Organizations can enforce DNS content and security policies for roaming users by sending DNS queries from the WARP client over DoH in DNS-filtering only mode. This service allows organizations to apply DNS policies by selecting a DoH subdomain from aligned to an existing location and configuring WARP clients to use this DoH subdomain.
The DNS filtering policy configured for that location will be applied to WARP client DNS traffic. When the client connection toggle is enabled, only DNS traffic is sent to Cloudflare Gateway for policy enforcement--all non-DNS traffic is sent directly to the internet.
When DNS filtering is enabled, all other traffic will be sent directly to the Internet. Entering a DoH subdomain for an organization triggers WARP into Teams mode