Feature Requests

eDNS0 and ECS are already supported, but the client subnet information is only used for CDN routing optimization. When a gateway/firewall (e.g. OPNsense with Unbound) forwards DNS queries with ECS headers containing the originating LAN client IP, that IP should be logged and displayed in the dashboard query log — not just used for CDN decisions. This would allow firewall-only deployments (without Relay or Roaming Clients) to have per-device visibility in the analytics, which is currently impossible since all queries appear to originate from the gateway IP. Why this is a strong request: ECS is already an open standard (RFC 7871) — You already use it for CDN optimization. It doesn't require any agent or Relay deployment, easy to deploy for small clients. ControlD and NextDNS both have this.

Some blocked applications generate large amounts of query log entries, creating noise in the logs that makes searching for other blocked sites (that we might want to allow) difficult.

The DNS query log currently allows 25, 50, and 100 rows per page. Please increase this to include 250 and 500.

The ability to sort by IPv4 column or filter for a specific address. It would be helpful if local ipv4 address was part of the filter criteria and if the column was able to be sorted. It would be even more helpful if all the columns were filterable and sortable as only some appear to have a sorting option or a filter option... Also, when looking at a domain report. It does not tell you specifically if the site is blocked or allowed by its category. It would be helpful if it clearly stated if the site has or is blocked and for what reason.

Report for new domains by time period. Would help eliminate frequently used sites/already known to be clear.

We use the NAT IPs feature mainly for 'allow-only' policies. It would be very useful especially when first implementing a new policy to view and report on DNS activity by policy. This would assist us in troubleshooting problems and also verify the policy is performing as expected and allow URLs needed for say OS updates or endpoint protection clients.

For example, when visiting cnn.com they will hit a block page as expected. However, when hitting a CDN or a backend resource, they might not hit the block page. It would be helpful to see within Data Export or in the dashboard when users hit a block page, or not when a domain is blocked.

Create checkboxes for logs in order to select multiple or "All" and have the "Action" for Allow or Block.