- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
OpenText Core DNS Protection
A laptop on hotel Wi-Fi, a browser with its own encrypted resolver. Your firewall never sees the lookup — OpenText Core DNS Protection, formerly Webroot DNS Protection, checks every lookup against 78 categories — through a Windows agent that speaks DoH, or by forwarding a whole site’s DNS to its resolvers.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The OpenText platform family
This page covers OpenText Core DNS Protection — DNS filtering for devices and networks, formerly Webroot DNS Protection. The rest:
Quick facts
30-second orientation- Product
- Cloud DNS filtering for devices and networks, run from the OpenText management console
- Maker
- Open Text Corporation, Waterloo, Ontario; NASDAQ and TSX: OTEX; CEO Ayman Antoun since April 2026
- Lineage
- Built as Webroot DNS Protection; Webroot joined Carbonite in 2019, then OpenText bought Carbonite
- Price
- Not published: quoted by OpenText or an MSP; a 30-day trial runs from the console
- Coverage
- Windows agent for roaming devices; any device on a network that forwards DNS to the resolvers
- Encrypted DNS
- The agent resolves over DoH and can block other DNS on ports 53, 443 (known DoH) and 853
- Categories
- 78 BrightCloud categories, seven of them security risks such as malware, botnets and spyware
- Reporting
- Category history kept 13 months; top blocked and requested domains 90 days
- India
- No Indian resolver location is published; ask which resolvers your offices would use
- In India via
- TechBag — site and user sizing, pilot design, quote in INR with GST, MSP hand-off
Understand DNS filtering before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is DNS filtering?
Every connection starts with a DNS lookup. A filtering resolver refuses to answer for malicious or unwanted domains, so the connection never starts.
Router DNS and firewall rules vs OpenText Core DNS Protection — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Router DNS and firewall rules | OpenText Core DNS Protection |
|---|---|---|
| A browser using its own DoH resolver | Lookups bypass the firewall unseen | Leak Prevention blocks DoH and DoT side doors |
| A laptop working from home | Unfiltered once off the office network | The Windows agent filters it on any network |
| Printers, phones and guest Wi-Fi | Need an agent each, so get none | Covered by forwarding the site’s DNS |
| A domain wrongly blocked | Edit each firewall or router by hand | One override, global or per site, in ~15 minutes |
| Who looked up what, last quarter | Router logs, if anyone kept them | 13 months of category reports in the console |
| What it is NOT | — | A proxy, TLS inspection, CASB, or a listed Indian resolver |
The cheapest test is the 30-day trial: forward one office’s DNS, put the agent on ten laptops, and read the security-risk report a week later.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Agent
The agent points the adapter at loopback, sends outside lookups to the resolvers over DoH, and leaves Active Directory names to your local DNS servers.
Network
Register a site’s public IP, or a dynamic-DNS name, then set the router or Windows DNS forwarders to the primary and secondary resolvers for your region.
Resolve
Resolvers answer on port 53 or DoH and check each domain against BrightCloud categories; a 2020 datasheet says they are hosted on Google Cloud.
Console
One console per site holds DNS policies, allow and block overrides, privacy settings and reports, beside Core Endpoint Protection where it is also used.
A Windows agent or a site forwarder — every lookup goes to filtering resolvers, every policy lives in one console.
Nine capabilities. Filter, enforce, govern.
OpenText Core DNS Protection stops bad domains at the lookup, on the laptop or across the whole site.
Seven threat categories
Malware sites, phishing and fraud, botnets, spyware and adware, keyloggers, proxy avoidance and spam URLs are blocked by policy.
78 categories in all
Gambling, adult, streaming, social and dozens more sit beside the security set; High and Medium starter policies are provided.
Search and YouTube locked down
DNS rewrites force SafeSearch on Google, Bing and DuckDuckGo, and YouTube Restricted Mode in a moderate or strict setting.
Lookups leave encrypted
The Windows agent sends outside lookups over DoH and reverts any change to the adapter’s DNS settings while its service runs.
No side doors on 53, 443, 853
Blocks plain DNS, known DoH providers and DoT so every lookup is filtered; it needs agent 4.2 or later on Windows 10 or newer.
Guests and IoT, no agent
Register a static IP or a dynamic-DNS name and forward to the resolvers; phones, printers and guest Wi-Fi are then filtered too.
Allow and block lists
Global, site or policy overrides take wildcards and up to 50 domains an entry; changes apply within about 15 minutes.
Thirteen months of history
Category reports keep 13 months, top blocked and requested domains 90 days, and the security-risk view 30 days.
Hide users, echo to the SIEM
Hide User Information masks names in logs, Local Echo copies lookups to your own resolver, and Fail Open keeps DNS up in an outage.
