This article lists the IP addresses, URLs, and ports required for CyberFOX DNS Filtering to operate correctly. The endpoints you need to allowlist depend on your deployment type:

• Static Locations (router/firewall): DNS Anycast IPs and DNS Forwarding Servers on port 53 UDP, plus the Management Portal on 443 TCP.
• Roaming Devices (DoH/DoT): DoH Anycast IPs on ports 80, 443, and 853 TCP, plus the DNS Service and Registration/Update service.
• Roaming Client (Windows agent): All of the above, plus the Roaming Client Loopback Listener on 127.0.0.1:53 UDP.

All endpoints in the table below must be reachable for their respective deployment type. Port usage summary:

• Ports 80 and 443 — HTTP, HTTPS, and DNS over HTTPS (DoH)
• Port 53 — Standard DNS (UDP; also TCP for large responses)
• Port 853 — DNS over TLS (DoT)

*DNS uses UDP for most queries but falls back to TCP for responses exceeding 512 bytes, zone transfers, and EDNS0 payloads. Enterprise firewalls with strict rules need TCP 53 open as well.