DNS glossary

What is DNS filtering?

DNS filtering is a security control that allows, blocks or redirects domain name queries based on administrator policy and threat intelligence. It operates at the resolver, evaluating the requested name before returning an answer, so a device is stopped from connecting to a prohibited site before any traffic is sent.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DNS filtering is a security control that allows, blocks, or redirects domain name queries at the resolver based on administrator policy and threat intelligence, stopping prohibited connections before they occur. Nearly every network connection begins with a DNS lookup, making the resolver an ideal enforcement point to centrally apply policy across all devices—including unmanaged, guest, and IoT equipment—without requiring security agents on individual endpoints. While DNS filtering effectively blocks phishing sites, malware hosts, and command-and-control domains early in an attack chain and provides query logs to identify suspicious activity, its effectiveness depends on proper management: stale block lists, overly broad categories, unmonitored bypass paths like encrypted DNS, and direct IP connections can create false positives, visibility gaps, and enforcement inconsistencies that undermine protection.

  • DNS filtering operates at the application layer (OSI layer 7) by evaluating domain name queries against allow lists, block lists, category rules, and threat intelligence feeds before the resolver returns an answer or applies actions such as NXDOMAIN responses, sinkhole addresses, or block pages.
  • Clients can bypass DNS filtering by connecting directly to hardcoded IP addresses, using outside resolvers, or employing encrypted DNS protocols, leaving gaps in coverage unless the network restricts these alternative paths.
  • Query logs from the filtering resolver reveal which devices requested blocked domains, enabling security teams to identify and remediate infected hosts without requiring security agents on each endpoint.

DNS filtering at a glance

AttributeValue
CategorySecurity control
Protocol and portApplies to DNS traffic, which uses port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useBlocking access to malicious, unwanted or policy-restricted domains at name resolution
Related termsDNS firewall, response policy zone, recursive resolver, DNS security, threat intelligence, DNS sinkhole

How DNS filtering works

DNS filtering places a policy decision at the point where a client asks a resolver to translate a domain name into an IP address. The resolver checks the name against its rules before it answers.

  1. Client sends a query: A device asks its configured recursive resolver for the address of a domain name, for example when a user opens a web page or an application starts.
  2. Resolver checks policy: The filtering resolver compares the queried name with allow lists, block lists, category rules and threat intelligence feeds. Policy can vary by user, device group or network segment.
  3. Resolver applies an action: If the name is permitted, the resolver resolves it normally. If it is blocked, the resolver returns an error such as NXDOMAIN, an empty answer, or the address of a block page or sinkhole.
  4. Client receives the result: The device either connects to the real destination or is prevented from doing so. The resolver typically logs the query and the action taken for review.

Filtering only covers traffic that uses the filtering resolver. Clients that connect directly to an IP address, or that send queries to an outside resolver, including through encrypted DNS, can bypass it unless the network restricts those paths. Filtering also judges only the name, not page content.

Why DNS filtering matters in enterprise networks

Nearly every connection begins with a DNS lookup, so the resolver is a practical place to enforce policy for every device on a network, including managed laptops, guest devices and IoT equipment that cannot run security agents. A single policy change can take effect across thousands of endpoints without touching each one.

Blocking at resolution stops many threats early. Phishing sites, malware download hosts and command-and-control domains all depend on name lookups, so denying the lookup can cut off an attack before any payload is delivered. Query logs also show which devices asked for blocked names, which helps teams find infected hosts.

Poorly managed filtering causes its own problems. Stale block lists or overly broad categories produce false positives that block legitimate business services, and teams may respond by disabling controls. Unmonitored bypass paths, such as devices using outside resolvers, leave gaps while giving a false sense of coverage. RFC 8499 defines DNS terminology used to describe these resolver roles, and clear ownership of policy, exceptions and logging keeps filtering both effective and trusted.

DNS filtering vs Protective DNS

DNS filtering is the general technique of allowing or blocking names at a resolver, while protective DNS is a security service model that applies filtering and threat intelligence to resolution, usually for an organization or government. What is Protective DNS?

AttributeDNS filteringProtective DNS
ScopeA control that can enforce security, content or acceptable-use policyA security-focused service built around blocking malicious domains
Policy basisAdministrator rules, categories and optional threat feedsPrimarily threat intelligence about malicious domains
Typical useWeb content control and threat blockingReducing exposure to malware, phishing and command-and-control traffic

DNS filtering vs Response Policy Zone (RPZ)

DNS filtering is the goal of controlling which names resolve, while a response policy zone is one mechanism that a recursive resolver can use to apply that policy. What is RPZ?

AttributeDNS filteringResponse Policy Zone (RPZ)
TypeSecurity control or capabilityPolicy mechanism implemented in resolver software
Where policy livesResolver, cloud service or appliance, in a product-specific formA zone file containing policy rules, which can be shared between resolvers
RelationshipCan be built using several methodsOne method of building DNS filtering

Common DNS filtering issues

Devices configured with a hardcoded public resolver, or browsers using DNS over HTTPS, skip the filtering resolver entirely. Blocked sites then load normally for those clients, and the query logs show nothing for them.

Broad category rules or stale block lists can block legitimate sites, content delivery domains or software update hosts. Users report that applications fail or pages load partly, and the cause is found only by searching query logs for the blocked name.

When queries pass through an intermediate forwarder or NAT device, the filtering resolver sees only that device's address. Policy by user or group cannot be applied, and logs cannot identify the originating host.

Clients and downstream resolvers keep answers until the record's time to live expires. A newly added block can take effect late for names already cached, which looks like inconsistent enforcement during testing.

Malware that connects to a hardcoded IP address never issues a lookup, so DNS filtering never sees it. Teams relying only on the resolver miss this traffic unless firewalls or other controls also cover it.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS filtering FAQ

Related terms

Article

Protective DNS

Protective DNS is a cybersecurity technology that proactively blocks access to malicious domains by analyzing and filtering DNS queries in real-time.

Learn more
Article

Response Policy Zone (RPZ)

RPZ (Response Policy Zone) is a DNS zone that allows resolvers to rewrite answers to block, redirect, or log queries to risky or disallowed domains, providing administrators real-time security and policy control.

Learn more
Article

DNS sinkhole

A DNS sinkhole is a DNS server configured to return a false IP address for a domain name to block access to that domain.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

DNS hijacking

DNS hijacking occurs when an attacker changes the IP addresses of a domain's DNS servers to attacker-controlled servers.

Learn more
Article

DNS tunneling

DNS tunneling is a technique that exploits the DNS protocol to tunnel malware and other unauthorized data through a client-server connection.

Learn more
Article

DNS over HTTPS (DoH)

DNS over HTTPS (DoH) encrypts DNS queries and responses by transmitting them over HTTPS, protecting DNS traffic from interception and monitoring.

Learn more
Article

DNS query / DNS request

A DNS query is a request for information sent from a device to a DNS server asking it to resolve a domain name.

Learn more
Browse the full glossary