SafeDNS Agent: Complete Setup and Best Practices Guide

2. Deploy via Group Policy, SCCM, Intune, or other endpoint management tools.

macOS:

1. Mount the DMG or run the PKG as an administrator.
2. Provide the organization token when prompted or pass it via installer flags for automated deployment.
3. Approve any kernel extensions or system extensions if required by macOS (System Settings → Privacy & Security → Allow).
4. For mass deployment, use Jamf, Munki, or Apple MDM to push the PKG with silent install options.

4. Post-install registration and checks

1. Verify the agent appears in the SafeDNS dashboard under Devices or Agents.
2. Ensure the device shows the correct policy assignment.
3. Confirm DNS queries are routed through SafeDNS (see verification steps below).

5. Verification and troubleshooting

Verification:

• On Windows, run:

Code
 ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf” data-copycode=“true” role=“button” aria-label=“Copy Code”>Copy CodeCopied
nslookup example.com 

and confirm the DNS server returned matches SafeDNS resolver IPs, or check the agent status in system tray.

• On macOS, run:

Code
Copy CodeCopied
scutil –dns 

or:

Code
Copy CodeCopied
dig example.com 

and confirm resolver IPs.

Common issues & fixes:

• Agent not showing in dashboard: ensure installer used correct org key and network allows outbound connections to SafeDNS servers (check firewall/proxy).
• DNS leaks (device using ISP DNS): Confirm agent service/process is running, check local DNS settings, and ensure no conflicting VPN or custom DNS client.
• macOS kernel/system extension blocked: Instruct users to allow extension in Privacy & Security and restart.

6. Best practices

• Staged rollout: Deploy to pilot group, monitor for issues, then roll out broadly.
• Use endpoint management: Automate installs and updates via SCCM, Intune, Jamf, or your MDM.
• Enforce safe search: Enable safe search and restrict search engines at policy level to reduce exposure to inappropriate content.
• Whitelist critical services: Pre-approve SaaS and internal services needed for business operations to avoid disruption.
• Logging and alerts: Enable logging and integrate SafeDNS alerts with your SIEM or monitoring tools for suspicious activity.
• Regular policy reviews: Review and update categories, whitelists, and blacklists quarterly or when business needs change.
• Fallback DNS handling: Configure fallback behavior to prevent bypassing Filter (e.g., block direct DNS over HTTPS/TLS to unapproved resolvers).
• User communication: Inform users about the filtering policy, expected behavior, and support contact for false positives.

7. Advanced deployment tips

• Split tunneling with VPNs: Ensure VPNs do not bypass DNS filtering; apply split DNS or force DNS resolution through SafeDNS.
• Layered security: Combine SafeDNS with endpoint protection (EDR), web proxies, and network firewalls for multilayer defense.
• API automation: Use SafeDNS APIs (if available) to automate device registration, policy assignment, and reporting.
• High availability: Use SafeDNS resolver IPs and prioritize them in network configurations; verify redundancy during maintenance windows.

8. Maintenance and updates

• Keep agent versions up to date; schedule regular maintenance windows for large updates.
• Monitor agent health and update policies as new threats emerge.
• Periodically audit devices for compliance and ensure retired devices are removed from the dashboard.

9. Example checklist (deployment)

1. Create pilot policy template.
2. Select 10 pilot machines (Windows/macOS).
3. Download agents and deploy to pilot.
4. Verify device registration and DNS routing.
5. Resolve any issues and update installer parameters.
6. Roll out to remaining devices via endpoint management.
7. Monitor logs and refine policies.

Conclusion

Following a structured approach—planning, piloting, automated deployment, verification, and continuous maintenance—ensures SafeDNS Agent provides reliable DNS-based filtering and protection across your endpoints.