resolvers within about a minute.

Secure Wi-Fi#

Secure Wi-Fi is an encrypted VPN (WireGuard) for staff on public Wi-Fi and mobile data. Each device’s lookups use its network’s DNSAFE policy and appear in that network’s Query Logs.

Plans and billing

• Included with Business Enterprise and MSP Enterprise
• On other paid plans the account owner switches it on; it’s $2 per person a month, counted for each person with at least one device (across all clients for MSPs), billed with the plan at renewal
• Up to 5 devices and 200 GB a month of fair use per person

Invite someone

1. Open the network (tenant) and choose the Secure Wi-Fi tab.
2. Enter the person’s email and click Send setup link. You can also copy the link and pass it on yourself.
3. They open the link on the device, pick the device type and follow the steps for the WireGuard app. Each link sets up one device, works once and expires after 7 days.

Remove a device or cancel an unused link from the same tab. Removed devices stop connecting right away. Team members with view-only access can see the tab but not change it.

Internet Exposure Check#

The Exposure tab on a network shows what anyone on the internet can reach at that network’s registered public IP addresses: open Remote Desktop, Windows file sharing, databases, Telnet, VPN and admin login pages, and more. It uses Netlas’s internet-wide scan data; DNSAFE doesn’t scan your network itself.

What you get

• An A–D rating: A nothing risky, B minor issues only, C one serious issue, D several
• Each finding in plain language, with why it matters and how to fix it
• Mark as expected for services that are meant to be open (your VPN, a mail server); they stop counting towards the rating
• Copy for a ticket, and Send to client (a branded summary to the network’s Client reports contacts)
• A weekly re-check, and an alert on the Alerts page when something new and serious appears. Alerts also lists every network’s rating, worst first

Plans and limits

• Included with Business Enterprise, MSP Growth and MSP Enterprise (and during a trial)
• Checks public IPs and ranges of up to 16 addresses; roaming devices and Secure Wi-Fi aren’t included
• Check again works once every 10 minutes per network

In client reports: in the network’s ⚙ Settings tab, under Client reports, switch on Include the internet exposure rating to add the A–D rating and up to three things to fix to the weekly summary your client contacts get. Items you’ve marked as expected are left out, results older than 14 days aren’t sent, and the full details stay in your portal.

Query Logs#

Every DNS query processed by DNSAFE is logged with full context. Logs are accessible in real time from the portal and via the REST API.

Accessing Logs

Two entry points:

• Query logs in the menu: all queries across your tenants, with a tenant filter
• Tenant detail → Query Logs tab: one tenant only

Filters

Log Fields

Log actions

Live Mode

Toggle Live in the top-right of the Query logs page to refresh automatically every 10 seconds. Useful for watching queries in real time during a client setup or troubleshooting session.

Export

Click Export CSV to download the current filtered log set. The export includes all columns and respects active filters. For large exports or automated reporting, use the REST API: GET /api/v1/logs and GET /api/v1/logs/export/csv (see the API reference).

Tenant Health#

The Tenant health page (a DNSAFE admin view) gives a real-time view of every tenant's activity status. It auto-refreshes every 30 seconds.

Status Definitions

Alerts

As a partner, turn on the Threat spike and Client went quiet alerts on the Alerts page to hear when a client goes offline or sees a burst of threats. See Alerts & Notifications.

Domain lookup#

The Domain lookup page (in the menu) lets you run a comprehensive threat analysis on any domain. It's useful for investigating suspicious queries in your logs or vetting a domain before adding a rule.

What It Checks

• DNS records — A, AAAA, MX, NS, TXT, CNAME
• RDAP registration — Registrar, creation date, expiry, registrant org
• Geo-IP — Country, ASN, hosting provider for each resolved IP
• ThreatGrid match — Whether the domain is in the current blocklist
• Query history — How often this domain has been queried on your network and with what actions
• Risk score — 0–100 composite score based on domain age, geo, flags, and threat feed matches

Risk Score Bands

Each user can run 20 lookups a day.

For a quick public verdict on any site, use dnsafe.net/check. Report a wrong verdict at dnsafe.net/contact?topic=report.

