How to protect staff phones and home laptops from scam sites

Where the office router stops

If your office router is pointed at ZDNS, every computer and phone on that office network is checked before it reaches a fake bank page, a fake courier link or a site on Google's list of suspected phishing and malware sites. That is the right first step, and it is only half the picture.

The moment a sales rep leaves the building with a phone, or an agent logs in from the spare room, they are on a different network. The router in the office never sees those lookups, so none of that protection applies. Scammers do not care where you are standing when you tap the link.

Why South African staff keep switching networks

In most South African workplaces nobody stays on one network for a whole day. When load-shedding hits, home fibre goes down and the laptop quietly moves to a phone hotspot or mobile data. The same phone hops between office Wi-Fi, a coffee shop, the taxi rank and a client's boardroom.

Call-centre agents who now work from home share their connection with family devices, games consoles and whatever else is on the router. A personal WhatsApp message with a fake redelivery fee can land on the same laptop that is open to the customer database.

A setting on one router cannot follow a person through all of that. The protection has to live on the device.

A private address for each device

ZDNS handles this by giving each device its own private address, a short code that ends in .dns.zdns.co.za. You create it yourself from the "Phones & laptops away from the office" card on your dashboard: type a label such as the person's name, click Add device, and the address appears.

The device is then set to use that address for its lookups. Android has a built-in Private DNS setting, iPhones, iPads and Macs use a small profile you download from the dashboard, and Windows 11 has a place for the address in its network settings. There is no app to install.

From then on, the device is protected on home Wi-Fi, on mobile data, in hotels and abroad. Filtering, reports and blocking work the same as for the office, and the device appears as part of your account. An account can have 2 devices per seat, and at least 5 devices, and each address is for one device only.

What happens when a phone is lost or someone leaves

Because every device has its own address, taking one away does not affect anyone else. If a phone is stolen or an employee resigns, click Remove next to that device on the dashboard. The address stops working straight away.

That is much simpler than a shared password or a single address that everyone knows, and it means a lost or departed device can be cut off without touching anyone else's.

An honest note about Android and hotel Wi-Fi

There is one situation worth knowing about. On Android, if Private DNS is switched on and the phone cannot reach ZDNS, it will say "No internet" or "Private DNS server cannot be accessed". The classic example is a hotel or airport Wi-Fi that shows a login page before it lets anything through.

The fix takes a minute. Switch Private DNS to Automatic, which brings normal internet back immediately, open the Wi-Fi login page and sign in, and then switch Private DNS back to the device's address. It is worth telling staff who travel before they need it.

Checking that it works

Open the dashboard on the device itself and press Test my protection. It works on mobile data too, once the device is set up. The dashboard may tell you that the address you are browsing from is not your office address. For a protected device that is away from the office, that is expected, and you do not need to change your office address.

As with all DNS filtering, this is one layer. It checks the names a device asks for, so it does not replace antivirus, updates or sensible caution with unexpected links. What it adds is a safety net that travels with the person.

To add your first device, follow the step-by-step guide at /setup.