DNS Speed Test

What Is Cisco Umbrella

Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer protection against malware, phishing, and command-and-control callbacks. Originally launched as OpenDNS in 2006 and acquired by Cisco in 2015 for $635 million, Umbrella has evolved into a comprehensive enterprise security solution that goes beyond simple DNS resolution.

Unlike free public DNS services, Cisco Umbrella is a commercial product aimed at organizations. It uses DNS as a security enforcement point to block threats before they reach the network perimeter. Umbrella processes over 200 billion DNS requests daily and uses this visibility to identify and block emerging threats across the global internet.

The platform includes DNS security, cloud-delivered firewall, intrusion prevention, secure web gateway, and cloud access security broker (CASB) capabilities. The DNS layer is the first line of defense, blocking requests to malicious domains before any connection is established.

How DNS Security Works

Cisco Umbrella operates as a recursive DNS resolver with a security enforcement layer. When a user's device sends a DNS query through Umbrella, the resolver checks the requested domain against Cisco Talos threat intelligence. If the domain is associated with malware, phishing, or command-and-control activity, Umbrella returns a block response. If the domain is safe, the query resolves normally.

Umbrella's visibility across its global customer base gives it a unique advantage. When a new domain is created and begins receiving queries from Umbrella-protected networks, the system can analyze the domain's behavior and correlate it with other intelligence signals. This allows Umbrella to block newly registered malicious domains — known as Newly Observed Domains (NODs) — that traditional threat feeds may not have catalogued.

Key Features

Cisco Umbrella includes DNS security with real-time threat blocking, intelligent proxy for selective traffic inspection, cloud-delivered firewall, data loss prevention, and integration with Cisco SecureX for unified security management. The roaming client extends protection to devices off the corporate network, ensuring consistent security regardless of location. Umbrella also provides detailed reporting and analytics for security teams.

Pricing and Tiers

Cisco Umbrella is a paid enterprise product. DNS Essentials starts at approximately $2 per user per month and includes threat blocking and content filtering. DNS Advantage adds intelligent proxy and reporting. Umbrella SIG (Secure Internet Gateway) bundles DNS security with firewall, CASB, and data loss prevention at a higher price point. Free OpenDNS offerings for home users are still available separately.

Setup and Deployment

Cisco Umbrella can be deployed by forwarding DNS traffic from existing network infrastructure to Umbrella's resolvers, by installing the Umbrella roaming client on endpoints, or by integrating Umbrella with Cisco Meraki, Cisco SD-WAN, or third-party network equipment. Organizations typically configure their DHCP or DNS infrastructure to point to Umbrella's DNS servers.

Umbrella vs OpenDNS

OpenDNS is the free consumer-facing DNS service that Cisco acquired and still operates separately from Umbrella. OpenDNS provides basic content filtering and security at no cost using addresses 208.67.222.222 and 208.67.220.220. Umbrella is the enterprise-grade platform with advanced security features, centralized management, and pricing based on user count. Both use Cisco Talos threat intelligence.

Frequently Asked Questions

Related Reading

• DNS Speed Test — Benchmark 17+ Resolvers
• DNS Filtering Guide
• Best DNS for Security

Test Your DNS Speed

See how OpenDNS performs from your location.

Run DNS Speed Test