Alerts & Notifications#

Configure alerts on the Alerts page in the menu. Under Where alerts go, set an email address and, if you like, a Slack or Teams webhook. Alerts go by email, webhook or both.

Access requests in ConnectWise or Autotask

On MSP Enterprise with ConnectWise or Autotask connected, each “Ask IT for access” request from the block page opens a ticket with one-click Approve and Dismiss links. When the request is decided, from the ticket link, the email or the portal, DNSAFE adds an internal note saying who decided what and closes the ticket.

• ConnectWise: the ticket is set to >Closed, then Closed, Completed or Resolved, whichever your service board accepts. If your board uses another name, enter it as Closed status in the ConnectWise settings.
• Autotask: the ticket is set to Complete (status 5). If yours differs, enter it as Complete status in the Autotask settings.
• If closing isn’t accepted, the note is still added and the ticket stays open for you to close.

API Keys#

The REST API lets you manage tenants, IPs, groups and rules and read query logs from your own tools. Create keys in the portal under API keys. The full key is shown once, so store it somewhere safe.

Which plans include it

• Basic is included with Business, MSP Growth and during a trial
• Pro is included with Business Enterprise and MSP Enterprise
• On other plans, or for higher limits, buy a tier on the API keys page

API Key Tiers

Authentication

Send the key as a bearer token on every request:

Authorization: Bearer dnsapi_…

Base URL

https://api.dnsafe.net/api/v1

Endpoints, parameters and examples are in the API reference.

Plans & Billing#

DNSAFE billing is managed through Stripe. Partners are billed monthly based on their plan and active tenant count. Extra client tenants above the plan’s included number, and Secure Wi-Fi where it’s an add-on, are added to the plan subscription.

Billing Cycle

When you add or remove tenants, the extra-tenant quantity on your subscription is updated to match, and it's billed at the next renewal. You can download invoices and update your payment method from Billing in the menu.

Overage

Growth and Enterprise have no cap: each tenant above the included number is billed as an extra. Starter has a cap of 25 tenants in total. To add more, move to Growth.

Trialing

New partners start a 14-day free trial with every feature, and no card is needed. If you don't choose a plan when it ends, the account becomes read-only and filtering stops. Nothing is deleted yet: your settings and history are kept for 30 days. Choose a plan any time before then and everything comes back as it was.

🏷️White-Label & Custom Domains#

Partners can present the DNSAFE portal under their own brand — custom domain, logo, colors, and support email. Clients see your company's identity throughout the portal and on the DNS block page. Custom domain provisioning (SSL + reverse proxy) is fully automated.

White-label branding is included with MSP Growth, MSP Enterprise and Business Enterprise. Open it from White-label in the partner menu.

What gets branded

Branding fields

Custom domain setup, step by step

1. Open the Branding tab
   Open White-label in the partner menu. Click Edit Branding.
2. Fill in your branding fields
   Upload your logo and enter your Company Name, Support Email and colors. These take effect immediately after saving — no domain required.
3. Enter your custom domain
   In the Custom Domain field type the subdomain you want to use, e.g. protect.acmeit.com. Use a subdomain (not a root domain). Click Save Branding.
4. Add a CNAME record at your DNS provider
   Log in to your registrar or DNS provider (Cloudflare, Route 53, GoDaddy, Namecheap, etc.) and create:

   TYPE   NAME                    VALUE               TTL
   CNAME  protect.acmeit.com.     custom.dnsafe.net.  300

   Propagation typically takes 1–10 minutes. You can verify with:

   dig CNAME protect.acmeit.com +short
   # should return: custom.dnsafe.net.

5. Provision the domain
   Back in the portal, click ⚡ Provision Domain. DNSAFE will:
   • Verify the CNAME record resolves to the correct server
   • Issue an SSL/TLS certificate via Let's Encrypt
   • Configure the nginx reverse proxy to serve the portal at your domain
   The status badge updates automatically. The whole process takes under 60 seconds if DNS has propagated.
6. Share with your clients
   Once the status badge shows Active, your branded portal is live. Share the URL with your clients — they sign in at your custom domain and see your branding throughout.

