Nantevo delivers authenticated Protective DNS through a novel transport-layer architecture — no endpoint software, no enrollment friction, no attack surface on your devices. Per-client 1:1 attribution, MDM-native deployment, and cloud, hybrid, or on-premise infrastructure aligned to NIST SP 800-81r3.
Traditional Protective DNS fails at the deployment model. Browsers independently implementing their own DoH bypass corporate controls entirely. Nantevo's transport-layer authentication architecture eliminates both problems simultaneously.
These numbers come from 2.5 years of production telemetry. Ad and tracker filtering doesn't just reduce the attack surface — it removes bandwidth and latency overhead from every device on your network. The FBI explicitly recommends DNS-layer ad blocking as a security control, not a convenience feature.
Architectural choices — not feature additions — with consequences that compound across every device in your fleet from day one.
Every DoH request carries a unique high-entropy endpoint subdomain and ClientID. The reverse proxy validates both before routing to the resolver. Unauthenticated requests receive no response — not an error, silence. DNS is treated as a Policy Enforcement Point in the Zero Trust sense: no query proceeds without verified identity. Per NIST SP 800-207, no network is inherently trusted.
Nantevo generates per-client MDM profiles containing unique high-entropy DoH endpoints pre-bound to unique ClientIDs. Deploy through your existing Apple MDM. OS-level DoH configures silently, system-wide — overriding browser-level DoH, covering every application and process simultaneously. The Encrypted DNS Gap closes the moment the profile installs.
Because every query carries an authenticated client identity, threat telemetry is scoped to the individual device. When RoCi detects a C2 beacon, the SOC gets the exact device, exact timestamp, and exact domain immediately — without needing network access or VPN correlation. This is what eliminates the visibility gap that inflates MTTR on every competitor platform.
RoCi analyzes the telemetry log stream asynchronously — after responses are already delivered. This is an architectural constraint, not a limitation: DNS resolution latency is a hard constraint, AI inference is not. RoCi's detections update the synchronous threat feed, building a defense-in-depth stack that improves with every detection across every client.
The same authentication architecture and RoCi intelligence operate across all three models. What changes is where the resolver runs and where DNS queries travel.
Globally distributed resolver nodes across the US with expansion roadmap to 32 locations. MDM profile push for zero-touch Apple fleet enrollment. Fastest path to full fleet protection — operational within hours of decision. All RoCi intelligence and per-client telemetry included.
Your DoH endpoint lives on your own subdomain. A local forwarding layer in your data center handles internal domain resolution. External queries route upstream to Nantevo resolvers. RoCi threat intelligence and unified per-client telemetry operate seamlessly across both layers.
Complete resolver stack deployed as a virtual appliance in your data center. DNS queries never leave your network. Only anonymized RoCi threat signals stream outbound — query content never crosses your boundary. Sub-10ms response times on-network. CDN outages have zero impact on resolution.
Device coverage was proven across 2.5 years of real households using real devices — not claimed on a spec sheet. Every category below has been operational since October 2023.
Provision, deploy, and activate protection across your entire fleet without touching a single device directly.
Generate a unique MDM configuration profile per client group from the Nantevo dashboard. Each profile contains a unique high-entropy DoH endpoint and bound ClientID — 128-bit entropy per credential, combined authentication required. Per-client filtering policy, content categories, and RoCi sensitivity are configured at this stage.
Deploy through your Apple MDM infrastructure. The profile installs silently at OS level, overriding browser DoH configuration system-wide. No user interaction. No application download. Every application, every process, every DNS query covered simultaneously — including browsers that would otherwise use their own DoH resolver.
From the moment the profile installs, every DNS query is encrypted, authenticated at the proxy, filtered against live threat intelligence, and logged with 1:1 device attribution. RoCi monitors behavioral patterns asynchronously — never in the query path — and surfaces threats with the exact device identity needed for immediate MTTR reduction.
RoCi analyzes per-client DNS query behavior continuously and classifies threats across every authenticated client simultaneously. When she detects a C2 beacon, a DGA pattern, or a tunneling attempt, she pushes a block rule to the synchronous threat feed immediately — cutting the attacker's communication channel before the device can receive a payload.
Enterprise security teams need logs. Nantevo gives you control over exactly what is retained, for how long, and where — without your data ever being used for anything other than your own security operations.
Compliance & framework alignment
What security teams say
"We evaluated three PDNS vendors. Nantevo was the only one that didn't require software on every device. For a team of 200 across four continents, that difference in deployment complexity was the decision."
— Director of Security Engineering, global SaaS company
"The 1:1 attribution caught a compromised laptop within hours of enrollment — something our previous solution would have averaged out of fleet-level data. RoCi gave us the exact device immediately. MTTR went from days to minutes."
— VP Engineering, Series C fintech
"The on-premise appliance was the deciding factor. Our DNS doesn't leave our data center, we get full RoCi intelligence, and a CDN outage has zero impact on our resolution path. That's the Zero Trust architecture we needed."
— CISO, regulated financial services firm
Two and a half years of continuous operation across geographically distributed infrastructure. These are live production metrics from the same platform your organization will run on.
Live demo. Your devices. No software installed before, during, or after.