Go to Security > DNS Security > Settings.
The Settings page has three tabs: General, Block Page, and Safe Search.
General tab
DNS Resolver Configuration
Shows the primary and secondary Trio DNS resolver IP addresses for your organization. These IPs must be pushed to managed devices for DNS Security filtering to work.
To deploy the resolver to devices:
Copy the resolver IP addresses from this section.
Create an MDM network profile (or update DHCP configuration) that sets these IPs as the DNS servers on managed devices.
Assign the profile to the relevant device groups.
Until the resolver is deployed, policies will show as active but no DNS traffic will be filtered. The Deployment Posture section on the Overview page shows the deployment status across your fleet.
Query Log Retention
Sets how long DNS query events are stored. Options: 7 days, 30 days, 90 days.
Longer retention uses more storage. Choose a value that meets your compliance requirements without exceeding your storage constraints.
Note: Events older than the retention period are permanently deleted and cannot be recovered.
SIEM Integration
Forwards DNS query events to an external SIEM or logging system in real time.
To configure:
Enable the SIEM Integration toggle.
Enter the Destination URL for your SIEM endpoint.
Select the Format: JSON, CEF, or Syslog.
Optionally enter an API Key or Auth Token if your endpoint requires authentication.
Click Test Connection to verify the endpoint is reachable and accepting events.
Click Save SIEM Settings.
If the connection test fails, check the destination URL, authentication credentials, and network access from Trio's infrastructure to your endpoint.
Block Page tab
The block page is shown to users on devices where the Block Response Method is set to Sinkhole. Customizing it reduces confusion and IT support tickets when users hit a block.
Changes are reflected in the live preview panel on the right as you type. The preview shows how the block page will appear to users, including the blocked domain, category, and policy name.
Block Page Content
Logo — upload a PNG or SVG (max 200 KB). Displayed at the top of the block page. Remove the current logo with the Remove link.
Title — the main heading shown to users. Default:
Access Blocked. Maximum 80 characters.Message — the explanation shown below the title. Default:
This website has been blocked by your organization's security policy.Maximum 500 characters.Support contact — an email address or URL shown as a link on the block page. Use this to let users request an exception or contact IT. Optional but recommended — block pages without a support contact generate more IT tickets.
Show blocked category — toggle on to display why the domain was blocked (e.g.,
Category: Malware,Category: Social Media). Helps users understand the reason without contacting IT.Show policy name — toggle on to display the name of the policy that blocked the request.
Click Save Block Page Settings after making changes.
To revert all customizations to defaults, click Reset to Defaults. This action cannot be undone.
Safe Search tab
Safe Search enforcement forces managed devices to activate Safe Search on major search engines at the DNS level — independently of browser settings or user preferences. This means users cannot disable Safe Search on a managed device even if they try through browser settings.
Note: Safe Search enforcement applies globally to all managed devices. It is not policy-scoped.
Supported search engines
Google Safe Search — forces
forcesafesearch.google.comat the DNS level.Bing Safe Search — enforces Bing's safe search mode.
YouTube Restricted Mode — enables Restricted Mode on YouTube for all managed devices.
Bing Image Search — enforces safe image search on Bing.
Configure Safe Search
Enable the toggle for each search engine you want to enforce.
Click Save Safe Search Settings.
Changes take effect at the next DNS resolution cycle on managed devices.
Note: Safe Search enforcement cannot be overridden by users on managed devices. Make sure your organization policy supports enforcement before enabling.