Endpoints
An endpoint is a device or a whole network pointed at DashX for DNS. Use it for anything that cannot run the DashX agent — printers, cameras, guest Wi-Fi, a branch office router.
This tab is visible to super admins only. For normal laptops and servers use Agent DoH instead — it needs no configuration at all.
How DashX identifies the client
- Encrypted DNS (DoH) — the client is identified by the token in the URL. Precise, and it works from anywhere.
- Plain DNS — there is no token, so the client is identified by its source IP. You must register your public ranges.
Add an endpoint
- Go to Secure Access → DNS Filtering → Endpoints.
- Type a name, e.g.
Head office, and click Add endpoint. - You get "Endpoint created — resolvers pick it up within a minute."
Each endpoint card gives you:
- A policy select — Default (auto) or a named policy.
- The DoH URL with a Copy DoH URL button. Paste it into the router, firewall or browser that will use it.
- A networks field for plain DNS.
Register plain-DNS networks
In the CIDR box (placeholder "Plain-DNS networks, e.g. 203.0.113.0/24 (optional)") enter your public egress ranges, comma-separated, then click Save networks.
Two limits to know:
- Ranges wider than /16 are rejected — that is deliberate, a /8 would sweep in other people's traffic.
- A range already claimed by another organization is rejected.
Use the public IP your traffic leaves from, not the internal LAN subnet.
Point the network at DashX
- Router / DHCP: hand out the DashX resolver addresses to clients, and register the site's public IP above.
- Firewall or resolver with DoH support: paste the DoH URL — this is the better option, because the token identifies the site exactly and no IP registration is needed.
Block outbound UDP/53 and TCP/53 to anything except your chosen resolvers at the firewall. Otherwise a device configured with 8.8.8.8 quietly skips filtering entirely.
Removing an endpoint takes a minute to propagate to the resolvers, same as adding one.