A roaming client is endpoint software that keeps a security policy active when a device leaves the trusted office network. In DNS security, it usually runs on laptops or mobile endpoints and forces DNS lookups through the organization’s approved resolver or filtering service, even on home, hotel, or public Wi-Fi.
This matters because many controls disappear once a user is off-network. Without a roaming client, users can bypass DNS filtering by switching to alternate resolvers, and attackers can exploit that gap to reach phishing pages, malware hosts, or command-and-control infrastructure. A roaming client helps preserve enforcement, logging, and user identity mapping outside the perimeter. Defenders use it to extend policy consistently across remote work, while attackers often try to evade it by disabling the agent, using encrypted DNS paths, or redirecting traffic through unmanaged devices.