In short: Cisco Umbrella DNS servers are the anycast resolvers 208.67.222.222 and 208.67.220.220 for IPv4 and 2620:119:35::35 and 2620:119:53::53 for IPv6, with DNS over HTTPS at doh.umbrella.com. Use only Umbrella resolvers, as two different addresses, then register your network as an identity in the Umbrella dashboard.
The Umbrella DNS server addresses
Umbrella answers lookups from anycast addresses, so your queries go to the nearest Umbrella data centre automatically.
| Protocol | Primary | Secondary |
|---|---|---|
| IPv4 | 208.67.222.222 | 208.67.220.220 |
| IPv6 | 2620:119:35::35 | 2620:119:53::53 |
| DNS over HTTPS | https://doh.umbrella.com/dns-query | - |
Two rules matter more than anything else:
- Use only Umbrella resolvers. Do not mix in your internet provider's servers or another public DNS service as a backup. Devices pick between configured servers, so any non-Umbrella entry is a route around your policy.
- Use two different addresses. Enter both the primary and the secondary, not the same address twice. If a router insists on a third and fourth server, Cisco gives 208.67.220.222 and 208.67.222.220 (or the IPv6 pair) for those entries.
Two more points from Cisco's set-up guidance: some internet providers lock the DNS settings on the router they supply, in which case you configure each computer or use the roaming module instead; and Cisco does not recommend pointing email servers at Umbrella DNS.
Umbrella supports recursive IPv6 resolution and applies security and content filtering to IPv6 traffic, and IPv6 addresses can be registered as network identities. If your network runs IPv6, configure the IPv6 resolvers too, or IPv6 lookups may bypass Umbrella.
These are the same addresses the free OpenDNS service uses. Pointing at them is not enough on its own: Umbrella only applies your organisation's policy once your network is registered as an identity, as covered in the steps below. Our OpenDNS guide explains why.
Before you change anything
- Find out what answers DNS today. In a small office it is usually the router or firewall. With Active Directory it is your domain controllers or other internal DNS servers.
- Note your public IP address. You will register it as a network identity. If your provider changes it from time to time, plan for dynamic IP updates (Umbrella supports dynamic registration for IPv4 only).
- List your internal domains. Anything that must resolve to internal addresses, such as your AD domain or intranet names, must keep resolving locally.
- Agree a policy first. At minimum, decide which security and content categories to block. See Umbrella content filtering.
- Check your package. Network DNS forwarding, roaming and virtual appliances are available in every package; see Umbrella packages.
Point your network at Umbrella
- In the Umbrella dashboard, go to Deployments > Core Identities > Networks and add your network with its public IP address. Doing this from a device on that network is easiest. The network shows as inactive until Umbrella starts receiving its queries.
- Small office without internal DNS: on the router or firewall, set the upstream DNS servers to the two Umbrella IPv4 addresses (and the IPv6 pair if used), and make sure DHCP hands out the router or the Umbrella addresses to clients.
- Network with Windows DNS or AD: leave clients pointing at your domain controllers. On each DNS server, replace the existing forwarders with the Umbrella addresses so only external lookups go to Umbrella. For per-device and per-user reporting, put Umbrella virtual appliances in front instead.
- Dynamic public IP (IPv4 only): select the network identity and mark it as dynamic. Then either install the Umbrella Dynamic IP Updater on a desktop computer that stays on that network and is always powered on, or have your router or a script send updates through Umbrella's Dynamic Network Update API when the address changes.
- Add the network to a DNS policy in the dashboard's policy section and save.
- Repeat for each site, then add the Umbrella Roaming Security Module for laptops that leave the office.
We also recommend blocking outbound DNS on your firewall to anything other than Umbrella (and your internal DNS servers), so devices with hard-coded DNS settings cannot sidestep your policy. If you use Cisco Meraki, see Umbrella and Meraki.
Keep internal domains resolving locally
Never point domain-joined computers straight at Umbrella. Umbrella cannot resolve your private AD domain or internal hostnames, so logons, file shares and printers will fail.
The usual patterns are:
- Forwarders: internal DNS servers answer internal names and forward everything else to Umbrella. Simple, but Umbrella sees every query as coming from your DNS server, so reports cannot tell users or devices apart.
