DNS filtering
Also known as: DNS security, web filtering, content filtering, protective DNS
DNS filtering intercepts the internet's 'address lookup' step and blocks requests to known malicious, phishing, or policy-violating websites.
Because it acts before the connection is made, it can stop malware downloads and phishing pages from ever loading, a simple, low-cost layer of protection for any business.
DNS filtering, explained at three levels
At home
Before your browser can visit a website, it asks a directory, DNS, for the site's numeric address, much like looking up a phone number. DNS filtering puts a careful operator on that directory. When you ask for a site known for scams or malware, the operator refuses to give out the number, so your browser shows a block page instead of loading the dangerous site.
At work
DNS filtering is a security service that checks every website lookup against threat intelligence and policy categories, and blocks requests to malicious or unwanted domains. Because almost every connection starts with a DNS lookup, one setting protects every device that uses the filter. For a business, it stops many phishing pages, malware downloads, and malware callbacks cheaply, with little impact on users.
At home
Here's the sequence. You click a link, and your device asks a DNS resolver for the domain's IP address. Normally your internet provider answers. With filtering, the router or device sends the question to a filtering resolver, such as Quad9, CIRA's Canadian Shield, or Cloudflare's 1.1.1.2, which checks the domain against lists of malware, phishing, and sometimes adult sites. A bad domain gets a block page address instead of the real one.
At work
Business DNS filtering, from products like Cisco Umbrella, DNSFilter, or Cloudflare Gateway, adds policies by group, blocking categories such as gambling or file sharing, and logs of every lookup. In the office, the firewall points DNS at the service. For laptops that leave the building, a small roaming agent sends lookups to the filter from anywhere. Logs show which device tried to reach a malicious domain, which often reveals an infection.
At home
DNS filtering only sees domain names, not the pages or files themselves. Attackers dodge it with freshly registered domains, domain generation algorithms that create thousands of throwaway names, and fast-flux hosting. Encrypted DNS, such as DNS over HTTPS built into browsers, can also skip the filter unless it is managed. While it can't stop everything, in my view it's one of the cheapest layers anyone can add, even at home.
At work
Enterprise DNS security adds blocking of newly observed domains, detection of DNS tunnelling used to sneak data out, and identification of command-and-control callbacks. Policy must address encrypted DNS: browsers using DNS over HTTPS or apps with hard-coded resolvers can bypass the filter, so administrators disable it by policy or block known public resolvers. Over-blocking creates help desk noise, so allow-lists and per-group policies need tuning. Logs should feed the SIEM or MDR provider for investigation.
Real-world examples
At home
Marcus clicked a link in a convincing email before realizing it looked off. The DNS filter his MSP had deployed recognized the destination as a known phishing site and blocked it, showing a warning page instead of the credential-stealing form.
At work
Nadia's agency enabled DNS filtering across all office and remote laptops. Beyond blocking malware domains, it stopped a piece of software from silently contacting a command-and-control server, alerting the MSP to a machine that needed cleaning.
Common confusions
- DNS filtering replaces antivirus or EDR — It's one layer that blocks bad destinations, not a full endpoint defence. It works alongside EDR, email filtering, and backups, each catching what the others miss.
- It slows down the internet — Cloud DNS filtering typically resolves lookups as fast or faster than a default provider, with negligible impact on browsing speed.
- It only works in the office — With a roaming agent, DNS filtering protects laptops anywhere (home, cafe, or on the road) not just on the office network.
For analysts
DNS filtering delivers a lot of protection per dollar: one policy shields every device on the network, blocks a broad class of web threats, and helps enforce acceptable-use rules. It's an easy early win in any small-business security stack.
History & origin
Every website visit starts with a DNS lookup that turns a domain name into an IP address. Security vendors realized this chokepoint was ideal for blocking threats, and DNS filtering services emerged in the 2000s. Cloud-based DNS security matured in the 2010s, offering threat intelligence feeds and content categories. It became a staple MSP control because it's easy to deploy across an entire network with no software on each device.