Skip to content
Support
Cloud DNS (add-on)

Cloud DNS overview

What Cloud DNS is, how to switch a network from plain DNS to filtering, and the tabs you use to manage it.

Cloud DNS turns a network from plain DNS forwarding into a managed, filtering resolver. Every lookup is checked against the policy you set before it is answered: blocked domains do not resolve, allowlisted domains always do, and rulesets decide which part of the network a policy covers and when.

Cloud DNS is part of the Service Gateway integration. You configure it on the DNS tab of your Sign In context’s Service Gateway settings, alongside DHCP, IPsec and BGP.

Requirements

Section titled “Requirements”
  • A Sign In context delivered through the Service Gateway integration.
  • Network DNS routed through the Service Gateway, so lookups reach Cloud DNS.

Plain vs Cloud DNS

Section titled “Plain vs Cloud DNS”

The DNS tab has a single mode switch:

  • Plain keeps the network on ordinary DNS forwarding. You can set upstream resolvers and a few static host records, but no filtering is applied.
  • Cloud DNS serves the network from a managed filtering resolver that applies your blocklists, allowlists and rulesets before answering.
The DNS tab showing the Plain and Cloud DNS mode switch, upstream forwarders, and the filtering sub-tabs
Cloud DNS Basic Settings: the mode switch, upstream forwarders, and the filtering tabs.

Turn on Cloud DNS

Section titled “Turn on Cloud DNS”

  1. Open the DNS tab

    In your Sign In context, open the Service Gateway settings and select the DNS tab. It opens on Basic Settings.

  2. Switch DNS Mode to Cloud DNS

    Under DNS Mode, choose Cloud DNS and confirm. This is a live change: the network moves onto the filtering resolver as soon as you confirm.

  3. Set the upstream resolvers

    Under Primary Forward and Secondary Forward, set the upstream resolvers Cloud DNS uses for lookups it does not block, then click Update Configuration.

Switching to Cloud DNS reveals the filtering tabs. Each one is covered in its own guide:

  • Custom Entries — static host-to-IP records. See Custom DNS records.
  • Remote Blocklists, Custom Blocklists and Allowlists — the lists you filter with. See Blocklists and allowlists.
  • Rulesets — the policies that combine lists, an audience and a schedule. See Rulesets.

To return a network to ordinary forwarding, switch DNS Mode back to Plain and confirm.

Next

Blocklists and allowlists

Subscribe to remote blocklists, build your own blocklists, and keep an allowlist of domains that must always resolve.

Rulesets

Combine blocklists and allowlists into a policy, choose who it applies to, and put it on a weekly schedule.