Build filtering policies as simple or complex as your organization requires. Assign rules per user, group, network, device, or location with time-based scheduling, override capabilities, and seamless Active Directory integration.
Build Your First PolicyOur policy engine gives administrators the flexibility to enforce acceptable use policies, security baselines, and regulatory requirements across any network architecture.
Assign distinct filtering policies to individual users or groups synced from Active Directory, LDAP, or Azure AD. Marketing teams can access social media while finance departments maintain stricter controls. Policies follow users across devices and locations.
Apply policies based on source IP, subnet, VLAN, or location identifier. Guest WiFi networks can have different rules than corporate LANs. Branch offices can inherit headquarters policies or maintain their own configuration.
Schedule policies to activate during specific hours, days of the week, or date ranges. Allow streaming media during lunch hours, enforce strict filtering during exams, or relax rules on weekends. Multiple schedules can layer on top of base policies.
Designated administrators and power users can bypass filtering for specific categories using time-limited override tokens. All overrides are logged with the user identity, reason, and duration for full audit trails.
Start from pre-built templates for common environments: K-12 schools, higher education, healthcare, enterprise, guest WiFi, and BYOD. Templates follow industry best practices and can be customized to fit your specific requirements.
Sync users and groups from AD, Azure AD, or LDAP automatically. Policy assignments update in real-time when group memberships change. Nested group inheritance is fully supported for complex organizational structures.
See how real organizations configure their filtering policies to meet different needs across departments and user groups.
When a DNS query arrives at our resolvers, the policy engine evaluates it through a deterministic rule chain to produce an allow, block, or redirect decision in under a millisecond. The evaluation order ensures that security rules always take precedence over permissive policies.
First, the query is matched against global security policies that block known content risks regardless of any user-level overrides. Then, user identity is determined through client IP mapping, authenticated tokens, or roaming agent identification. The user's group memberships and associated policies are loaded from cache.
Each applicable policy rule is evaluated in priority order. Time-based conditions are checked against the user's local timezone. Category-based rules are evaluated against all categories assigned to the requested domain. The first matching rule determines the action.
If no explicit rule matches, the default action for the policy applies. Administrators configure whether the default is permissive (allow unless blocked) or restrictive (block unless allowed) depending on their security posture.
Policy decisions in under 1ms with cached rule sets distributed to edge resolvers
Stack multiple policies with clear priority ordering and inheritance
content blocking rules always take precedence over permissive policies
Every policy change is versioned with who, when, and what was modified
From simple single-policy setups to complex multi-tenant configurations, our policy engine scales to match your needs. Start with a template and customize from there.
Check Domain See Plans