Hosted DNS web filter for MSPs: one filter account for each of your clients
If you look after IT for several libraries, schools or small offices, you can run our managed DNS filter for all of them. Each client gets its own account with its own networks, rules, staff PINs, block page, reports and dashboard logins. We create the accounts for you.
Sell the filter to ten clients without building anything
We run the DNS filter and the category data behind it, so your work is creating accounts and agreeing policies. Each client ends up with its own rules, reports and dashboard login.
- Open one account per client and keep their networks apart.
- Point each client router at a single DNS address and you are live.
- Run every site from one dashboard instead of a stack of resolvers.
Who this guide is for
IT providers who want to offer web filtering as a service without running resolvers, appliances or agents. It fits best where clients need clear category rules, a simple staff bypass and a monthly record, more than deep traffic inspection.
If you build your own filtering product and need the category data itself, our MSP web filtering page covers licensing the database instead.
Library and school IT providers
Clients that must show a filter is in place and need a simple adult research bypass.
Small business MSPs
Offices that want adult, gambling or bypass sites closed on staff and guest Wi-Fi.
Community organization IT
Youth centres, churches and charities with shared public Wi-Fi.
One-person IT shops
Technicians who need a filter that clients' staff can mostly run themselves.
Two levels: client account and network
The filter keeps clients strictly apart. Everything a client configures lives inside its own account, and each account splits further into networks for sites or Wi-Fi.
Your logins
- One MSP login for all your clients
- You create client accounts yourself
- A client switcher at the top of every page
- Logins for client staff on request, limited to their own client
Client account
- Profiles and blocked categories
- Always allowed and blocked lists
- Branded block page
- Time zone and report recipients
- Client's own dashboard logins
Network
- A branch, a building or a Wi-Fi
- Its registered addresses
- Its own encrypted DNS link
- Its own staff page and PIN
- Its own lists and report line
The Overview page of each client
- Lookups and blocks for that client, with a recent trend
- Five readiness checks, such as whether the filter answered the client's network in the last 24 hours
- Blocks by category, so unusual activity stands out
- The place to start every check-in with that client
Working inside a client
- The same pages the client sees: Overview, Policy, Activity, Networks, Staff bypass, Reports, Import lists, Settings
- Changes apply to that client only, within seconds
- To work on another client, pick it in the client switcher at the top of the dashboard
Client logins see only their own account. They cannot see any other client, and every page they open is limited to their account's networks and settings. Your MSP login sees all of your clients and nothing else: never another provider's clients.
Onboarding a new client, step by step
Most onboardings follow the same eight steps. Plan about an hour for a single-site client, most of it agreeing the policy. Multi-site clients take longer mainly because each site's address has to be registered from that site, or by an administrator who knows it.
Create the client
In your MSP login, open Customers and add the client's name. The new account starts with a Main network and the CIPA standard preset.
Agree the policy
Go through the client's written policy and choose categories, SafeSearch and YouTube settings for each group of users.
Build profiles and networks
Create profiles from presets and one network per site or Wi-Fi. See profiles and networks.
Register addresses
Open each network page from the client site and add its public address. The filter only answers registered addresses.
Import old lists
Upload the client's allow and block lists from its previous filter, with a preview first. See importing lists.
Brand the block page
Add the client's name, logo, message and the support contact you want users to call.
Point the router
Set the client's router or firewall to hand out the filter as the only DNS server, and lock down outside DNS.
Hand over
Give the client its staff links and PINs, ask us for a client staff login if wanted, and add the director to the monthly report email.
What stays separate per client
Separation is the point of running clients as accounts. This table shows where each setting lives, so you know what a change in one place can affect.
| Setting | Lives on | Effect of a change |
|---|---|---|
| Blocked categories, SafeSearch, YouTube | Profile, inside one client | All networks of that client using the profile |
| Time schedules | Profile, inside one client | Same as above, in that client's time zone |
| Always allowed and blocked lists | Client account, or one network | That client, or that one network |
| Staff page and PIN | Network | That network only |
| Encrypted DNS link | Network | Devices set up with that link |
| Block page branding | Client account | All of that client's networks |
| Report recipients and time zone | Client account | That client's monthly email and schedules |
| Dashboard logins | Client account | People who can see and change that client only |
Each client also has its own time zone, so a client in another state gets schedules and month boundaries in its own local time.
Nothing is shared between clients. A list or a profile you build for one client has to be built again for another, which also means one client's change can never leak into another's network.
