DNSFilter Setup Beta

Connect DNSFilter to let Junto investigate DNS traffic and blocked queries, categorize domains, inspect filtering policies, and review protected networks, roaming clients, and deployment coverage. With approval, the AI agent can also change allow and block lists, adjust policies and schedules, manage networks and addresses, and administer roaming clients, organizations, dashboard users, API keys, and scheduled reports.

Junto supports one DNSFilter configuration per organization. Connect your DNSFilter account once, then map DNSFilter organizations and networks to Junto companies so the agent can retrieve each customer's data.

Prerequisites

• A Junto Admin or Owner account
• A DNSFilter dashboard account with access to the customer organizations you want to connect (an MSP account for multi-tenant deployments)
• A DNSFilter API key created by that account
• Customer companies in Junto, imported from your PSA, to map to DNSFilter

Step 1: Create a DNSFilter API Key

1. Sign in to the DNSFilter dashboard and open your account menu.
2. Select Account Settings, then open the Security tab.
3. In the API Keys section, click Create Key.
4. Enter a Name such as Junto and choose an Expiration. The name cannot be changed after the key is created.
5. Click Generate Key and copy the key. DNSFilter shows it only once, and you must copy it before you can save.
6. Click Save.

A DNSFilter API key carries the same access as the user who created it, and each user can hold a limited number of active keys. Create the key from an account that can see every customer organization you plan to map. Features such as organization administration and billing lookups only work if that account has the matching rights in DNSFilter. Note the expiration date; when the key expires, Junto's connection stops working until you enter a replacement.

For current instructions, see DNSFilter's API keys help article.

Step 2: Configure in Junto

1. Go to Settings > Integrations > DNSFilter.

2. Click Add configuration.

3. Complete the Add DNSFilter form:

   Field	What to enter
   API key	The key from Step 1
   Active	Leave enabled to make the integration available

4. Click Save. Junto encrypts the key before storing it and never displays it again; the dialog closes after it confirms Saved.

5. On the DNSFilter API card, click Test connection and confirm Connected to DNSFilter. appears. The confirmation also reports how many DNSFilter organizations the key can see.

Saving the configuration does not test the key; run Test connection separately. A successful test confirms the key is valid and can list organizations. Individual features still depend on the rights of the DNSFilter user who created the key.

Step 3: Map Companies

1. Click Company mappings on the active configuration. The Map DNSFilter scopes dialog lists every Junto company.
2. For each Junto company, open Add organization or network… and select one or more DNSFilter scopes. Each entry shows its name followed by (organization) or (network).
3. Click Save mappings.

A mapping can be either kind of scope:

• Organization gives the company everything in that DNSFilter organization: its policies, networks, roaming clients, local users, traffic, and reports.
• Network limits the company to specific sites. Explicit network mappings override their parent organization, so a network mapped to one Junto company is excluded from any other company that maps the parent organization.

Each DNSFilter organization or network can be assigned to only one Junto company. To remove a mapping, click the x on the scope and save. A company with no mapping cannot use the customer-specific DNSFilter tools.

If a mapped company has since been hidden in Junto, it appears under Unavailable company mappings. Its assignments stay reserved until you click Remove assignment and save, which lets you reassign those scopes to another company.

If the dialog reports that the scope inventory is incomplete because it reached the safety limit, your DNSFilter account has more organizations and networks than Junto can load at once. No mappings can be saved in that state; contact Junto support.

