DNS
The DNS tab under Service Gateway: run the network on plain forwarding, or switch to Cloud DNS for filtering with blocklists, allowlists and rulesets.
The DNS tab under Service Gateway controls how the network resolves names. It has two modes, chosen with the DNS Mode switch on Basic Settings:
- Plain — ordinary DNS forwarding to your upstream resolvers, plus optional static host records. No filtering.
- Cloud DNS — a managed filtering resolver that applies your blocklists, allowlists and rulesets before answering.
Plain mode
Section titled “Plain mode”In Plain mode the DNS tab has two things to configure:
- Forwarders — the upstream resolvers the network forwards queries to.
- Custom Entries — static hostname-to-IP records for names the public DNS does not advertise (internal services, venue-local shortcuts, or a name you need to force to a specific IP for the sign-in flow).
To verify a custom entry, run dig <host> or nslookup <host> from a device in
the venue’s DHCP scope and confirm it returns the IP you configured. Per-query
logs are not surfaced in the Context admin, so dig / nslookup is the fastest
way to confirm resolution.
Cloud DNS mode
Section titled “Cloud DNS mode”Switch DNS Mode to Cloud DNS to turn the network into a filtering resolver. This unlocks blocklists, allowlists, scheduled rulesets and custom records, all managed from the same DNS tab. Cloud DNS has its own set of guides:
Cloud DNS overview
Switch a network to filtering and learn the tabs.
Blocklists and allowlists
Subscribe to lists, build your own, and set allow exceptions.
Rulesets
Combine lists, choose an audience, and schedule the policy.
Custom DNS records
Point an internal hostname at an IP.