Six sites a client may ask you about, and how we file them
When a library, youth centre or office calls about one address, the category tells you which switch decided it. Here is what our data holds for six that come up often.
| Address a client mentions | Filed in our data as |
|---|---|
| roblox.com | Gaming |
| bet365.com | Gambling, Sports & Recreation |
| pokerstars.com | Gambling |
| tiktok.com | Social Networking, Streaming Media |
| twitch.tv | Streaming Media, Gaming |
| discord.com | Email and Messaging, Social Networking, Gaming |
Daily operations across clients
Once clients are live, most of the work is answering small requests. These are the ones MSPs handle most, and where to do them.
"This site is blocked by mistake"
Sign in to that client, search the site in Activity to see the reason, then add it to always allowed for the client or one network.
"Staff need adult research now"
The client's staff use their own staff page and PIN. You can also start or stop a bypass from the client's Staff bypass page.
"The filter stopped working"
Open that client's Overview page. A failed readiness check for the last 24 hours usually means a changed public address or a router change.
"A staff member left"
Change the PIN on the affected network, and create a new staff link if the old one was widely shared.
"We opened a new branch"
Add a network inside the client, register the branch address and give the branch its staff link.
"The board wants numbers"
Open the client's monthly report, or add the board contact to the monthly email under the client's Settings.
Reports per client
Each client account produces its own reports. You never have to cut a shared report apart before sending it to a client.
What each client gets
- A monthly activity report for all networks and for each network
- Lookups, blocks, block rate and staff bypass uses
- Blocks by category and the most blocked websites
- A table of every staff bypass with time, network and source
- CSV files and a printable page, plus an optional email on the first of the month
How MSPs use them
- Add your support address next to the client's director as a recipient
- Use the by-network table in quarterly reviews
- Spot wrong blocks from the most blocked websites list
- Show that the research bypass is used, and used sparingly
- Keep the CSV files in the client's documentation folder
Details of every section are in the monthly filtering reports guide.
Who does what: you, the client and us
A clear split of roles keeps support calls short. This is a split that works well; adjust it in your own client agreements.
| Task | MSP | Client staff | Us |
|---|---|---|---|
| Create client accounts | Creates in the MSP login | Sets up your MSP login | |
| Policy, profiles, schedules | Sets up and changes | Agrees the policy | Advises on request |
| Router and device settings | Configures | Provides the steps | |
| Adult research bypass | Rotates PINs | Uses the staff page | |
| Wrongly blocked sites | Adds to always allowed | Reports them | Reviews category labels you send us |
| Monthly reports | Reviews, adds recipients | Receives | Sends the email |
| Running the filter service | Operates resolvers and dashboard |
Start with one pilot client
The fastest way to judge the service is one real client with one or two sites. A pilot shows how your team and the client's staff get on with the dashboard before you plan a wider rollout.
Pick a friendly client
A client with a fixed public address, a known policy and staff who will tell you what they notice.
Run it alongside first
Point one test device at the new filter with its encrypted link while the old filter keeps running for everyone else.
Switch one network
Move one network's router to the filter during a quiet hour and watch Activity for the first day.
Collect the requests
Note every unblock request and bypass question in the first two weeks. They show where the policy needs tuning.
Read the first report
The first monthly report gives you numbers to discuss with the client and a template for your other clients.
Write your runbook
Turn what you learned into a short onboarding checklist for the next client.
Material to hand each client
A one-page handover per client prevents most early calls. Keep it short and keep the PIN off anything that patrons or students can see.
For the client's staff
- The staff page link for each network, to bookmark
- The PIN, handed over in person or by a private channel
- What the bypass opens and what it does not
- That secure sites show a browser warning when blocked
- Who to contact for a wrongly blocked site
For the client's director
- Which categories are blocked on which network
- The printable policy record from the Reports page
- When the monthly report email arrives and who gets it
- A dashboard login of their own, which we create on request
- Your support contact and hours
Network setup at client sites
The filter works at the DNS level, so the setup is the same at every client: send DNS to the filter, keep other DNS out.
At the router or firewall
- Hand out the filter as the only DNS server by DHCP
- Allow outgoing DNS only to the filter
- Block DNS over TLS to other servers
- Register the site's public address on its network page
On managed devices
- Turn off the browsers' own encrypted DNS by policy
- Use the network's encrypted DNS link on laptops that travel
- Keep public PCs locked so VPN apps cannot be installed
- Test once from each network after any change
The filter adds its own protections: unknown addresses are refused, public encrypted DNS services and VPN sites are blocked, and browsers are told to switch off automatic encrypted DNS. Background: encrypted DNS and web filtering.