- Umbrella virtual appliances: the VAs forward external lookups to Umbrella and send internal domains to your internal DNS servers, while passing the internal IP address (and, with the AD Connector, the user) to Umbrella. Deploy at least two for redundancy. See the Umbrella virtual appliance guide.
Laptops running the roaming module also need your internal domains listed in the dashboard so they keep resolving them locally on the corporate network or over VPN.
DNS over HTTPS (DoH)
Modern browsers can send lookups over HTTPS to a provider of their choice, which can bypass any DNS-based filter. Umbrella offers its own DoH endpoint at https://doh.umbrella.com/dns-query, a front end for the same resolvers.
- Chrome only switches on DoH automatically when it sees a participating DNS provider, such as the Umbrella resolvers, as the system's DNS servers. Cisco notes that it cannot do this when devices use a local DNS server or the roaming client, and Chrome may leave DoH off on managed, domain-joined or policy-controlled devices.
- Firefox has its own DoH setting that ignores the system DNS. Cisco recommends using Group Policy so Firefox cannot divert lookups away from your DNS settings.
- Managed devices: control each browser's secure DNS setting through policy (Intune, Group Policy or the Google Admin console), either turning it off or pointing it at the Umbrella URL, so users cannot choose another provider.
- Roaming module: laptops running the Umbrella module in Cisco Secure Client already send their lookups to Umbrella, so test any browser DoH change on a pilot group first.
Chromebooks use Cisco Security for Chromebook, a Chrome extension that uses DoH to give Umbrella DNS-layer protection across the whole device. Internal domains can be excluded from Umbrella DoH with the Google Admin console's included and excluded domains setting (ChromeOS 131 and later), so they resolve through your internal DNS.
Test that Umbrella is working
Once the network identity shows as active, check from a device on that network. Cisco publishes test destinations for this:
| Test site | What a working set-up shows |
|---|---|
| welcome.umbrella.com | A 'Welcome to Umbrella' page, confirming your lookups go to Umbrella |
| www.internetbadguys.com | A block page, confirming phishing protection |
| examplemalwaredomain.com | A block page, confirming malware protection |
| examplebotnetdomain.com | A block page, confirming command-and-control protection |
| exampleadultsite.com | A block page, if your policy blocks adult content |
| proxy.opendnstest.com | Confirms the intelligent proxy, where your package includes it and it is enabled |
| ssl-proxy.opendnstest.com | Confirms SSL decryption in the intelligent proxy, where enabled |
These destinations test DNS-layer coverage. Users who are also behind the SIG secure web gateway or a network tunnel may see web-policy results instead, so test DNS and web policies separately. Then open the activity search in Umbrella reporting and confirm the test queries appear against the right identity. For a newly added identity, Cisco says the first report can take up to an hour to appear.
If you would like this done for you across every site, or want a second pair of eyes on an existing set-up, contact us. With Umbrella reaching end of sale on 31 January 2027, we can also check that your DNS design will carry over cleanly to Cisco Secure Access; see Cisco Umbrella end of life.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What are the Cisco Umbrella DNS server IP addresses?
For IPv4, 208.67.222.222 and 208.67.220.220. For IPv6, 2620:119:35::35 and 2620:119:53::53. The DNS over HTTPS endpoint is https://doh.umbrella.com/dns-query. Use both addresses of a pair and no non-Umbrella servers.
Are the Umbrella DNS servers the same as OpenDNS?
Yes, the resolver addresses are shared. What makes the difference is registering your network as an identity in a paid Umbrella organisation, so your policy, reporting and subscription apply. Unregistered traffic is treated as the public OpenDNS service.
Can I add Google DNS as a backup to Umbrella?
No. Cisco advises using only Umbrella resolvers. Devices can use any configured server, so a non-Umbrella backup lets lookups bypass your policy. Umbrella's anycast network provides the resilience instead.
How do I know if Umbrella is working?
Browse to welcome.umbrella.com from a device on the network; a working set-up shows a 'Welcome to Umbrella' page. Then try www.internetbadguys.com, which should show a block page, and check the query appears in the dashboard's activity search.
Should my domain controllers point to Umbrella?
Your domain controllers should keep answering internal names and forward external lookups to Umbrella, or sit behind Umbrella virtual appliances. Do not point domain-joined clients directly at Umbrella, or internal names will stop resolving.