Domain status reference

Troubleshooting

Your DNS address

In White-Label → Your DNS address, pick a short name (3–20 letters, numbers or hyphens). It works straight away, with nothing to add at your DNS provider. Included with every MSP plan and Business Enterprise.

The DNS address is always yourname.dns.dnsafe.net. Using your own domain as the DNS address is not available yet. (Your own domain for the portal works today: see Custom domain setup.)

• Roaming-device setup steps and iPhone/Mac profiles use your name as soon as it’s saved. Devices already set up keep working on dns.dnsafe.net.
• A device ID only works with its own partner’s name, so nobody can use your name with someone else’s devices.
• If you change or remove the name, the old one keeps working for 30 days, then set those devices up again (or they fall back to working by office IP).

Client Reports#

Client reports send your clients email under your brand. They come with white-label branding (MSP Growth and MSP Enterprise). Set them up per network: open the tenant → ⚙ Settings tab → Client reports.

• Client contacts: add the client's email addresses. Nothing is sent until you add one, and each contact can unsubscribe.
• Weekly summary: every Monday, threats stopped, sites blocked and how protection is going.
• Send alerts to the client too: “Threat spike” and “network went quiet” also go to these contacts, in plain language. You always get them.
• Include the internet exposure rating: adds the A–D rating and up to 3 items to fix to the weekly summary.
• Send a test summary to yourself or to one of the contacts.

Branded sending domain

Under White-label → Send emails from your domain, enter your domain and add the 3 DNS records shown at your DNS provider, then press Check now. Once it's verified, emails that go out under your brand (client reports, alerts, access requests, Secure Wi-Fi invites, team invites and summaries) come from your domain instead of noreply@dnsafe.net. If sending from your domain ever fails, DNSAFE falls back to noreply@dnsafe.net.

Branded PDF reports are on the Reports page (see White-Label).

MFA & Duo Setup#

DNSAFE supports Duo two-step sign-in for the portal. It's available on MSP Enterprise and Business Enterprise.

Turning on Duo

Open Team & security in the menu. Under Two-factor sign-in, turn on the Require Duo switch. From then on everyone on the account signs in with Duo after their password.

• Only the account owner can change the switch.
• There are no Duo keys for you to enter: DNSAFE runs the Duo connection.

Team & Security#

Open Team & security in the menu to control who can sign in to your account.

• Invite a teammate by email, as Admin or Viewer. You can resend the invite, change a role, suspend or remove someone.
• The Activity card is the audit log: who changed what, for the last 200 changes.
• Duo two-step sign-in is on the same page (see MFA / Duo Setup).

Integrations#

Open Integrations in the menu. MSP partners see SIEM, PSA tickets and SSO. Business accounts see SIEM, SSO and DNS name (there are no PSA tickets on business plans).

SIEM streaming

Forward DNS query logs to your SIEM or log platform. Events are sent every 2 minutes.

• Webhook: generic JSON, Splunk HEC or Elastic bulk format
• Syslog: UDP or TCP (RFC 3164 or RFC 5424)
• Use the test button to send a sample event
• Included with the Business and Enterprise plans for businesses, and the Growth and Enterprise plans for MSPs

PSA tickets (ConnectWise and Autotask)

On MSP Enterprise, connect ConnectWise or Autotask so “Ask IT for access” requests from the block page open tickets. See Access requests in ConnectWise or Autotask for how tickets are closed.

SSO

SAML single sign-on is included with the Enterprise plans (business and MSP).

DNS name (business Enterprise)

Put your company’s name on the encrypted DNS address your team sets up on phones and laptops, like harbor.dns.dnsafe.net instead of dns.dnsafe.net. Set it under Integrations → DNS name; the setup guide then shows your address. MSP partners set theirs under White-label.

Consumer Accounts#

The consumer portal (my.dnsafe.net) is a self-service portal for home and personal users. Consumer accounts are separate from partner/tenant accounts and are managed independently.

DNSAFE admins can view all consumer accounts from Home accounts in the admin menu. This shows plan, device count, subscription status, and join date.