Watch OpenText Core DNS Protection in action
Dynamic DNS detection, Leak Prevention, the MSP case and an engineering deep dive — all from the official Webroot channel, recorded between 2021 and 2024 under the former Webroot DNS Protection name.
DNS Protection's Dynamic DNS Detection
How the service spots unapproved authoritative DNS servers, filmed under the former Webroot name.
Webroot DNS Leak Prevention
The setting that blocks plain DNS, DoH and DoT around the agent, shown in 2024 before the OpenText rebrand.
Webroot DNS Protection: Purpose-built for MSPs
Why the product was designed for managed service providers, from the Webroot era.
Webroot DNS Protection: Technical Deep Dive
An hour-long engineering session on the agent, resolvers and policies, recorded under the Webroot brand.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Encrypted DNS is quietly routing around your filters. Core DNS Protection filters the lookup and shuts the side doors.
Here’s what genuinely sets it apart — and exactly where it stops.
Encrypted DNS is filtered, not just blocked
Browsers and apps now send lookups over DoH, which a firewall cannot read. The agent sends its own queries to the resolvers over DoH, and Leak Prevention shuts plain DNS, known DoH providers and DoT around it, so a browser’s private resolver cannot skip the policy. It needs agent 4.2+ on Windows 10 or newer.
Two ways in, one policy
Laptops get the Windows agent, deployed by MSI or switched on in a Core Endpoint Protection policy. Everything else on a site — phones, printers, guests, cameras — is covered by registering the office’s public IP and forwarding DNS to the resolvers. Both draw on the same categories, overrides and reports in one console.
Made for MSPs running many small sites
The console’s MSP view has a site list, global overrides every site can inherit, and per-site keycodes and trials. One MSP quoted on OpenText’s page says its clients’ help-desk calls fell by almost 40%. Logs can hide user names, or be echoed to a local resolver for a SIEM.
Where it stops
It filters by domain only: no proxy, no TLS inspection, no CASB. The documented agent is Windows; Macs and phones rely on network forwarding. No price or Indian resolver is published. OpenText keeps its SMB and consumer security line, which includes this product, outside its core and is divesting non-core units; ask about the roadmap.
The numbers behind the platform
What your OpenText Core DNS Protection rollout looks like
List sites, IPs and devices
Count Windows laptops, other devices and each site’s public IP or dynamic-DNS name, and note your Active Directory domains.
Pick resolvers and test them
Choose each site’s region in the console, run nslookup against both resolvers, and ask OpenText where they are hosted.
Trial on one site
Start the 30-day trial, apply the High policy, add AD domains to the bypass list and deploy the agent to a pilot group.
Close the side doors
Turn on Leak Prevention, add allow overrides for blocked business apps, and check the security-risk report daily.
Forward every site
Point each site’s forwarders at the resolvers, roll the agent out through endpoint policy, and schedule monthly reports.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We turned on DNS in the endpoint policy and the agent rolled out with the next check-in. No separate deployment project at all.”
“Leak Prevention ended the problem of browsers using their own DoH resolver. Our block page finally shows up on every laptop.”
“Guest Wi-Fi and the CCTV recorders are filtered by forwarding alone. We registered the office IP and changed two forwarders.”
“Global overrides save us hours: one allow entry for a client’s accounting portal reaches all forty sites within fifteen minutes.”
“Thirteen months of category history settled an HR question about streaming at work that a 30-day log never could have.”
“Fine for Windows, but our Mac designers are only covered in the office. Off-site they need another tool, so plan for that.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the secure web and DNS market — tap any vendor to see why it sits where it does.
TechBag Secure Web & DNS Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quoted, usually by an MSP; no price published.
Ease of Adoption × Inspection Depth
The grid nobody publishes — how easily you can buy and switch it on alone vs how deep into the traffic it can see.
DNS only; Windows agent or forwarding, sold standalone.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
OpenText Core DNS Protection vs the secure web and DNS field
Against Cisco Umbrella, Cloudflare One Gateway, Zscaler Internet Access, Netskope Next Gen SWG and Palo Alto DNS Security — on layer, roaming, encrypted DNS, price, logs and India.