What the Agent Can Do

Capability	What Junto can do	Risk level
Domain lookup	Categorize up to 100 domains, with category names, before a policy change or during an investigation	Low
Filtering catalog	List and search DNSFilter categories and applications to resolve exact names and identifiers	Low
Traffic reporting	Totals for requests, threats, domains, categories, applications, collections, and geography; queries per second; top-traffic rankings; and client, deployment, and roaming-client coverage for a date range	Low
Query logs	Investigate allowed, blocked, or all DNS queries with domain, policy, category, application, client, IP, agent, and user filters, plus a fast path for recent blocked queries	Low
Policies	List policies for a mapped company or organization and read one policy's full domain, category, and application rules	Low
Schedules and block pages	List time-based policy schedules and custom block pages	Low
Networks	Find protected sites and networks, read a network's configuration and its effective policy, inspect IP, MAC, and subnet records, verify an IP address, and check the status of a bulk network job	Low
Roaming clients and local users	List roaming clients with status counts and inspect one client's assignments, platform, version, last-seen time, and settings; list and inspect local users observed on agents	Low
Organizations and users	Discover DNSFilter organizations, read one organization's configuration and licensing, and list an organization's dashboard users	Low
API keys, reports, and invoices	List API key metadata (never key material), scheduled reports, and invoices	Low
Policy changes	Create, update, or delete a policy; add or remove allowed and blocked domains with an audit note; add or remove blocked categories and allowed or blocked applications; enable or disable permissive mode	High
Schedule and block-page changes	Create, update, or delete a weekly policy schedule or a custom block page	High
Network changes	Create, update, or delete networks individually or in bulk; create, update, or delete IP, MAC, and subnet records; generate, rotate, or revoke a network secret	High
Roaming client changes	Update a client's name, status, site, policy, schedule, block page, tags, or VPN override; change CyberSight, filtering, diagnostics, connection, and failover settings; queue or cancel an uninstall; deliver an organization's uninstall PIN	High
Local user changes	Update a local user's name or assignments, or delete local users individually or in bulk	High
Organization administration	Create, update, bulk-update, cancel, or delete DNSFilter organizations; create, update, delete, or re-invite dashboard users	High
API key administration	Create, revoke, or delete DNSFilter API keys	High
Scheduled reports	Create, update, preview, or delete scheduled reports and their recipients	High

Approval Required

All write actions require technician approval before execution. Read-only tools do not require approval.

Every DNSFilter write is treated as high risk because each tool can affect live DNS enforcement for a customer, so it is never eligible for risk-based auto-approval. Write actions require the Manager role or higher; a request from a lower-level member is routed to a member with that role for approval instead. The approval fixes the action and its target (the policy, network, device, organization, or user); an approver can adjust the content of the change but cannot redirect it to a different target. Organization details, invoices, and organization administration require the Billing Admin flag. API key administration requires an Administrator or Owner with Billing Admin.

Scope and Reporting

• Where the tools are available: The full catalog is available in Explore chat. In a ticket (signal) conversation, the agent has the read tools plus policy domain, category, application, and permissive-mode changes and roaming client updates. DNSFilter tools are not available in runbooks or automated processors.
• Customer context: In Explore chat the agent can work organization-wide or scoped to one mapped company. A ticket conversation is fixed to the ticket's company. Listing organizations, organization administration, API key administration, and bulk network job status are tenant-wide and only work in an organization-wide Explore chat.
• Mapped scope is enforced: In a company-scoped session the agent can only read or change resources that belong to that company's mapped organizations and networks. Requests for anything else are refused as outside the company's mapped scope.
• Network-only mappings: A company mapped only to networks cannot list organization-wide policies. Ask for a network's effective policy instead.
• Shared filtering objects: When a DNSFilter organization has networks explicitly assigned to another Junto company, policy, schedule, and block-page changes for that organization are refused in a company-scoped chat. Use an organization-wide Explore chat.
• Date ranges: Traffic reports and query logs default to the previous 24 hours in UTC. Specify a range for anything else.
• Result limits: Query logs return 20 records by default and at most 100; top-traffic reports are rankings, not complete inventories. Inventory lists such as networks, policies, and roaming clients report when they are incomplete; narrow the search or use DNSFilter for an exhaustive review.
• Client-identity filters: Query-log filters by collection, agent, user, MAC address, or NAT IP are available only in an organization-wide Explore chat.
• Concise and detailed results: Lists return the most useful fields by default. Ask for detailed results when you need the complete DNSFilter record, including invoice billing breakdowns.
• Billing: Invoices are read-only. DNSFilter license usage reports and billing or payment changes are not available through Junto.

