DNS filtering alternatives for guest WiFi: how to compare and choose
The alternatives to a DNS filtering service for guest WiFi fall into five groups: pure-play DNS filters, enterprise secure-access suites, zero-trust platforms, family-focused DNS services and on-premises appliances. Purple Shield is the sixth: built for guest and public WiFi, with a policy per SSID and VLAN, ad blocking included and nothing to install.
- Filtering built to the Internet Watch Foundation bar
- No hardware, no agents on devices
- Fails closed, across multiple data centres
Reviewed on October 9, 2026
Shield in numbers
- 241,000threats a week blocked on the guest WiFi at St George's Healthcare NHS Trust
- 10 daysearlier warning of new threats than standard blocklists
- 80,000+venues on the Purple platform Shield runs on, in 90 countries
In short
Key takeaways
- Most DNS filters were built for managed endpoints, laptops and phones an organisation owns. Guest WiFi is a different problem because you do not control the devices.
- Compare on nine criteria: unmanaged-device coverage, policy per SSID and VLAN, ad blocking, multi-site management, resilience, detection lead time, reporting per venue, install effort and pricing structure.
- Per-user pricing is a poor fit for guest WiFi, where you do not know the users. Ask for pricing by network, venue or estate.
- Shield's edge on guest WiFi: a policy per network, ad blocking included, no hardware, fails closed, and detection that flags new threats up to 10 days before standard blocklists.
- Other options are the right call in specific cases, and this guide says which. A trial on one network settles the rest.
- Run a 30-day trial of Shield on one SSID, side by side with your current filter, and decide on the blocked URLs and threat analysis.
The options
What are the alternatives to a DNS filtering service for guest WiFi?
Five groups: pure-play DNS filters, enterprise secure-access suites, zero-trust platforms, family-focused DNS services and on-premises appliances. Shield is a sixth: DNS filtering built for guest and public WiFi.
- Network DNS filter (Shield)Every device that joins the WiFi, with nothing installed
- DNS filter with roaming agentsNetwork locations, plus managed devices that carry the agent
- Zero-trust platformEnrolled users and devices, with identity-aware policy
- Device agentOnly the devices that have it installed
Search for a DNS filter and the results blur together, because most products do the same core thing: refuse a bad domain at the lookup. What differs is who each was built for, and that decides whether it suits a guest network.
| Kind | Examples | Built for | Fit for guest WiFi |
|---|---|---|---|
| Guest-WiFi DNS filtering | Purple Shield | Venue estates: a policy for every SSID, VLAN and venue | Designed for it: nothing on devices, ad blocking included, fails closed |
| Pure-play DNS filter | DNSFilter | Protective DNS for managed and roaming endpoints | Works on a network; policy follows users and devices an organisation manages |
| Enterprise secure-access suite | Cisco Umbrella | Large enterprises that want DNS security, web gateway and zero trust under one contract | Broad; a larger programme than a venue guest network needs |
| Zero-trust platform | Cloudflare Gateway | Identity-aware policy for the users and devices an organisation enrols | Network-level DNS filtering is possible; the platform is built around enrolled users |
| Family-focused DNS service | CleanBrowsing, Control D | Households and small organisations choosing ready-made filter profiles | Simple to start; built around profiles rather than an estate of venues |
| On-premises appliance | Legacy filtering appliances | A box at every site inspecting traffic at the edge | Hardware to buy, fit and maintain at every site |
Criteria
How should you compare DNS filtering services for WiFi?
On nine criteria that decide whether a filter works on a network full of devices you do not own. The scorecard below turns them into questions you can put to every vendor, Shield included.
Feature lists compare well and decide little. What separates DNS filters on guest WiFi is how they handle the things guest WiFi has and an office does not: devices you cannot configure, many small sites, strangers of every age, and a business that cannot afford the network being down.
DNS filtering evaluation scorecard
0 of 11 done
Comparison
How do the options compare, criterion by criterion?
Shield is built around the guest-WiFi criteria, so it leads on policy per network, unmanaged devices, ad blocking and no-hardware setup. The other kinds lead on the problems they were built for, which are managed endpoints and enterprise programmes.
| Criterion | Purple Shield | Pure-play DNS filter | Enterprise suite | Zero-trust platform | Appliance |
|---|---|---|---|---|---|
| Built for | Guest and public WiFi estates | Managed and roaming endpoints | Large enterprises, one contract | Enrolled users and devices | A site's edge |
| Unmanaged guest devices | Every device, nothing installed | Covered by network DNS; policy follows managed users | Covered by network DNS; suite value is on managed users | Covered by network DNS; platform value is on enrolled users | Traffic through the box |
| Policy per SSID, VLAN, venue and hour | Yes, each | Per network or location | Per network or identity | Per location or identity | Per box, at each site |
| Ad blocking included | Yes | Ask the vendor | Ask the vendor | Ask the vendor | Ask the vendor |
| Hardware or agents | None | Optional agent for roaming | Optional client for roaming | Client for enrolled devices | An appliance per site |
| If the service fails | Fails closed, across multiple data centres | Depends on the vendor's design | Depends on the vendor's design | Depends on the vendor's design | Depends on the box and its failover |
| Venue estate management | One dashboard for every venue | Multi-location and MSP tools | Large-estate tools | Account-level tools | A console per vendor |
Pricing
How are DNS filtering services priced?