Consumer Plans

Suspending a Consumer

From the Consumers list, click Suspend on a consumer row to immediately disable their account. Their device IPs are removed from the consumer IP map and queries will no longer be filtered. Use this for billing issues or ToS violations.

Consumer Rules#

Consumer accounts can manage their own block and allow rules from the consumer portal (my.dnsafe.net/rules). These rules apply to all registered devices on their account.

Consumer rules are kept separate from tenant rules and reach the resolvers in about a minute.

DNSAFE admins can view a consumer's rules from their detail page (Home accounts → open the account).

Troubleshooting#

Queries not appearing in logs

1. Confirm the client's DNS points to your region's pair (see DNS Setup): run nslookup dnsafe.net from the client and check the server shown
2. Check that the client's egress IP is mapped to the tenant (Clients → the tenant → IP Addresses card)
3. Check that the tenant is active (not disabled)
4. Wait about a minute for new IPs to reach the resolvers

A domain isn't being blocked

1. Verify the rule exists on the correct tenant (not a different one)
2. Check the domain format — enter just the domain, no http:// prefix
3. Wait about a minute for the change to reach the resolvers
4. Try flushing the client's DNS cache: ipconfig /flushdns (Windows) or sudo dscacheutil -flushcache (macOS)
5. Use Test a domain on the tenant's Protection tab to see which rule wins

A blocked domain is showing up as allowed

Check the rule order (see How a lookup is filtered): group allow rules override tenant blocks, and allow rules beat threats. If the querying IP is in a group that has an allow rule for the domain, the block won't fire. Check the group's allow list first.

The block page isn't showing

The block page appears when the browser loads the blocked site and lands on DNSAFE’s block page instead. On HTTPS sites, turn on Show the block page on HTTPS sites on the tenant's Protection tab and install the DNSAFE certificate on the devices. Without it, HTTPS sites show a browser error instead of the page. Some browsers cache previous DNS answers for longer. Try a hard refresh or open an incognito window. Also check that the client's router doesn't have DNS rebind protection blocking the response.

API returning 401 Unauthorized

Your API key may have been rotated or the Authorization header format is incorrect. Ensure you're passing: Authorization: Bearer YOUR_KEY (note the space after Bearer).

ThreatGrid feed not updating

Check the dashboard: the ThreatGrid Feed card shows the last update time. Feeds refresh once a day; if it’s more than a day old, contact support.

Frequently Asked Questions#

Can a client IP be mapped to multiple tenants?

No. Each IP can only belong to one tenant at a time. If you need different policies for different subnets, use CIDR ranges that don't overlap, with each range mapped to its own tenant.

How quickly do rule changes take effect?

Rule changes are saved immediately and reach the resolvers in about a minute. DNS resolvers also cache responses, so clients may need to flush their DNS cache for the change to take immediate effect.

Does DNSAFE log the full DNS query including all subdomains?

Yes. Every query is logged with the exact domain queried (including any subdomain), the resolved action, client IP, and timestamp.

What happens if the DNSAFE resolver is unreachable?

If the resolver is unreachable, DNS queries will fail and clients will experience internet outages (DNS is required for nearly all internet traffic). That's why you set both addresses of your region's pair (see DNS Setup): if one can't be reached, the other answers, still filtered. Don't use your ISP's or any other DNS as the secondary, because lookups through it are not filtered. Resolver status is at status.dnsafe.net.

Can I use DNSAFE alongside an existing firewall DNS policy?

Yes. DNSAFE operates at the DNS layer and is complementary to firewall rules. DNS filtering is faster (blocks at query time before any connection) and easier to manage for domain-based policies. Use your firewall for IP/port-level controls and DNSAFE for domain-level filtering.

Are query logs retained indefinitely?

No. MSP Starter and Business Starter keep 30 days, MSP Growth and Business keep 90 days, and MSP Enterprise and Business Enterprise keep 365 days. Older logs are deleted automatically. For compliance requirements, use the REST API to export logs to your own storage on a scheduled basis.

Can partners log in to the MSP portal directly?

Yes. Partners use the same portal.dnsafe.net login. The portal automatically scopes their view to their own tenants — they cannot see other partners' tenants or admin-level settings.