DNS Filtering for Small Business: What It Blocks

DNS filtering is one of the cheapest security controls a small business can turn on, and one of the most effective for the money. It checks every web address your computers try to reach against lists of known-bad and unwanted destinations, then blocks the connection before the page loads. Someone clicks a link in a convincing email, and instead of landing on a page built to steal their password, they get a block screen. That is the whole idea, and it runs quietly in the background once it is set up.

What is DNS filtering, exactly?

DNS is the system that turns a name like example.com into the numeric address your device actually connects to. DNS filtering sits in that lookup step. When a device asks "where is this site?", the filtering service checks the domain first. If the domain is tied to malware, phishing, or a category you have chosen to block, the lookup is refused and the site never loads. Nothing has to reach the computer for the filter to work.

What does DNS filtering block?

The strength of filtering at the DNS layer is that it stops trouble at the connection stage, no matter how the link arrived. It does not care whether the bad address came from an email, a text, a chat message, or a search result.

• Known malware and phishing domains that threat intelligence feeds already flag.
• Command-and-control callbacks from a machine that is already infected, which cuts off the attacker's remote control.
• Malvertising and search-poisoning domains, the fake download and fake support sites that ride on ads and search results. We covered that scam in detail in our guide to malvertising and SEO poisoning.
• Whole categories you decide to restrict, such as adult content, gambling, or file-sharing sites, if that fits your acceptable-use policy.
• Newly registered domains, which attackers spin up by the thousand for short-lived campaigns and which have no business reputation yet.

Why do small businesses need it?

Most attacks begin with a click that leads somewhere it should not. DNSFilter's 2025 Annual Security Report found that one in every 174 DNS requests it processed was malicious, a steep jump from roughly one in 1,000 the year before, and that phishing-related queries rose 203% over the period. Every device on your network makes thousands of those lookups a day.

Small companies get hit for a simple reason: they usually run fewer layers of defense, so a single mistake goes further. Email filtering catches a lot, and antivirus catches some of what slips through, but neither one stops an employee from following a link out of a personal webmail tab or a QR code on a flyer. DNS filtering covers that gap. It is a net under the whole team, not just the inbox.

DNS filtering, firewall, antivirus: how do they fit together?

These are different jobs, and you want all three. A firewall guards the edge of your office network and controls what traffic is allowed in and out. Antivirus or endpoint detection works on the device itself, catching and cleaning malicious files that manage to run. DNS filtering sits earlier in the chain, stopping the connection to a bad destination before anything downloads. If you are still deciding on the perimeter piece, our take on whether a small business needs a firewall pairs well with this.

Does it protect remote and hybrid staff?

It can, and this is where DNS filtering earns its keep for modern teams. You can apply it two ways. At the network level, you point your router or firewall at the filtering service, and everything on that network is covered. For laptops that leave the office, a lightweight roaming client keeps the same protection in place at home, at a client site, or on airport Wi-Fi. That second option matters, because the coffee-shop network is exactly where you have the least control otherwise.

What does it cost, and how hard is setup?

For a small business, DNS filtering usually runs a few dollars per user per month, which puts it among the least expensive security tools you can add. Setup is quick, but there is one habit worth keeping: start in monitor mode. Let it watch traffic for a week without blocking, review what it flags, and add any legitimate business sites to an allowlist. Then switch on enforcement. That short break-in period keeps you from blocking a vendor portal on day one and spending the afternoon fielding complaints.

By Joel Baum. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.

Frequently asked questions

Is DNS filtering the same as a firewall?

No. A firewall controls what network traffic is allowed in and out based on ports, addresses, and rules. DNS filtering works one step earlier, at the moment a device looks up a domain name, and decides whether that specific destination should be reachable at all. They solve different problems, and most secure setups run both together.

Will DNS filtering slow down our internet?

No. The domain lookup happens in a few thousandths of a second whether it is filtered or not, and good filtering services run large, fast networks. In some cases browsing feels a touch quicker because malicious and ad-heavy domains never load. Users almost never notice the filter is there until it blocks something.

Can employees just get around it?

A determined user can try, which is why filtering is paired with a few controls: a roaming client that reapplies policy off-network, locking down the ability to change DNS settings, and blocking known bypass tools. For most small businesses this closes the door on casual workarounds, and the point is to stop accidents far more than to police staff.

Does it replace antivirus or email security?

No, and you should not treat it that way. DNS filtering is one layer that stops connections to bad destinations. You still want endpoint protection on each device and filtering on your email, because attackers try many paths and no single tool catches all of them.

Is a free public DNS resolver good enough for a business?

A free resolver can block some malicious domains, but it gives you no per-user policy, no reporting on what was blocked, no allowlisting, and no roaming protection for laptops. For a business that needs to show what its controls do, often for a cyber insurance application, a managed filtering service is worth the small monthly cost.

Want DNS filtering rolled out across your team without breaking the sites you rely on? See how our managed security services work, or contact The NetSys Group for a complimentary security assessment and we will show you where your current gaps are.