Almost every connection to the internet begins with a DNS query, because a device first has to know the IP address for a name, see DNS. This is exactly where a DNS filter comes in. It works for all programs and devices that use the designated resolver, including printers, cameras or guest smartphones that do not run any protection software. This makes it a comparatively simple but effective additional layer of protection.
How does a DNS filter work?
- Devices in the company use a filtering resolver that runs as a cloud service, on the firewall or on a dedicated server.
- For every query, the filter checks the requested name against lists of known malicious domains and against categories such as gambling or advertising.
- If the domain is harmless, the resolver returns the normal response. If it is blocked, it returns no valid address or redirects to a notice page.
- The queries are logged. Conspicuous patterns show whether a device is trying to contact an attacker's command-and-control server.
For laptops outside the corporate network, a small agent or a device configuration handles the redirection to the filter.
Typical examples
- An employee clicks a link in a fraudulent email (phishing). The domain was registered only recently and is already classified as malicious, so the page does not open.
- Malware on a computer tries to reach its control server. The query is blocked and IT receives an alert.
- In the guest Wi-Fi, categories that could damage the company's reputation are blocked.
What companies should keep in mind
- Prevent bypassing: Only allow outgoing DNS queries to the designated resolver, and control encrypted DNS in browsers so that the filter is not bypassed.
- Include mobile devices: The protection should also work outside the office.
- Regulate exceptions: A simple process for pages blocked by mistake increases acceptance.
- Respect data protection: Logs reveal browsing behavior. Define retention periods and access, and inform employees.
- Do not rely on it alone: A DNS filter complements endpoint protection, updates and security awareness, but does not replace them.
How it differs
A DNS filter only sees the domain name, not the full address or the content of a page. A web proxy can inspect content more precisely but is more complex to operate.
View security expertise