Skip to content
Let’s talk
Menu

DOH · SECURE DNS, ANYWHERE

Your company’s DNS.
On every machine, everywhere.

DoH is a managed agent for employee machines. It gives your team your company’s own secure DNS on any network, over encrypted DNS-over-HTTPS. Internal names keep working too, with no VPN.

Request a demo How it works
DoHPROTECTION STATUS
DoH desktop dashboard: protection enabled, DNS routed through the local agent to the upstream DNS, and all five activation steps ready.
The desktop dashboard: protection status and activation chain.Enlarge screenshot (opens in a new tab)
Your DNS, on any network
  • Encrypted DNS
  • Policy-based routing
  • Managed centrally

THE PROBLEM

Outside the office, DNS is out of your hands.

Away from the office, every machine uses whatever DNS
the local network hands out. DoH brings it back to you.

Today: whatever the network gives

  • Machines use the DNS of any network they join.
  • Plain DNS on hotel and café Wi-Fi can be read or changed.
  • Your company’s DNS policy stops at the office door.
  • The usual fix, a full-tunnel VPN, is slow and sends all traffic through the office.
  • Third-party DNS clients cost licence fees and can’t be managed centrally.

With DoH: your DNS, everywhere

  • Every machine uses your company’s own DNS, on any network.
  • Lookups are encrypted inside standard HTTPS.
  • Internal names resolve too, with no VPN to connect.
  • IT sets policy once, for every enrolled machine.

HOW IT WORKS

Capture. Decide. Deliver.

Your company DNS server is never exposed to the internet.

  1. 01

    Capture

    The agent on each machine catches every DNS lookup.

  2. 02

    Decide

    Your policy decides where the lookup goes, and whether the machine is outside the office.

  3. 03

    Deliver

    The lookup goes over encrypted HTTPS to your hub, then to your company’s DNS. The answer returns the same way.

Employee machineDoH agent
Encrypted DoH
Your hubYour DoH endpoint
Private network
Company DNSNo public access
Employee machineIf policy allows
Untouched
Local networkOther lookups
Your policy sends every lookup to company DNS, or only your company’s domains while the rest resolve on the local network.

Smart enough to know where it is. In the office, DoH steps aside and lets your local DNS servers answer. Once the machine leaves the office, it takes over again on its own, with nothing for anyone to switch.

THE SOLUTION

What DoH does.

  • Your company’s own DNS on every employee machine.
  • Encrypted DNS, even on public Wi-Fi.
  • Works the same in the office, at home and on the road.
  • Internal company names resolve without a VPN.
  • One policy for every machine, managed centrally.
  • A simple status app for employees.

WHO IT’S FOR

One agent. Three teams covered.

Administrators manage every machine from one console, employees get DNS that just works, and security gets one DNS policy on every network.

For IT admins

  • Manage every machine from one web console.
  • Organize machines to match how your company is structured.
  • Set the DNS policy your machines follow.
  • Enable, disable or revoke a machine at any time.
  • See every admin action in the audit log.
  • Users can’t change managed settings.

For employees

  • Secure company DNS at home, on the road or in the office.
  • Internal sites work too, with no VPN to connect.
  • A simple status app in the system tray.
  • Clear alerts when something needs attention.

For security teams

  • DNS is encrypted on every network.
  • One DNS policy, in the office and out of it.
  • Your company DNS server stays private.

WHAT YOU GET

Four parts, one managed service.

Endpoint agent

Runs quietly in the background on each machine and starts with the system.

Desktop dashboard

A native app with a tray icon: protection status, setup, DNS activity logs, settings and alerts.

Admin console

A web app for administrators: machines, DNS policy, your company’s structure, and the audit log. In English, French and Arabic.

Hub

Your encrypted DNS entry point. It sends each customer’s lookups to their own DNS. Hosted by you and kept up to date.

Platforms

  • WindowsSigned installer
  • LinuxSigned package
  • macOSComing soon
  • iOSComing soon
  • AndroidComing soon

BUILT TO BE TRUSTED

Safe to roll out. Clean to remove.

  • Signed installers on Windows and Linux. Uninstalling restores the machine’s original DNS settings.
  • Admin actions are recorded in an audit log.
  • Your company DNS server stays private, with no public inbound access needed.

FAQ

Questions we hear often.

Something else on your mind? Our team is happy to walk through your setup.

Ask a question
Which lookups go to our company DNS?

Your policy decides: every lookup, or only your company’s domains while everything else resolves on the local network.

Does it replace our VPN?

For DNS, yes: machines reach your company DNS, internal names included, without connecting a VPN. DoH handles DNS only, so keep your VPN for any other traffic your policy requires to go through the office.

Can the local network see our lookups?

No. Lookups sent to your company DNS are encrypted between the machine and your hub, so hotel, café or home networks can’t read or change them.

What happens in the office?

On the trusted office network, the agent steps aside and leaves DNS to the company’s local servers. It switches to DoH automatically when the machine leaves.

Can employees turn it off or change settings?

No. IT sets policy in the admin console. Users can view the managed settings in the desktop app but can’t change them.

Does our DNS server need to be on the internet?

No. The hub is the only entry point. It forwards lookups to your company DNS, which needs no public inbound access.

Which platforms are supported?

Windows and Linux today, with signed installers. macOS, iOS and Android are coming soon.

SEE IT ON YOUR NETWORK

Your DNS, on every machine.

Tell us about your sites, machines and DNS setup. We’ll show you DoH running against your own DNS.

Request a demo