What is a DNS filter?
A DNS filter is a security service that checks each domain name a device tries to look up, from a link in an email to a site typed into a browser, against lists of known malicious and banned sites, and refuses to answer for the bad ones, so the connection never starts.
DNS Filtering is a security control that inspects domain name lookups and refuses to resolve the ones that lead to known malicious or unwanted sites. Every time a computer visits a website, opens a link in an email, or contacts a server in the background, it first asks the Domain Name System to translate a name into an IP address. A filtering resolver answers that question only when the destination passes its checks.
The filtering service maintains lists of domains associated with phishing, malware distribution, command-and-control servers, and newly registered domains that have no reputation yet. It also groups sites into categories, such as gambling or adult content, so a business can enforce an acceptable use policy. When a lookup matches a blocked entry, the resolver returns a block page or no answer at all, and the connection never happens. Because the check occurs before any traffic flows, a malicious page cannot load and malware that is already on a machine cannot reach its operator. Most services install a small agent on laptops so the protection follows the device off the office network.
For a small or mid-sized business DNS filtering is one of the cheapest controls with the broadest effect. It stops many phishing links even when an employee clicks, blocks the fake software download sites that malvertising campaigns push to the top of search results, and gives an administrator a log of which device tried to reach what. It is a complement to endpoint protection rather than a replacement, since it cannot see traffic that bypasses DNS or content served from a legitimate but compromised domain.
NetSys includes DNS filtering in its managed IT and network security services and manages the policy on the client's behalf, adjusting category blocks to match how the business works. Logs feed the same 24/7 monitoring the firm uses for endpoints, so a burst of blocked lookups from one machine is treated as a signal to investigate rather than a statistic to file.
Why it matters for a small business
Most attacks on a small business begin with a click, and most of those clicks lead to a domain that security researchers have already flagged. DNS filtering breaks the chain at that moment without asking anything of the employee. It also covers the devices that traditional firewalls miss, such as laptops on home Wi-Fi and phones on cellular data. Setup takes an afternoon, the policy is easy to explain to staff, and the logs give you a plain answer when someone asks whether a suspicious email did any damage.
DNS Filtering: FAQs
What does DNS filtering do?
DNS filtering stops devices from connecting to dangerous or prohibited websites by refusing to translate their domain names into IP addresses. When an employee clicks a phishing link or a program tries to contact a malware server, the filtering resolver checks the domain against threat lists and category rules, and if it matches, the connection is blocked before any data moves. It works for web browsing and for background traffic from installed software alike.
Is DNS filtering the same as a firewall?
No. A firewall controls traffic based on addresses, ports, and inspected content, usually at the edge of the office network. DNS filtering controls which destinations a device is allowed to look up at all, and with an agent installed it works wherever the device goes. The two overlap on some threats but catch different things, and most businesses run both. DNS filtering is simpler to deploy and is often the first control added when staff work from home.
Does DNS filtering protect remote workers?
It does when the service is deployed with an endpoint agent rather than only at the office router. The agent forces the laptop or desktop to use the filtering resolver no matter which network it joins, so a home connection or a hotel Wi-Fi gets the same protection as the office. Policies can also be set per user group, which lets a business apply stricter rules to shared kiosks than to the finance team.
What is included in a DNS filtering service?
A business DNS filtering service usually includes threat lists that block phishing, malware and command-and-control domains; category controls for an acceptable use policy; an agent for laptops so protection follows them off the office network; separate policies for different groups; and logs showing which device tried to reach which domain. When the service is managed for you, someone also reviews the blocked lookups and adjusts the policy when a legitimate site is caught.
How is DNS filtering set up?
At the office, the firewall or router is pointed at the filtering service's resolvers so every device on the network uses them. Laptops and desktops get a small agent that does the same wherever they connect. The policy usually runs in a lenient or log-only mode for a few days first, then threat and category blocks are switched on and exceptions are added for legitimate sites that get caught.
More terms
Discuss network security & firewall management for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.