Workflow Automation · Dnsfilter + Claude
Dnsfilter MCP with Claude: Automate DNS Security and Safe Internet Access
The short answer
Claude works with Dnsfilter through the Model Context Protocol (MCP), an open standard that acts as a secure adapter between the two. Once connected with an API key, Claude can read DNS activity, review threats, and help update allow and block lists, with approvals controlled by your organisation.
What is Dnsfilter?
Dnsfilter is a cloud-based DNS security and content filtering solution. It helps organisations block online threats such as malicious websites and manage safe internet access for their staff. IT and security teams typically use it to set filtering policies across offices, remote workers and guest networks, and to review what is being blocked and why. It suits businesses of many sizes that want protection without running their own filtering hardware.
How Claude connects to Dnsfilter through MCP
The Model Context Protocol is an open standard that lets Claude securely use other software, reading information and taking actions, with permissions the organisation controls. Think of it as a universal adapter between Claude and the tool. Connecting Dnsfilter this way means Claude can work with your DNS security data in the same way a member of your team would, but in plain language.
Once connected, Claude can typically read recent DNS threat events, summarise blocked categories, review existing allow and block lists, and draft changes to filtering policies. It can also prepare security alerts for your team. Connection uses the API key that Dnsfilter supports, and access is limited to what that key permits.
Permissions and approvals keep people in charge. Your organisation decides which actions Claude may take and which need a human sign-off. For example, Claude might prepare a block-list change for an IT manager to approve before it goes live, and every action is recorded in an audit log.
What you can automate
Daily threat summaries for the security team
Each morning, Claude reviews overnight DNS threat events and produces a short, plain-English summary. It highlights new blocked domains, unusual spikes by site or department, and anything needing attention. Security staff start the day with a clear picture instead of scrolling through raw logs.
Allow and block list management
When an employee reports that a legitimate business website is blocked, Claude can look up the block reason, check the domain's category and suggest whether it should be allowed. The change is queued for approval, so the decision remains with your IT team and the audit trail stays complete.
Policy review for new teams or offices
When a new office or department opens, Claude can help draft a filtering policy suited to that group's needs, such as stricter controls for finance staff or more open access for marketing. Your administrators review the draft, adjust it and apply it, saving hours of manual configuration.
Automated alerts for suspicious activity
Claude can monitor for patterns that suggest a problem, such as repeated attempts to reach a known malicious domain from one device. It then prepares an alert with context and routes it to the right person in your ticketing or messaging system, so incidents are picked up quickly.
Monthly reporting for leadership
At the end of each month, Claude can compile key figures on threats blocked, policy changes made and categories most often triggered. It turns these into a short report that a non-technical manager can read, supporting conversations about security investment and staff training.
An end-to-end workflow: Threat alert to incident ticket
TriggerDnsfilter records repeated access attempts to a known malicious domain from a single laptop.
Claude reads the threat events and confirms the pattern across the past hour.
Claude checks the device owner and department against the staff directory in Microsoft 365.
Claude drafts a security alert with the domain, device, timeline and recommended next steps.
The alert is opened as a ticket in the organisation's ticketing system and assigned to the security on-call engineer.
The engineer approves a temporary block, and Claude records the decision in the audit log.
OutcomeSuspicious activity is investigated within minutes rather than hours, with a complete record of what was found and who acted on it. Typical results depend on your existing processes and staffing.
How we set it up
Free automation audit
We review how your team currently manages DNS filtering and alerts, and identify the workflows worth automating. This session is free and carries no obligation.
Secure API key connection
We connect Claude to Dnsfilter using an API key that you create and control. Access is set to least privilege, so Claude can only use the actions your policy allows.
Workflow design
We design the end-to-end workflow across Dnsfilter and your other systems, such as Microsoft 365, your CRM or ticketing tool. We agree which actions need human approval.
Testing with real cases
We test the workflow against past threat events and policy changes from your own environment, checking accuracy and adjusting prompts and permissions where needed.
Launch, monitoring and training
We launch with monitoring and audit logging in place, then train your administrators and security staff on how to use and oversee the automation.
Who benefits
- IT and security managers
- Faster visibility into threats and policy changes, with less time spent on routine list management.
- Helpdesk and support teams
- Quicker answers when staff ask why a site is blocked, with clear next steps.
- Operations and office leaders
- Simple monthly summaries of safe internet use without needing to read technical logs.
- Compliance and risk owners
- A consistent audit trail of filtering decisions and approvals.
Security and control
- Claude uses an API key with least-privilege access, limited to the actions your organisation approves.
- Consequential changes, such as updating block lists, require human approval before they take effect.
- Every action Claude takes is recorded in an audit log that your team can review.
- Monitoring alerts your team if usage or activity falls outside agreed patterns.
- Claude is tested against your real cases before launch, and reviewed regularly afterwards.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can use this automation with their own data protection and security policies in place. In India, the Digital Personal Data Protection Act, 2023 governs how personal data is handled, and we design workflows to support those obligations. Organisations in the UAE and Saudi Arabia must meet local data protection laws, and we choose a hosting region in India, the United States, the United Kingdom or the European Union to meet your requirements.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the Dnsfilter MCP server do?
The Dnsfilter MCP server is the connector that lets Claude use Dnsfilter securely. It exposes the information and actions your organisation allows, such as reading threat events and managing allow and block lists. Claude works through this connector in plain language, and only the permitted functions are available.
Is connecting Claude to Dnsfilter secure?
Security depends on how the connection is set up. We use an API key that you create and control, with least-privilege access, so Claude can only perform approved actions. Consequential changes need human approval, and every action is logged for review. We also test the setup before launch.
What can Claude do with Dnsfilter once connected?
Typically, Claude can read recent DNS threat events, summarise blocked categories, review allow and block lists, draft filtering policy changes and prepare security alerts. Exactly what it can do depends on the permissions you grant during setup.
How long does setup take?
Many organisations complete a first workflow within a few weeks, though timing depends on how many systems are involved and how complex your policies are. The free automation audit gives a clearer estimate for your environment.
What access do I need to connect Dnsfilter?
You need an API key from your Dnsfilter account, created by an administrator with the appropriate permissions. The exact access depends on your Dnsfilter arrangement, so we confirm the requirements during the audit and set up only the permissions your workflow needs.