Changes and Verification

• Policy edits: Before a full policy update, the agent reads the current policy so a change someone made in the DNSFilter dashboard at the same time is not overwritten. Domain, category, and application changes are applied one item at a time (up to 100 per request), so large batches take longer.
• Schedules: A weekly policy schedule assigns policies in 15-minute blocks across the week and may reference at most 100 distinct policies.
• Bulk operations: Bulk network creation and bulk local-user deletion stop at the first failure and report each target's outcome. Bulk network updates apply one shared policy to every target. The agent verifies unconfirmed targets before retrying and never repeats completed ones. Bulk network jobs run asynchronously; ask for the job status to confirm completion.
• Secrets: New network secrets, new API keys, and uninstall PINs are never shown in chat. They are delivered to the requesting technician through a one-time Secure Send link. If the change succeeds but delivery cannot be confirmed, the agent reports this instead of repeating the change; rotate or replace the secret with a new approval.
• Unconfirmed writes: If DNSFilter does not confirm a change, the agent reads the affected resource before any retry rather than resubmitting automatically.

Example requests:

• "Show Acme's blocked DNS queries from the last 24 hours."
• "Categorize example.com and tell me whether Acme's policy blocks it."
• "Which roaming clients at Acme are offline, and which policy are they assigned?"
• "Allow example.com on Acme's Standard policy and note the ticket number."
• "Enable permissive mode on Acme's Guest policy for troubleshooting."
• "Move the laptop ACME-042 to the Remote Workers policy."
• "List the networks at Acme and show the effective policy for the Chicago office."

Managing the Connection

• Update credentials: Click Edit, enter the replacement API key, and click Save. Leave API key blank to keep the stored key and its mappings. Replacing the key clears all company mappings; reopen Company mappings and remap before company-scoped use, then test the connection.
• Pause the integration: Click Edit, turn off Active, and click Save. The configuration and mappings remain saved, and Company mappings and Test connection are unavailable until you reactivate it.
• Remove the integration: Click Delete, then Delete configuration. This removes the encrypted API key and every DNSFilter company mapping from Junto.

Troubleshooting

• Connection failed: Confirm the API key has not expired or been revoked in DNSFilter and that its user still has access. If Junto reports that stored credentials cannot be decrypted, click Edit and enter the key again.
• "DNSFilter is already configured": Junto allows one DNSFilter configuration per organization. Edit the existing configuration instead of adding another.
• Mappings cannot be saved: If the dialog reports that credentials or mappings changed, another administrator saved changes or replaced the key; reopen Company mappings to reload before saving. Each DNSFilter scope can be mapped to only one company.
• Company has no mapping: The agent reports that the company has no DNSFilter organization or network mapping. Confirm the configuration is active and the mapping is saved.
• Resource outside mapped scope: The policy, network, or device belongs to an organization or network that is not mapped to the selected company, or it is a network explicitly assigned to another company. Check the mapping or use an organization-wide Explore chat.
• Operation unavailable in a company-bound session: Tenant-wide operations and client-identity query filters require an organization-wide Explore chat.
• Authorization failed during a tool call: The key's DNSFilter user lacks the required permission, or the key is no longer valid. Grant the permission in DNSFilter or replace the key.
• Rate limiting: DNSFilter is throttling requests. Wait before asking again.
• Network inventory incomplete: The company may have more networks than Junto can load at once. Narrow the search by name and retry.
• Local users unavailable: DNSFilter may return an error when a tenant has no local-user records. This does not indicate a connection problem.
• Secret delivered but not received: Check Secure Send for the link. If delivery was not confirmed, request a rotation rather than repeating the original request.