| Dimension | OpenText Core DNS Protection | Cisco Umbrella | Cloudflare One (Gateway) | Zscaler Internet Access | Netskope Next Gen SWG | Palo Alto DNS Security |
|---|---|---|---|---|---|---|
| What it is | MSP-sold DNS filter | DNS layer, then SIG | DNS inside a SASE | Cloud proxy first | Instance-aware proxy | Firewall subscription |
| Enforcement layer | DNS only | DNS, proxy at SIG | DNS, HTTP, network | Full inline proxy | Full inline proxy | DNS on the firewall |
| Deployment and roaming | Windows agent + forward | Point DNS + client | Resolver IPs or WARP | Client or tunnels | Client or tunnels | Needs the platform |
| Encrypted DNS control | Blocks 53, DoH, DoT | DoH/DoT category | Own DoH and DoT | Inspects DoH inline | Tunnel blocking | Firewall policy |
| Categories and intelligence | 78 BrightCloud cats | Talos + OpenDNS | Cloudflare network | Zero Trust Exchange | App-instance aware | DGA and tunnelling |
| Pricing model | Quoted, often by MSP | Per user, by tier | Per user a month | Per user, by edition | Per user, platform | Per firewall SKU |
| Published entry price | Not published | ~$30–40/user/year | Free; then $7/user/mo | ~$6–12/user/month | Not published | Not published |
| Included vs add-on | All features inside | Proxy at higher tiers | DNS in the free tier | Editions add depth | Modules by licence | Separate SKUs |
| Reporting and logs | Up to 13 months | Export to S3 | 24 h free; 30 days paid | Stream to your SIEM | Stream to your SIEM | On firewall or cloud |
| Integrations and admin | MSP console, API | Cisco and Meraki | Cloudflare One stack | Zero Trust Exchange | Netskope One stack | Strata management |
| India resolver or PoP | Not documented | Chennai, Mumbai sites | Six Indian cities | Indian data centres | Mumbai, Chennai, Delhi | Your own firewall |
| Support and trial | 30-day trial | Free trial | Free up to 50 users | Trial on request | Trial on request | Partner evaluation |
| Lock-in and exit | Stop service, reverts | Repoint DNS | Monthly, change DNS | Unwind tunnels, client | Platform-bound | Tied to firewalls |
| Best fit | MSPs with Windows fleets | Start at DNS, grow | Price-led, India-near | Deep inspection | SaaS tenant control | Palo Alto estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose OpenText Core DNS Protection if…
- ✓Your MSP already runs Core Endpoint Protection, so DNS filtering is a policy switch rather than a new rollout
- ✓Browsers and apps using their own DoH resolvers are slipping past the filters you have today
- ✓You need guests, printers and IoT on each site filtered by forwarding, with no agent to install
Compare alternatives if…
- ✓Resolvers must be documented in India — Cloudflare lists six cities; Netskope and Cisco publish Indian sites
- ✓You need a published price before a call — Cloudflare prints one
- ✓Macs and phones must be filtered off-site, or content inspection is the real need — Umbrella, Cloudflare or Zscaler
Do not expect…
- ✓A price list, INR billing or a documented Indian resolver
- ✓Proxy inspection, TLS decryption or CASB — this is DNS filtering
- ✓A documented macOS or mobile agent for roaming devices
OpenText Core DNS Protection is one of 44 secure web & dns products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What does an unfiltered DNS layer cost you?
Drag the sliders (users whose devices are filtered; admin-hour cost). Estimates model IT time spent cleaning up after malicious-site visits, chasing unfiltered encrypted lookups and editing router blocklists by hand, at an assumed 1.5 hours per user a year, with 70% of it removed by DNS-layer blocking and central overrides. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. OpenText publishes no price and no licence unit for Core DNS Protection: a site is switched on in the console with a paid keycode or a 30-day trial, and most buyers are quoted by OpenText or their MSP. Third-party listings show seat bundles that OpenText does not confirm. TechBag counts sites and devices first, then quotes in INR with GST.
30-day trial
Best for proving it on one site
- Full product, free for 30 days
- Started per site from the console
- Agent stops filtering when it lapses
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Full subscription
Best for MSP-run multi-site estates
- Quoted by OpenText or your MSP
- Agent and network filtering included
- Bought apart from Core Endpoint Protection
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
How many devices are Windows laptops that roam, and how will Macs and phones be filtered when they leave the office?
Are endpoints on Windows 10 or newer with agent 4.2+, so Leak Prevention can block DNS, DoH and DoT side doors?
Which resolver region will each site use? OpenText documents no Indian location, so measure latency before rollout.
Which internal domains must go on the bypass list so the agent hands them to your local DNS servers?
Does the brief need content inspection or CASB? If so, DNS filtering alone will not meet it — price a proxy too.
Should user names be hidden in logs, and does your SIEM need lookups echoed to a local resolver?
OpenText treats SMB and consumer security as non-core. What does the contract say if the product changes owner?
Does the quote state the licence unit, term, currency and support route? Ask about INR billing and add GST.
Questions buyers ask
Ready to evaluate OpenText Core DNS Protection?
Count your sites and Windows devices first, or let a TechBag advisor test the resolvers from your offices, run the pilot with Leak Prevention on and get the quote in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.