These are the release notes for Sophos DNS Protection.
View the product documentation at Sophos DNS Protection help.
SFOS 23.0 simplifies DNS Protection deployment by automating Sophos Firewall onboarding and DNS over HTTPS (DoH) configuration. You no longer need to manually create locations in Sophos Fusion or configure DNS Protection IP addresses on the firewall. Turn on DNS Protection with a single setting and manage DNS filtering policies from Sophos Fusion.
For more information, see Configure Sophos Firewall to use DNS Protection.
You can now add DNS Protection widgets to the Sophos Fusion global dashboard to monitor DNS activity across your environment from a centralized location. Use the Product or Category filters to find and add DNS Protection widgets and view DNS-related activity alongside information from other Sophos products.
You can add the following DNS Protection widgets:
The Sophos Fusion global dashboard doesn't support the DNS query volume widget.
To add a DNS Protection widget, go to Dashboards > Manage dashboards and click Create new. Use the product filter or category filter to find and add DNS Protection widgets. Select DNS Protection in the Product filter or select Threat in the Category filter.
There are no resolved issues included in this release.
We've added the Generative AI category to the Business and generative AI category group. You can use this category to control access to websites that provide generative AI services. As part of this update, we've renamed the Business-relevant site categories category group to Business and generative AI.
To allow only approved Generative AI websites, block the Generative AI category in a filtering policy, create a domain list containing the URLs of approved Generative AI websites, and then allow that domain list in the same filtering policy.
For existing filtering policies, the Generative AI category inherits the setting configured for the Information technology category. For example, if the Information technology category is set to Allow in an existing policy, the Generative AI category will also be set to Allow.
For information about configuring filtering policies, see Add a filtering policy.
There are no resolved issues included in this release.
If you're using DNS Protection with a Workspace Protection license, you can configure Sophos Endpoint to forward DNS requests from Windows devices to DNS Protection by adding an Endpoint DNS Protection policy.
You can now access Endpoint DNS Protection policies from My Products > DNS Protection > Policies > Endpoint policies.
This update also introduces the following changes in DNS Protection:
If you don't have a Workspace Protection license, you'll see the change from Policies to Filtering policies, but you won't have access to the Endpoint policies feature.
You can also continue to configure Endpoint DNS Protection policies from My Products > Endpoint > Policies.
There are no resolved issues included in this release.
APIs for policies and custom domain lists are now available. You can create, update, and manage policies and domain lists, and integrate with third-party systems.
For more information, see DNS Protection API Guide.
There are no resolved issues included in this release.
With this release of DNS Protection, the product is now available with a Workspace Protection license, as well as under a Sophos Firewall Xstream Protection subscription. Workspace Protection includes functionality for Windows endpoints to intercept and forward DNS traffic to DNS Protection using DNS over HTTPS. This ensures that devices benefit from DNS Protection regardless of where they are connected or located.
For the release announcement, see the Sophos Community post.
This release introduces the following new features:
Sophos DNS Protection is now integrated with Sophos Endpoint. This integration automatically secures DNS traffic by redirecting it over HTTPS to DNS Protection, helping block malicious domains and enforce web access policies without manual configuration.
Additionally, DNS Protection reports now include the following details:
To use this feature, you must upgrade to the Sophos Endpoint package for DNS Protection. For details, see the Endpoint DNS Protection policy requirements.
See the following resources:
DNS Protection > Logs & Reports now includes the following new report templates:
There are no resolved issues included in this release.
This page lists the new features introduced in this early access program (EAP).
Sophos DNS Protection is now integrated with Sophos Endpoint. This integration automatically secures DNS traffic by redirecting it over HTTPS to DNS Protection, helping block malicious domains and enforce web access policies without manual configuration.
Additionally, DNS Protection reports now include the following details:
To use this feature, you must join the Workspace Protection and New Endpoint Protection Features early access programs. For details, see the community post.
See the following resources:
DNS Protection > Logs & Reports now includes the following new report templates:
There are no resolved issues included in this release.
This page lists the new features introduced.
When setting up a DNS Protection location, Sophos Central now provides a list of suggested IP addresses, including your current public IP address and the known public IP addresses of your licensed firewalls. For more information, see Add a location.
| Issue ID | Component | Description |
|---|---|---|
| NSWAAS-4461 | DNS resolver | Fixed an issue where DNS Protection couldn't resolve some domains. |
This page lists the new features introduced.
DNS Protection is now available for users with accounts in all Sophos Central regions, including Australia, Brazil, Canada, India, and Japan.
There are no resolved issues included in this release.
This page lists the new features introduced.
In this release, we have added new capabilities to allow better interaction and status monitoring in future versions of Sophos Firewall.
We've improved our evaluation of how policies perform if you add many domains to Custom Domain Lists.
| Issue ID | Component | Description |
|---|---|---|
| NSWAAS-4310 | DNS resolver | Fixed an issue where DNS Protection stripped private IP addresses from responses from the DNS server. |
| NSWAAS-4229 | SFOS | The DNS resolver sends large UDP responses when the endpoint computer doesn't use EDNS. This fixes an issue where DNS Protection users using Sophos Firewall experienced significant delays resolving queries with large response payloads, such as DKIM records. |
There are no new features introduced in this release.
| Issue ID | Component | Description |
|---|---|---|
| NSWAAS-3939 | UI - RBAC | Fixed an issue where the DNS Protection reports page was appearing even though the Enable access to logs & reports setting was turned off. |
There are no new features introduced in this release.
| Issue ID | Component | Description |
|---|---|---|
| NSWAAS-3748 | UI | Fixed the misalignment of UI text on the policy page in dark mode. |
| NSWAAS-3758 | UI | Fixed the scrolling issue on the domain list, location, and policy pages. |
| NSWAAS-4041 | UI | Updated some UI text to make it consistent across the product. |
This page lists the new features introduced.
ECS allows DNS Protection to serve DNS queries based on their geographic location. Currently, DNS Protection supports ECS only for certain Sophos domains, but coverage will be extended to other domains in the coming weeks.
DNS Protection now appears as a quick-access link under "Product setup" when you sign in to Sophos Central. This link redirects you to the DNS Protection dashboard.
The Policies pages shows a comma-separated list of all locations to which you've applied the policy. If the list is long, hover over the list to see all locations.
We've improved the experience for users with a read-only role when accessing DNS Protection. Access to DNS Protection is based on the administration roles you've defined in Sophos Central. For more information, see Administration roles.
There are no resolved issues included in this release.
This page lists the new features introduced. For details, see the Sophos DNS Protection help.
You can now copy the IP addresses or FQDNs of your locations and domains in your domain lists to the clipboard and paste them elsewhere.
| Issue ID | Component | Description |
|---|---|---|
| NSWAAS-3884 | UI | Fixed the alignment of the steps in the Set up DNS Protection assistant. |
DNS Protection is a new product offering by Sophos. It provides a globally available secure DNS resolution service with integrated policy controls and reporting in Sophos Central. DNS Protection leverages SophosLabs' real-time threat intelligence to protect your organization from malicious domain activity and allows you to enact policies for domain categories or domain lists.
For more information, see the Sophos DNS Protection help.
For the release announcement, see the Sophos Community post.
To ensure you get a good experience as you start to use DNS Protection, we're limiting the number of accounts that can start using DNS Protection and will be increasing that limit in stages over the coming weeks. If you can't access the product immediately, please wait for the later stages.
To see the known issues for DNS Protection, go to the Known Issues list.
You can find technical support for Sophos products in the following ways:
Copyright © Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respectiveowners.