Why DNS filtering suits MSPs
MSPs look for services that add real security value, are quick to deploy across many customers and are easy to support. DNS filtering scores well on all three. It blocks phishing, malware and fresh attack domains for every device on a customer network, deployment is a change on the customer's firewall or DHCP server, and the query log answers most support questions in seconds.
Because there are no agents to install, you can protect printers, cameras, guest devices and other equipment that endpoint tools cannot reach.
How the MSP model works
FirewallDNS separates the MSP administrator from customers. As the administrator you create customer accounts, configure their filtering, set the cost each customer pays and invoice them. Each customer sees only their own network, settings, logs and cost, never other customers or your margins.
- Add and manage customers from one admin account
- Set the price and invoice each customer yourself
- Customers see only their own cost and data
- Per-device billing that maps directly onto your contracts
Simple per-device economics
The MSP package costs $2.90 per device per month with unlimited devices and customers. Per-device pricing makes quoting simple: count the devices on a customer network and you know your cost. You decide the price your customers pay. [FILL IN: MSP volume terms, billing cycle and minimums, if any]
Rolling out to a customer
A typical rollout takes minutes per site. Create the customer, register their public IP address, apply your standard filtering profile, and change the DNS server on their firewall, router or Active Directory forwarders. Our guides cover FortiGate, Palo Alto, Cisco, Meraki, Sophos, SonicWall, WatchGuard, UniFi, MikroTik, pfSense, OPNsense, Windows Server and many more, so your technicians have a reference for most estates.
Standardise your security baseline
Most MSPs define a baseline that every customer receives: malware protection, phishing protection and newly registered domain blocking switched on, plus a short allowlist of tools you support. Category filtering can then be added as an upsell or tailored per customer. [VERIFY: whether reusable filtering templates across customers are available]
Support and troubleshooting
When a customer calls because something will not load, the technician opens that customer's query log, filters to blocked requests and sees immediately whether DNS filtering was involved. If it was, an allowlist entry resolves the ticket. Logs also highlight infected devices through repeated blocked command-and-control lookups, which can turn into proactive security work for your team.
Selling DNS filtering to customers
DNS filtering is easy to explain to customers: it stops people reaching dangerous websites, and it protects devices that cannot run security software. Bundling it into a managed security package raises the baseline for every customer without adding agents to maintain. Showing a customer their own query log, with blocked phishing and malware lookups, makes the value tangible at review meetings.
Because pricing is per device, it maps directly onto per-device or per-seat managed service contracts. You decide the price each customer pays and invoice them through FirewallDNS.
Onboarding checklist for technicians
For each new customer: create the customer, register their public IP, apply your baseline settings, change DNS on the edge device or forwarders, block outbound DNS to other servers, confirm queries appear in the log, and note any allowlist entries the customer needs. Document the configuration in your usual system so the next technician can support it.
Reporting value to customers
Customers rarely see the attacks that never happened. Summarise blocked malware and phishing lookups from their query log in your regular reviews, so they understand what the service does.
Handling customer exceptions
Every customer has unique tools: an industry application, a payroll service, a supplier portal. Keep a short note of why each allowlist entry exists, so that technicians can review exceptions during quarterly business reviews. When an exception turns out to be needed by many customers, add it to your onboarding baseline so new customers never hit the same issue. Clear exception handling is what turns DNS filtering from a source of tickets into a service customers barely notice.
Data separation and trust
Each customer's settings and logs are isolated from every other customer. As the MSP, you remain responsible for informing customers about how their DNS data is processed. Our security and GDPR pages describe how FirewallDNS handles query data, and a data processing agreement is available. [VERIFY: DPA availability for MSPs and sub-processor terms]