In short: Sophos DNS Protection is Sophos's cloud DNS resolution and filtering service. It blocks malicious and unwanted domains at lookup time across all ports, protocols and apps. It comes with the Sophos Firewall Xstream Protection subscription for networks, and with Sophos Workspace Protection for Windows endpoints, with DNS over HTTPS and reporting in Sophos Fusion.
What is Sophos DNS Protection?
Almost every connection on the internet starts with a DNS lookup that turns a name, such as a website or a cloud service, into an address. If that lookup is answered by a resolver that knows the domain is malicious, the connection never happens. That is why DNS filtering is one of the simplest and broadest protective layers available: it works for browsers, email links, desktop apps and malware alike, on any port and protocol.
Sophos DNS Protection is a globally available secure DNS resolution service run by Sophos. It uses SophosLabs threat intelligence to block domains identified as threats (those are always blocked), and lets you add your own policies to block or allow domains individually or by category. Dashboards and reports sit in Sophos Fusion (formerly Sophos Central).
Two ways to get it
| DNS Protection with Sophos Firewall | DNS Protection for endpoints | |
|---|---|---|
| What it protects | Every device on a protected network, including unmanaged, guest and IoT devices that use the firewall's DNS | Windows devices running the Sophos Endpoint agent, wherever they connect from |
| Licence | Included with the Sophos Firewall Xstream Protection subscription | Included with Sophos Workspace Protection |
| How it is counted | Covered by the firewall subscription | Number of devices using DNS Protection |
| Includes Sophos Endpoint? | No | No (Sophos Endpoint is licensed separately, or bought in the Endpoint plus Workspace Protection bundle) |
| DNS over HTTPS | Included in the licence, per Sophos's licensing documentation | Sophos Endpoint intercepts DNS traffic and redirects it over HTTPS to DNS Protection |
In both cases DNS Protection comes as part of the subscription rather than as a separate product. Each licence carries a fair use limit: Sophos compares your average daily usage over 30 days with the combined limits of your licences. For details of the firewall bundles, see Sophos Firewall licensing.
How it works
- Add your locations in Sophos Fusion by entering the public IP addresses of each network
- Point DNS at Sophos: set your firewall or network DNS settings to forward to DNS Protection, or turn on the endpoint DNS Protection policy for Windows devices
- Set policies that block or allow domains by category or individually, and assign them to locations
- Install the DNS Protection root certificate in browsers if you want users to see an explanatory block page rather than a connection error
- Review logs and reports to confirm traffic is flowing through the service and see the most-queried and blocked domains
The service is IPv4-based but can resolve IPv6 addresses, so you do not need a separate IPv6 DNS server. Domains that SophosLabs flags as a threat or security risk are always blocked, whatever your own policies say.
Platform support: Windows, Mac and servers
Sophos's current tech specs list Windows 10 and Windows 11, on Intel and ARM processors, for DNS Protection for endpoints, where the Sophos Endpoint agent intercepts DNS lookups and forwards them to the service over HTTPS. The endpoint DNS Protection policy lets you exclude specific domains and assign devices to locations, so the right filtering policy applies wherever the device is. Sophos lists Microsoft Entra ID, Okta and on-premises Active Directory as supported identity providers for endpoint DNS Protection.
Sophos does not list macOS for the endpoint DNS Protection policy. Mac users are still covered when they sit behind a protected network, and Sophos's documentation also describes configuring Macs to use DNS Protection directly with Secure DNS: you generate a DNS over HTTPS configuration profile from a location in Sophos Fusion and install it on the device. Sophos also publishes guidance for pointing Windows Server and third-party firewalls at DNS Protection. We check the latest support list before any rollout.
Reporting, XDR and threat hunting
The DNS Protection dashboard in Sophos Fusion shows a usage summary, a traffic graph and query counts for the top domains over the last seven days, and logs help you troubleshoot whether requests are reaching the service. Sophos also documents querying DNS Protection data with Live Discover, which means your team on Sophos XDR, or Sophos's analysts on Sophos MDR, can use it when investigating an incident: for example, to see which other devices looked up the same suspicious domain.
For controlling generative AI use specifically, rather than blocking domains, see Sophos AI Defense.
Sophos DNS Protection vs other DNS security
DNS filtering is a layer, not a complete web security service. It decides whether a domain may be resolved; it does not inspect the content of pages or files. Sophos covers deeper inspection through Sophos Firewall web protection and Protected Browser.
If you do not run Sophos Firewall or Sophos Endpoint, a standalone DNS security service may suit better. We also supply Cisco Umbrella DNS Security Essentials, a widely used alternative, and can compare the two for your estate.
How we help
We check whether you already have DNS Protection through an Xstream Protection firewall subscription, set up locations and policies, roll out endpoint DNS Protection to Windows devices through Workspace Protection, and tune categories so you block risk without blocking work. DNS filtering is a useful extra layer alongside the technical controls in Cyber Essentials, though it does not replace any of them.
Contact us for setup help or a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos DNS Protection free?
Not on its own; it comes as part of other subscriptions. Network DNS Protection is included with the Sophos Firewall Xstream Protection subscription, and endpoint DNS Protection is included with Sophos Workspace Protection. Fair use limits apply.
Does Sophos DNS Protection work on macOS?
Sophos lists Windows 10 and 11 for the endpoint DNS Protection policy, not macOS. Macs are covered behind a protected network, and Sophos documents configuring Macs to use DNS Protection directly through a Secure DNS (DNS over HTTPS) configuration profile.
Does Sophos DNS Protection support DNS over HTTPS?
Yes. Sophos's licensing documentation says both the Xstream Protection and Workspace Protection licences include DNS over HTTPS, and on Windows endpoints Sophos Endpoint redirects DNS lookups over HTTPS to the service.
What is the difference between DNS filtering and web filtering?
DNS filtering decides whether a domain name can be resolved, which blocks connections to bad domains for any app or protocol. Web filtering inspects web traffic in more detail, such as specific URLs and content. Most organisations use both.
Do I need Sophos Firewall to use Sophos DNS Protection?
No. You can protect Windows endpoints through Sophos Workspace Protection without a Sophos Firewall. The firewall route is the way to cover every device on a network, including unmanaged ones.