- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Heimdal DNS Security – Network
Your offices are full of devices that will never run an agent. They still look up every domain through your DNS servers — Heimdal DNS Security – Network filters every device that uses your office DNS servers — PCs, guest phones, printers and IoT — by forwarding lookups to Heimdal’s resolvers, or by filtering on your own DNS server with Hybrid DNS.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Heimdal platform family
This page covers Heimdal DNS Security – Network — the agentless network filter, including Hybrid DNS. The rest:
Quick facts
30-second orientation- Product
- Agentless DNS filtering for networks: your DNS servers forward lookups to Heimdal’s resolvers
- Maker
- A Danish firm founded 2014 with HQ in Copenhagen; owned by Marlin Equity Partners since 2020; CEO Jesper Frederiksen
- Former name
- Threat Prevention Network, now sold as DNS Security – Network
- Price
- Not published; per device per year on Heimdal’s calculator, quote only, with a free trial
- Deployment
- Forward to 193.243.129.53 and 76.223.127.10, or run the Hybrid DNS LogAgent on your DNS server
- Coverage
- Any device using a forwarding DNS server, BYOD and IoT included; nothing follows laptops off-site
- Layer
- DNS only: no proxy and no TLS inspection; its “CASB” view is DNS-based app discovery
- Recognition
- No MQ or Wave; Heimdal’s awards page quotes 4.8/5 from Gartner Peer Insights reviewers
- India
- No Indian hosting: tenants live in EU, US or UK regions; the Mumbai team sells and supports
- In India via
- TechBag — resolver mapping, quote in INR with GST, bypass rules and a log-export plan
Understand network DNS filtering before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is network DNS filtering?
Your DNS servers ask a filtering resolver first, so a bad domain never resolves for any device behind them.
An ISP resolver and firewall blocklists vs Heimdal DNS Security – Network — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | An ISP resolver and firewall blocklists | Heimdal DNS Security – Network |
|---|---|---|
| Who gets filtered | Nobody; the ISP resolver answers everything | Every device that uses your DNS servers |
| IoT and guest devices | Unfiltered; nothing can be installed | Covered by forwarding, with no software |
| Dynamic-IP branches | Static IP or no service | Hybrid DNS filters on the local server |
| Finding the device | A NAT address in the firewall log | Internal hostname and IP from the LogAgent |
| Policy across sites | A blocklist per firewall, edited by hand | One dashboard of categories and lists |
| What it is NOT | — | A proxy, TLS inspection, roaming cover or an India region |
The cheapest test is the free trial: forward one office’s DNS to Heimdal for a few weeks and read which devices it blocks.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Resolvers
Your internal DNS servers forward outside queries to 193.243.129.53 and 76.223.127.10. Heimdal says these run on AWS but names no city; blocked domains get no usable answer.
Access Rules
Each office’s public address is registered as a /32, /31 or /30 Access Rule; wider ranges go through support, and an edit reaches the resolvers within about 30 minutes.
LogAgent
Optional: the LogAgent runs a filtering DNS server on loopback 127.8.8.1 inside a Windows Server 2012+ or Ubuntu 18.04+ DNS box, so dynamic IPs and any forwarder work.
Dashboard
Category blocks, allow and deny lists, the DNS-based app view Heimdal labels CASB, and query logs share one console with Heimdal’s other modules, plus a REST API.
Your DNS servers forward to Heimdal’s resolvers — or Hybrid DNS filters on the server itself and names each internal device.
Nine capabilities. Forward, filter, report.
Heimdal DNS Security – Network blocks bad domains for a whole office, with nothing installed on the devices.
Covers what cannot run an agent
Phones, printers, cameras, guest laptops and IoT kit are filtered just by using a DNS server that forwards to Heimdal.
Filtering on your own DNS server
The LogAgent filters on the DNS server itself, which drops the static-IP requirement and lets you keep the forwarder you prefer.
DoH from the server outward
A DoH setting sends the server’s own lookups to a chosen DNS-over-HTTPS resolver, so the upstream leg is not plain text.
Block whole categories at once
Entire categories of domains can be refused in one rule, with per-domain allow and deny lists for the exceptions you need.
Heimdal’s predictive engine
Heimdal claims 96% accuracy for Predictive DNS in spotting malicious domains; that is the vendor’s figure, not an independent test.
The list Heimdal calls CASB
Apps seen in DNS lookups are listed and can be blocked through the domain blocklist; no inline proxy or SaaS API sits behind it.
Which machine asked
With Hybrid DNS the LogAgent ties each lookup to an internal hostname and IP, so a blocked query points at a device, not a NAT address.
Hooks for MSP and network tools
Connectors for Cisco Meraki, Palo Alto, HaloPSA, Autotask PSA and ConnectWise RMM are listed, with a REST API for exports.
Pairs with the endpoint DNS agent
The same dashboard runs DNS Security – Endpoint, so laptops that leave the office keep a matching policy if you buy both.