By user, by device, by site or location, by query volume or by network. For guest WiFi the unit matters more than the number, because you do not know your users. Ask for pricing by network, venue or estate, and expect a quote rather than a rate card.
| Pricing unit | Fits | Where it mismatches guest WiFi |
|---|---|---|
| Per user | Offices with a known headcount | Guests are unknown and change every day, so the count is a guess |
| Per device | Managed fleets | Guest devices are unmanaged and not enrolled |
| Per site or location | Venue estates and multi-site retail | Fits well; the question is what each site includes |
| Per query volume | Large, steady networks | A busy venue weekend can move the bill |
| Per network or SSID | WiFi-first estates | Fits well; each network has its own policy |
Shield is priced around your venues and networks. You start with a 30-day free trial, then a Purple expert sends a quote built around your estate, standalone for any WiFi network or as an add-on to Purple Access. There is no appliance to buy and no firewall change to pay for, so the quote has no hardware line. Pricing is not published, because venue estates vary too much for a rate card to be honest.
When others fit
When is another option the right call?
When your users are managed staff on laptops rather than guests on phones, when you buy one security suite for the whole enterprise, or when a regulator requires inspection on-premises. Otherwise, for guest WiFi, a guest-WiFi filter fits better.
Which option fits which situation
Purple Shield
Fits when
- You run guest, student, resident or public WiFi at one site or many.
- You want a policy per network and ad blocking without hardware.
Not when
- Your only users are managed staff and you need per-user policy on laptops.
Pure-play DNS filter or zero-trust platform
Fits when
- The people you are protecting are employees on devices you enrol.
- You want policy that follows the user off the network.
Not when
- The network is mostly guests whose devices you cannot enrol.
Enterprise secure-access suite
Fits when
- You are buying DNS security, web gateway and zero trust in one enterprise programme.
Not when
- You need a venue guest network filtered in minutes without a wider programme.
On-premises appliance
Fits when
- A rule requires traffic to be inspected on site.
Not when
- You run many small sites and cannot staff a box at each.
For guest and public WiFi, start with a DNS filter built for it, and keep your firewall behind it.
Which kind of DNS filter do you need?
Question 1
Is this a guest, public, student or resident network?
See the whole decision as a list
Is this a guest, public, student or resident network?
- Yes
Do you run more than one site or network?
- Yes, an estate
Shield across the estate, with a policy per network
- A single network
Shield on one network
- Yes, an estate
- No, it is staff on managed devices
A pure-play DNS filter or zero-trust platform
Switching
How do you switch DNS filtering provider without an outage?
Run the new filter on one network alongside the old one, copy the policy across, change the DHCP DNS servers in a maintenance window, verify, then retire the old service. The resolver is one setting, so a rollback is the same setting reversed.
Switch one network at a time
Export your current policy
Write down the categories, allow and block lists and schedules on the current filter for each network. This is the policy you will recreate.
Pick one low-risk SSID
Choose a single network, such as one venue's guest WiFi, so a problem touches few people. If your estate runs change control, Purple's engineers plan the pilot with your team or your ICT provider.
Recreate the policy in Shield
Start from a ready-made policy and add your lists, then switch on ad blocking, Safe Search and your branded block page.
Change the resolver in a window
Replace the DNS servers in the DHCP scope for that network with the Shield addresses. Leases renew as devices rejoin or renew.
Check: A device rejoining the SSID is handed the Shield addresses.
Verify and compare
Test a blocked category and an ordinary site, then read Shield's blocked URLs and threat analysis against the old filter's report for the same period.
Roll out and retire
Repeat for each network, then retire the old service. To roll back at any point, put the old DNS servers back in the DHCP scope.
Proof to ask for
What proof should a DNS filtering vendor show you?
Named customers running it on guest WiFi, a measured number for threats stopped, a stated detection lead time, a resilience design and an uptime commitment. Ask every vendor for the same five, Shield included.
| Ask for | Shield's answer |
|---|---|
| Named customers on guest WiFi | Whitbread (hotel guest WiFi), AGS Airports (passenger WiFi at Aberdeen, Glasgow and Southampton) and St George's Healthcare NHS Trust |
| A measured volume of threats stopped | Around 241,000 threats a week blocked on the guest WiFi at St George's |
| Detection lead time | Up to 10 days earlier than standard blocklists for new threats |
| Resilience design | Fails closed, across multiple data centres, so an outage never leaves a network unfiltered |
| Uptime commitment | 99.999% uptime SLA on the Purple platform, which carries 500 million logins a year |
The trial
How do you run a trial that settles the choice?
Run the candidates side by side on one network for a month, and judge them on the same four things: what they blocked, what they missed, how the network felt and how much work they took. Shield's trial is free for 30 days.