Laptops and phones outside the client network keep the same rules
A private encrypted link carries the client policy to devices that leave the building, and to networks where a provider redirects DNS. You manage it in the same account, with nothing installed as an appliance or agent.
Limits to plan for
Know these before you put the service in a client contract. They come from DNS filtering itself or from how the service works today.
Writing them into your service description up front saves awkward conversations later, and helps clients choose the right extra layers, such as device management or a separate security service.
Domain level only
DNS filtering never sees full URLs, so rules apply to whole websites, not single pages or videos.
HTTPS warnings
Blocked secure sites show a browser certificate warning before any block page. Tell clients' staff to expect it.
Addresses must be registered
A client whose provider changes its public address is refused until the new address is added. Fixed addresses make life easier.
No per-person rules
Rules apply per network. Staff and guests on one shared address need separate addresses or encrypted links to get different rules.
No security feed
The filter blocks by content category. It is not a malware or phishing protection service; keep your security stack for that.
No monitoring
It records website lookups per network. It does not watch messages, keystrokes or behaviour.
Hosted filter or your own build
Some MSPs run their own resolvers and buy category data; others want a finished service. Both are possible with us. This comparison helps you choose per client base.
| Question | Hosted filter (this page) | Your own build with our data |
|---|---|---|
| What you run | Nothing but client routers | Resolvers, policy engine, dashboard |
| Client dashboard | Included, with staff bypass, reports and branding | You build or buy one |
| Category data | Built in and kept current by us | Licensed files and lookup API |
| Best for | Libraries, schools and small offices with simple needs | MSPs with their own security platform and engineers |
| Where to read more | The guides linked on this page | MSP web filtering and the web filtering database |
Hosting resolvers for every client or using our managed filter
Both give a client web filtering, but they load very different work onto your own team.
| What you need to deliver | Running resolvers yourself | Our managed filter |
|---|---|---|
| Keeping client rules apart | You build and maintain the separation | One account per client with its own networks and lists |
| Category data | You license it and keep it current | Same database we license to security vendors, already attached |
| Policy change at a site | Edit config and reload servers | Switch a category and it applies in seconds |
| Staff who need adult research | Custom exception handling | PIN bypass for 15, 30 or 60 minutes, logged and reverting |
| Month-end paperwork | Assemble logs by hand | Activity reports and CSV exports per client |
| Hardware at the client | Often an appliance or agent | No appliance and no agent |
MSP questions
Can our clients log in to see their own filter?
Yes. Each client can have its own login that sees only that client's account. It never sees other clients.
Do we need to install anything at client sites?
No appliance and no agent. Point the router at the filter and register the public address. Single devices can use an encrypted DNS link.
Does each client site get its own staff PIN?
Yes. Every network has its own staff page and PIN, and a bypass applies to that network only.
Can the block page show the client's name instead of ours?
Yes. It is branded per client account with the client's name, logo, message and contacts.
How do client reports work?
Each client account has its own monthly report per network and for all networks, as a page and CSV, with an optional email to up to 10 addresses.
How are new client accounts created?
We create them with you. A new account starts with a Main network and the CIPA standard preset.
Can we copy one client's policy to another?
Not with one click. Use the presets as a common starting point, then copy a client's lists from its Policy page into a text file and import that file into the next client.
Can we give a client's own IT person access?
Yes. Ask us and we add a login for anyone the client names. It sees and changes only that client's account, so you can share day-to-day list edits with them.
What happens if a client leaves us?
Tell us and we will close the account at the date you agree with the client. Point the client's routers to their new DNS before that date, and download any reports the client wants to keep.
Do client networks share an IP address with others?
No sharing is needed on your side. Each client site registers its own public address, and the filter refuses addresses that are not registered to any client.
How is the service priced for MSPs?
We quote per deployment, based on the number of clients and sites. Tell us your client mix and we will come back with a proposal.
We quote by how many sites and devices your clients run. Put one friendly client on a pilot first and you will see the blocks and the reports before you commit to the rest.
Bring your first client
Tell us how many clients and sites you look after and what they use today. We will set up your first client account with you and walk through the dashboard.
More guides: staff bypass PIN · branded block page · time schedules · DNS filtering for business
YouTube is a trademark of Google LLC. It is used here only to identify the service discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by its owner.