← Back to home

Product

Web filtering | Browsing control on the endpoint

Filtering runs on the computer itself, so it protects the user wherever they are: at the office, at home or connected from a hotel.

KairosLink resolves the computer's DNS queries against per-category lists and blocks whatever the policy says. The categories available today are malware and phishing, adult content, gambling and social media. On top of that come each organization's own hand-loaded lists of blocked and allowed domains.

Each customer has a base policy and as many additional policies as needed. Additional policies are assigned to a specific computer, an Active Directory security group or an Organizational Unit, with an explicit precedence order: first the computer, then the group, then the Organizational Unit, and finally the base policy. There is never a computer without a policy.

The agent downloads the policy and the lists, and from then on resolves on its own. If it loses connection with the panel, it keeps enforcing the last policy in effect. The policy can also be set to block the DNS over HTTPS services browsers use to sidestep the filter.

Every block is logged and the report shows the most blocked domains and categories, with filters by period and by customer.

What it filters and what it does not

Whole domains are filtered, not individual URLs. With HTTPS the rest of the address travels encrypted, so you can block an entire site but not a specific section of that site.

Filtering is not traffic inspection: the content of the user's communications is never opened or read.

If the agent stops for any reason, the computer recovers its original DNS configuration and keeps browsing. We prefer a customer without a filter to a customer without internet.

The computer's Active Directory domain and KairosLink's infrastructure are never filtered, even if they showed up on a list by mistake.

Web filtering is available on the Business and Enterprise plans.

Frequently asked questions

What is DNS web filtering?
It is browsing control applied at the point where the computer translates a domain name into an IP address. When the computer tries to resolve a domain included in the policy, resolution is blocked and the attempt is logged. Acting on the computer's DNS, it covers every browser and application, not just one.
Can I block a whole category?
Yes. Each policy lets you enable full categories (Malware and phishing, Adult content, Gambling and online betting, Social media), fed from public domain lists. You can also add your own blocked domains and allowed domains as exceptions.
Can the user bypass it by switching browsers?
No. Filtering is applied at the system's DNS resolution level, not inside a browser or as an extension, so switching browsers does not evade it. The policy can also block known DNS over HTTPS (DoH) endpoints so the browser cannot sidestep the filter on its own.
Does it help enforce acceptable use policies?
Yes. You define which categories and domains are not allowed under the customer's acceptable use policy, and the block report, with domain, computer and date, provides the record that the policy is being enforced.
Does it apply to every computer equally?
Not necessarily. There is a base policy per customer and you can create additional policies assigned to a computer, a security group or an Organizational Unit of the customer's Active Directory.
Do I need to install extra hardware on the customer's network?
No. Filtering runs inside the agent already installed on each computer. There is no appliance, no intermediate server, no router changes.
Does it work if the user takes the laptop home?
Yes. Since filtering lives on the computer, the policy applies on any network it connects to.
What happens if the computer loses connection with the panel?
It keeps enforcing the last policy and lists it downloaded.
Can I block a specific section of a site?
No. Whole domains are blocked. With HTTPS the rest of the address travels encrypted, so you can block an entire site but not a part of it.
Can I apply a different policy per area of the company?
Yes. Policies are assigned to a specific computer, an Active Directory security group or an Organizational Unit, and are resolved with a defined precedence order.
What happens if the agent stops working?
The computer recovers its original DNS configuration and keeps browsing. The filter goes down, connectivity does not.
Try KairosLink free for 14 days

All modules included. No credit card.