Watch Heimdal DNS Security – Network in action
Network and endpoint DNS filtering under the product’s former name, Threat Prevention (2021), plus two DNS security explainers from 2024. All from Heimdal’s official channel.
Heimdal Threat Prevention Endpoint & Network - DNS Filtering
Network and endpoint DNS filtering side by side (under its former name, Threat Prevention).
DNS Security Best Practices – A Quick Guide for Organizations
Heimdal’s practical list for protecting an organisation’s DNS; a topic guide rather than a product demo.
DNS Security Explained in 30 Seconds
A half-minute primer on why stopping a bad lookup stops the connection that would have followed it.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Every device asks DNS before it connects. DNS Security – Network answers for the whole office.
Here’s what genuinely sets it apart — and exactly where it stops.
A whole site filtered with no rollout
Point your internal DNS servers at two Heimdal addresses and every device that relies on them is filtered: PCs, guest phones, printers, CCTV and IoT kit no agent will ever run on. Heimdal knows the office by its registered public IP, so nothing is installed on clients.
Hybrid DNS answers the dynamic-IP problem
Branches on broadband rarely keep one public address. Hybrid DNS moves the filter onto your own Windows Server or Ubuntu DNS server via the LogAgent, which needs no static IP, keeps your forwarder, and logs the internal hostname behind each lookup.
The same console as the endpoint stack
DNS – Network lives in the dashboard that also runs Heimdal’s endpoint DNS agent, patching, antivirus and XDR. Buy it alone for the office, or add DNS Security – Endpoint for laptops; it also plugs into Meraki, Palo Alto and the main MSP tools.
Where it stops
It decides on the domain name only: no proxy, no TLS inspection, and the “CASB” view is a list of apps seen in DNS. It cannot follow a laptop home. The resolvers run on AWS with no city named, customer data is held in an EU, US or UK region, and query-log retention is never stated.
The numbers behind the platform
What your Heimdal DNS Security – Network rollout looks like
Map every resolver in the estate
List each office’s DNS servers and public IPs, and note which IPs are static; dynamic-IP branches are Hybrid DNS candidates.
Register rules and forward one site
Add each static IP as a /32, /31 or /30 Access Rule, allow 30 minutes to propagate, then forward one site’s DNS to Heimdal.
Install Hybrid DNS where IPs move
Put the LogAgent on a Windows Server 2012+ or Ubuntu 18.04+ DNS server; check Npcap OEM against any Azure ATP sensor first.
Close the bypass routes
Block outbound port 53 and known DoH services at the firewall so devices cannot skip your forwarders, then tune the blocks.
Settle logs and the licence
Set up CSV or API log export for 180 days, decide whether laptops need the Endpoint module, and get the device count in writing.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We forwarded the head-office DNS servers on a Friday afternoon; by Monday the CCTV recorders were turning up in blocked-query logs.”
“Our branches sit on broadband with changing IPs. Hybrid DNS on each local Windows DNS server fixed that without a support ticket.”
“The LogAgent named the actual laptop behind a blocked lookup instead of the firewall’s NAT address. That alone saved hours.”
“Npcap clashed with the Azure ATP sensor on one domain controller, so we moved the LogAgent to a separate DNS server.”
“Guest Wi-Fi phones are filtered without any app, which was the whole point for our campus. Roaming laptops needed the endpoint module.”
“Blocking works well, but we export logs ourselves to keep 180 days for CERT-In; the retention period is not spelled out anywhere.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the protective DNS market — tap any vendor to see why it sits where it does.
TechBag Network DNS Filtering Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote per device a year; part of a 12+ product platform.
Agentless Reach × Inspection Depth
The grid nobody publishes — how many devices a product filters without an agent vs how far past the domain name it can look.
Forwarding or on-server Hybrid DNS; domain verdicts only.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Heimdal DNS Security – Network vs the protective DNS field
Set beside Akamai SIA, Cloudflare One Gateway, OpenText Core DNS Protection, Infoblox Threat Defense and Cisco Umbrella — on deployment, devices covered, inspection depth, encrypted DNS, price, logs and India.
