Atlas Resolve filters DNS on the devices that run the Atlas Reach agent, including your session hosts. You set one policy for the tenant and override it per host pool: block threat categories, keep your own always-allow and always-block lists, enforce SafeSearch and send lookups upstream over encrypted DNS. The fleet overview shows which devices are enforcing, which need attention, and whether anything is getting around the filter. Atlas Resolve is included with Atlas Reach and uses no units of its own: filtering DNS on a device adds nothing to that device's Atlas Reach unit.
Key capabilities
- Tenant-wide policy with per-host-pool overrides: the most specific policy wins
- Security categories enforced today: malware, phishing, botnet command and control, and cryptomining
- Content categories such as adult, gambling and social media, drawn from open community lists with partial coverage; newly registered domains are coming soon
- Always-allow and always-block lists that cover subdomains; allow always wins
- Blocked sites answered as "does not exist" or sent to your own block page
- SafeSearch enforcement and encrypted upstream DNS over DoH or DoT (Quad9, Cloudflare, Google or your own)
- Bypass protection: lock DNS settings, turn off browser secure DNS, block other DNS servers
- Fleet overview of enforcing, degraded and not-reporting devices, per host pool, with leak detection and CSV export
How Atlas Resolve™ works
- Install the Atlas Reach agent on your devices and session hosts
- Turn filtering on for the tenant or a host pool and choose categories and lists
- Atlas pushes the policy to connected agents straight away; offline devices pick it up when they reconnect
- The agent filters lookups locally and forwards allowed ones over encrypted DNS
- Devices report their status every 15 minutes
Available on: Community plan and above
Atlas Resolve™ is included in every Community subscription.