Advanced Threat Protection

Advanced Threat Protection (ATP) lets you block specific categories of unwanted content at the DNS level. You configure which categories to enable, and the SDK resolves the appropriate DNS IP to use.

Available categories

Category	Description
Adult	Blocks adult and explicit content
Ads	Blocks advertising domains
Malware	Blocks known malware and phishing domains
Trackers	Blocks cross-site tracking domains

Categories can be combined freely. Setting an empty list disables ATP.

Configuring categories

Set the desired categories on the Configuration object. This can be done at any time - for example, when the user updates their preferences.

Swift

let config = sdkManager.getConfiguration()

// Enable categories
config.setAdvancedThreatProtectionCategories(categories: [
    .malware,
    .trackers,
])

// Disable ATP
config.setAdvancedThreatProtectionCategories(categories: [])

// Read active categories
let active = config.getAdvancedThreatProtectionCategories()

Kotlin

 val config = sdkManager.getConfiguration()

// Enable categories
config.setAdvancedThreatProtectionCategories(
    listOf(
        AdvancedThreatProtectionCategory.MALWARE,
        AdvancedThreatProtectionCategory.TRACKERS,
    )
)

// Disable ATP
config.setAdvancedThreatProtectionCategories(emptyList())

// Read active categories
val active = config.getAdvancedThreatProtectionCategories(

Getting the DNS IP

Once categories are configured, call getDnsIp with the user's subscription ID to retrieve the DNS IP to use. This never makes a network request - it derives the DNS IP from the locations dataset already in the local cache, so a call to getFullLocationsForProtocols must have populated that cache first (typically as part of your connection flow).

It returns a DnsIpResult containing the DNS IP together with a cacheState flag. The cache is served even after it expires, so cacheState tells you whether the data was still fresh (Cached) or Stale. If you need a value guaranteed by a fresh network request, use DNS IP Only instead.

Swift

// Configure categories
sdkManager.getConfiguration().setAdvancedThreatProtectionCategories(categories: [
    .malware,
    .ads,
])

// Get the DNS IP from the cached locations dataset
let result = try instanceDiscovery.getDnsIp(subscriptionId: subscriptionId)
let dnsIp = result.dnsIp
if result.cacheState == .stale {
    // Optionally refresh via getFullLocationsForProtocols at a convenient time
}

// Apply DNS IP as the system DNS server

Kotlin

// Configure categories
sdkManager.getConfiguration().setAdvancedThreatProtectionCategories(
    listOf(
        AdvancedThreatProtectionCategory.MALWARE,
        AdvancedThreatProtectionCategory.ADS,
    )
)

// Get the DNS IP from the cached locations dataset
val result = runCatching { instanceDiscovery.getDnsIp(subscriptionId) }.getOrThrow()
val dnsIp = result.dnsIp
if (result.cacheState == CacheState.STALE) {
    // Optionally refresh via getFullLocationsForProtocols at a convenient time
}

// Apply DNS IP as the system DNS server

DnsIpResult

Name	Type	Description
dnsIp	String	The calculated DNS IP address (e.g. 212.115.104.5)
cacheState	CacheState	Cached if the cached dataset was still fresh, Stale if past its expiry

DNS IP Only

Use this when you only need the DNS IP, with no other location data required. It makes a dedicated lightweight request.

Swift

// Configure categories
sdkManager.getConfiguration().setAdvancedThreatProtectionCategories(categories: [
    .malware,
    .ads,
])

// Get only the DNS IP
let dnsIp = try instanceDiscovery.getDnsIpOnly(subscriptionId: subscriptionId)

// Apply DNS IP as the system DNS server

Kotlin

// Configure categories
sdkManager.getConfiguration().setAdvancedThreatProtectionCategories(
    listOf(
        AdvancedThreatProtectionCategory.MALWARE,
        AdvancedThreatProtectionCategory.ADS,
    )
)

// Get only the DNS IP
val dnsIp =
    runCatching { instanceDiscovery.getDnsIpOnly(subscriptionId) }.getOrThrow()

// Apply DNS IP as the system DNS server

Error Handling

Fetching the DNS IP can throw an InstanceDiscoveryException in the following cases:

• EndpointsCacheIsEmptyOrExpired - getDnsIp was called with no cached locations dataset for this subscription. Call getFullLocationsForProtocols first. (Does not apply to getDnsIpOnly, which fetches over the network.)
• DNSSubnetIpInvalid - the server could not return a valid DNS address for the given subscription.
• DNSIPCalculationError - the selected categories could not be applied to the DNS address returned by the server.