| Dimension | Heimdal DNS Security – Network | Cisco Umbrella | Infoblox Threat Defense | OpenText Core DNS Protection | Cloudflare One Gateway | Akamai Secure Internet Access Enterprise |
|---|---|---|---|---|---|---|
| What it is | Network DNS filter | DNS tiers under SIG | Protective DNS family | Ex-Webroot DNS filter | SSE gateway, DNS too | Recursive DNS firewall |
| Deployment | Forwarders or LogAgent | Repoint DNS, Meraki | Cloud, NIOS, Endpoint | Forwarding + Win agent | Locations or WARP | Forwarders, then proxy |
| Devices covered | Site only, no roaming | Sites + roaming module | Seven-OS agent | Windows agent only | WARP on any device | Clients on five OSes |
| Inspection depth | Domain verdicts only | Proxy from SIG up | DNS layer only | Lookups only | Full TLS, CASB | Selective TLS proxy |
| Encrypted DNS | DoH upstream only | DoH/DoT category | Public DoH feeds | Agent blocks DoH, DoT | DoH per location | DoT in the client |
| Pricing model | Per device, per year | Per user by tier | Three tokens a device | Per-site keycodes | Per user, monthly | Quote by licence |
| Published entry price | No price | ~$30–40/user/yr | Not published | Not published | $0 to 50, then $7 | Quote only |
| Included vs add-on | Endpoint sold apart | Proxy costs a tier | Extras on tokens | One policy, all in | Three filter types | Licences stack |
| Scale and limits | /30 rules, AWS-hosted | Verified past 5,000 | 17,000-staff customer | Scale not verified | 330+ cities, verified | Carrier-scale DNS |
| Integrations | RMM, PSA, Meraki, API | Cisco and Meraki | Infoblox DDI | MSP console, Unity API | Cloudflare One stack | Connector, SD-WAN, IPsec |
| Logs and retention | Retention not stated | S3 export | 60-day viewer | 13-month reports | 24 h free, 30 days paid | Not documented |
| India presence | No Indian region | Mumbai and Chennai | Indian resolvers | No Indian city listed | Six Indian cities | No Indian city named |
| Lock-in and exit | Change two forwarders | Repoint and remove | Cloud easy, NIOS sticky | Agent stop reverts DNS | Harder once HTTP is on | Proxy adds exit work |
| Best fit | Offices full of IoT | Fast DNS, proxy later | Infoblox DDI shops | MSP Windows clients | Free start, Indian PoPs | DNS + risky-site proxy |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Heimdal DNS Security – Network if…
- ✓Every device on an office network must be filtered, including printers, cameras and guest phones that can never run an agent
- ✓Branches change public IPs, and Hybrid DNS on a local Windows or Ubuntu DNS server suits you better than static-IP registration
- ✓You already run Heimdal modules and want office DNS policy in the same dashboard, with the Endpoint agent for laptops later
Compare alternatives if…
- ✓You need named Indian resolver cities in writing — Umbrella, Infoblox and Cloudflare publish theirs
- ✓Web content must be inspected, not just domains — Cloudflare Gateway and Akamai SIA offer TLS-inspecting proxies
- ✓You want a printed price before talking to sales — Cloudflare lists $7 per user a month after 50 free users
Do not expect…
- ✓TLS inspection, file scanning or a real CASB; the “CASB” view is DNS app discovery
- ✓Protection for laptops once they leave the office, unless you add DNS Security – Endpoint
- ✓An Indian data region, a published price or an analyst Magic Quadrant placement
Heimdal DNS Security – Network is one of 44 secure web & DNS products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What do threats from unmanaged office devices cost you?
Drag the sliders (devices on your office networks; IT-security hour cost). Estimates model staff time spent cleaning up after malware callbacks and phishing clicks from office devices at an assumed 1.5 hours per device a year, with 70% of it removed by blocking malicious domains at the network’s DNS. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
No public figure exists. Heimdal’s quote builder shows DNS Security – Network on its own line, counted by device for each year of the term, and a free trial comes first. How a forwarding DNS server’s clients become a device count is not written down anywhere, so have Heimdal state the method. Roaming laptops need DNS Security – Endpoint, which is a second line. TechBag maps your sites and devices first, then quotes in INR with GST.
DNS Security – Network
Best for offices full of devices no agent reaches
- Forwarding, or Hybrid DNS on your server
- Per device per year, quoted
- Covers BYOD, IoT and guests on site
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Network + Endpoint
Best when laptops also leave the office
- Two line items in one dashboard
- Endpoint agent for Windows and macOS
- Matching policy on site and off
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
How will Heimdal count devices behind a forwarder for a per-device licence? Get the counting method in writing.
Is every site’s public IP static and no wider than a /30? Larger ranges go through support; dynamic ones need Hybrid DNS.
Do your DNS servers run Windows Server 2012+ or Ubuntu 18.04+, and is Npcap OEM safe beside your other agents?
Will the firewall stop clients using their own resolvers or DoH? No client-side DoH control is documented for this product.
Do laptops spend time off-site? This product covers only the network, so budget DNS Security – Endpoint for them.
Where will DNS logs live for CERT-In’s 180 days? Retention is not documented, so plan a CSV or REST API export.
Can your compliance team accept an EU, US or UK tenant? Heimdal has no Indian region and names no resolver city.
Do you need content inspection or a CASB? This product decides on domains only; a proxy gateway is a different buy.
Questions buyers ask
Ready to evaluate Heimdal DNS Security – Network?
Map your offices’ DNS servers and public IPs first, or let a TechBag advisor run a trial on one site and plan the bypass rules and log export.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.