- Week 1Point one SSID at ShieldRecreate the policy, force DNS
- Week 2Run the bypass testsHard-coded DNS, VPN app, canary domain
- Week 3Read the threat analysisCallbacks stopped, threats flagged
- Week 4Compare data and decideData used against last month
| Week | Do | Measure |
|---|---|---|
| 1 | Point one SSID at Shield, recreate your policy, force DNS to it | Setup time, blocked URLs, any false blocks |
| 2 | Run the bypass tests from a guest device: hard-coded DNS, VPN app, the Firefox canary domain | Which routes the filter closes |
| 3 | Read the threat analysis and callbacks stopped | Threats flagged, and any your old filter missed |
| 4 | Compare data used and page speed with ad blocking on | Data used on the SSID against the previous month |
At the end, write down the decision against the nine criteria in the scorecard. If Shield did not win on your network, you have lost a month and spent nothing. If it did, you already have the policy and the evidence to roll out.
Proof
Running on guest WiFi at hotels, airports and hospitals
- 241,000threats a week blocked on the guest WiFi at St George's Healthcare NHS Trust
- 10 daysearlier warning of new threats than standard blocklists
- 80,000+venues on the Purple platform Shield runs on, in 90 countries
- 500 millionlogins a year across the Purple platform
- Whitbread
- AGS Airports
- St George's Healthcare NHS Trust
Compare
How Shield compares
| Compared with | Where Shield wins | What it is built for |
|---|---|---|
| DNSFilter | Built for guest and public WiFi, with ad blocking included, a policy per SSID and VLAN and nothing to install | Pure-play protective DNS for managed and roaming endpoints |
| Cisco Umbrella | Purpose-built for WiFi filtering, live in minutes across a multi-site venue estate | A broad secure-access suite, from DNS security to SWG and ZTNA, for large enterprises on quote-based pricing |
| Legacy filtering appliance | No hardware, no firewall change, and it fails closed across multiple data centres | A box at every site that inspects traffic at the network edge |
Glossary
Key terms
- Pure-play DNS filter
- A product that does DNS filtering and little else, usually built for managed and roaming endpoints.
- Secure web gateway (SWG)
- A control that inspects web requests for policy and threats, often with a client or certificate on the device.
- Zero-trust network access (ZTNA)
- Access control that checks the user and device before granting access to each application.
- Policy per SSID
- A separate set of filtering rules for each WiFi network name, so guests, staff and children's areas never share one.
- Fail closed
- If the service cannot answer, protection stays in force rather than the network opening up.
- Roaming client
- Software that carries a DNS filtering policy onto a managed device when it leaves the network.
- Block page
- The page shown when a name is refused. Shield shows your own branded page.
- Proof of concept
- A time-boxed trial on one network that produces the evidence for a buying decision.
The library
All guides in this pillar
What each group of guides covers in DNS filtering alternatives for guest WiFi, so you know where to look.
Comparisons
How Shield compares with the filters buyers shortlist most often.
Buying
Choosing, pricing and trialling DNS filtering.
Questions
Questions about DNS filtering alternatives for guest WiFi
What are the best alternatives to a DNS filtering service for guest WiFi?
Pure-play DNS filters, enterprise secure-access suites, zero-trust platforms, family-focused DNS services and on-premises appliances. Most were built for managed endpoints. Purple Shield is built for guest and public WiFi, with a policy per SSID and VLAN and no hardware.
How is Shield different from DNSFilter?
DNSFilter is pure-play protective DNS for managed and roaming endpoints. Shield is built for guest and public WiFi, with ad blocking included, a policy per SSID and VLAN and nothing to install on any device.
How is Shield different from Cisco Umbrella?
Umbrella is a broad secure-access suite, from DNS security to web gateway and zero trust, for large enterprises on quote-based pricing. Shield is purpose-built for WiFi filtering and live in minutes across a multi-site venue estate.
Do I need hardware to filter guest WiFi?
No. Shield works at the DNS layer, so there is no appliance to buy, no firewall change and nothing to install on devices.
Why is per-user pricing a poor fit for guest WiFi?
Because you do not know your users. Guests change every day and their devices are not enrolled, so a per-user count is a guess. Ask for pricing by network, venue or estate.
How much does Shield cost?
Shield starts with a 30-day free trial. A Purple expert then sends a quote built around your venues and networks. There are no published prices and no hardware line on the invoice.
Can I use Shield with a firewall?
Yes, and you should. Shield blocks the lookup first and covers guest and BYOD devices a firewall agent never touches. It runs behind your firewall, not instead of it.
What if the filtering service goes down?
With Shield, protection does not lapse. It fails closed, so an outage never leaves a network unfiltered, and it runs across multiple data centres so a fault in one does not take your service down.
How long does it take to switch provider?
The resolver is one setting, so switching a network is a DHCP change in a maintenance window. Run Shield on one SSID alongside your current filter, compare the reports, then roll out network by network.
Is Shield only for Purple Access customers?
No. Shield is sold on its own for any WiFi network, and it also bolts onto Purple Access on its open, secure and xPSK networks.
Keep going
Where to go next
On this site
On other Purple products
The wider picture
Reviewed on October 9, 2026