DNS filtering helps protect businesses against phishing by analyzing domain queries made by devices and blocking access to destinations identified as malicious or suspicious. When a user clicks on a phishing link, the DNS request needed to locate the domain can be verified before the connection is established. If the domain is associated with a known threat or blocked by company policy, access can be stopped. This protection acts as a complementary layer to firewalls, endpoint security, and identity controls.
What is a DNS filter?
DNS filtering is a technology that analyzes DNS queries made by devices and can allow or block access to specific domains based on security information and company-defined policies.
The Domain Name System (DNS) is responsible for locating the address associated with a domain name. When a user tries to access a website, the device performs a query to find out which address to connect to. With DNS filtering, this request can be analyzed before access to the domain is granted.
The solution can use information such as reputation, threat intelligence, categories, and blocklists to determine whether a query should be allowed or blocked. Thus, DNS also functions as a control point over internet access, in addition to its traditional function of name resolution.
To understand in detail how this technology works and what its applications are in the corporate environment, consult the guide on corporate DNS filtering.
How can a company protect itself against phishing using DNS?
DNS filtering can protect a company against phishing by analyzing domain queries made by devices and preventing the resolution of domains identified as malicious. Therefore, when a user attempts to access a phishing page, the request can be blocked before the device establishes a connection to the destination.
This mechanism acts as an additional layer of protection throughout the internet access process. Instead of relying solely on the user's ability to recognize a fraudulent message, the company can apply a security policy directly to DNS queries.
The process can be understood in four stages:
- The user receives and clicks on a phishing link: the message may arrive via email, messaging app, social media, or another channel.
- The device queries the DNS: to access the requested address, the device needs to find out which server is associated with the domain.
- The query is analyzed: the DNS filter verifies the domain according to security information and policies configured by the company.
- Access is either allowed or blocked: if the domain is associated with a known threat or is restricted by policy, resolution may be blocked. Otherwise, the query proceeds normally.
NIST describes this type of filtering as a way to apply security policies to name resolution. In a Protective DNS implementation, for example, domains known to be used in phishing campaigns or by malicious infrastructure may no longer be resolved normally .
What happens when a user clicks on a phishing link?
Imagine that an employee receives a seemingly legitimate email with a link to a fake login page. The attacker's goal is to trick the user into providing their credentials.
When the link is clicked, the device needs to locate the domain indicated in the URL. This is when the DNS filter can come into play.
If the domain has already been identified as malicious, the query may be blocked, and the device will not receive the necessary resolution to proceed normally to that destination.
In this scenario, the DNS filter creates a barrier between the user's click and access to the fraudulent page. The phishing attempt still occurred, but an additional layer of security can prevent the user from reaching the domain identified as a threat.
How does a DNS filter identify phishing websites?
Identification can utilize different sources of information, including threat intelligence, domain reputation, blocklists, and classification mechanisms.
This information needs to be continuously updated because phishing campaigns can use new domains or change their infrastructure rapidly. Therefore, the quality and timeliness of the intelligence used by the service are important factors for effective filtering.
It is also possible to combine threat information with policies defined by the company itself. In this way, the DNS filter can block both destinations identified as malicious and domains or categories that the organization has decided to restrict.
Does DNS filtering prevent phishing attacks before they happen?
Not exactly. DNS filtering doesn't prevent a phishing message from being received, nor does it prevent a user from clicking on a link. Its action occurs at a later stage, when the device attempts to resolve the domain used by the attack.
Therefore, it is more accurate to say that DNS filtering can block access to certain destinations used in phishing attacks.
This distinction is important for understanding the role of technology. DNS filtering adds a barrier to the attack process, but it remains necessary to combine this protection with email security, multi-factor authentication, endpoint protection, access control, and user awareness.
itself recommends the use of Protective DNS as a measure to protect against phishing and other threats, especially as part of a broader security strategy.
What are the limitations of DNS filtering?
DNS filtering is an important layer of protection, but it cannot identify or block all phishing attacks and other threats. Its blocking capability depends on the information available about the domain, how the solution is implemented, and how the attacker conducts the access attempt.
The main point is that DNS filtering acts on domain name resolution. Therefore, it is especially effective when the destination used by the attack can be identified and blocked at that level. NIST highlights Protective DNS as a mechanism capable of applying policies during resolution and blocking domains known for phishing campaigns or command and control infrastructure.
On the other hand, there are situations where other layers of security are necessary:
| Situation | What can happen with the DNS filter? | What can complement |
|---|---|---|
| Known malicious domain | The query may be blocked before access to the destination. | Other layers remain important for additional protection. |
| Newly created or unclassified domain | The domain may not be identified as a threat at the time of the attempt. | Threat intelligence, email security, endpoint protection, and other layers. |
| Phishing hosted on a legitimate service | The domain used may belong to a legitimate platform and, therefore, not be blocked solely due to domain reputation. | Email security, URL analysis, endpoint protection, and user awareness. |
| Malicious content on a specific path within a legitimate domain | DNS filtering typically works at the domain level, not on the entire content or all paths of the URL. | Web filtering solutions and other controls capable of analyzing the URL or content. |
| Direct access via IP address | There may not be a DNS lookup for the destination that would allow the same domain-based blocking to be applied. | Firewall, endpoint protection, and network controls. |
| Use of VPN, proxy, or unmanaged DNS | Traffic or queries may no longer pass through the DNS infrastructure protected by the company. | Network controls, managed devices, and policies that prevent or monitor these deviations. |
| Credential theft | DNS filtering can block access to certain destinations, but it does not replace identity protection mechanisms. | Multifactor authentication, access policies, and identity controls. |
These limitations help define the role of the DNS filter within the security strategy: a layer capable of blocking many malicious destinations, but which needs to work in conjunction with other controls.
Does the DNS filter block newly created domains?
Not always. One of the challenges of reputation-based filtering is that a domain used in a new campaign may not yet have been classified as malicious when the user tries to access it.
Therefore, a DNS filtering solution relies on mechanisms capable of updating its security information and identifying different risk signals. NIST highlights the use of threat intelligence integrated into the DNS infrastructure to update policies and information used in blocking malicious domains.
Even so, it's not possible to guarantee that every malicious domain will be identified before the first access attempt. This is one of the reasons why DNS filtering should work in conjunction with other layers of protection.
Can a DNS filter analyze the content of a webpage?
Not in the same way as a solution that inspects web content. The DNS filter acts primarily on the domain-related query, before the device establishes a connection with the destination.
This means that a legitimate domain can host different types of content, including a compromised page or a specific path used in an attack, without the entire domain necessarily being identified as malicious.
In these cases, mechanisms capable of analyzing URLs, web content, or endpoint behavior can offer an additional layer of protection.
Can the DNS filter be bypassed?
It can, depending on the architecture adopted and the controls applied by the company.
If a device uses a DNS server different from the one defined by the organization, for example, queries may bypass the filtering infrastructure. The same principle needs to be considered in scenarios that use mechanisms capable of redirecting or encapsulating traffic, such as certain proxies or VPNs.
Therefore, the implementation of DNS filtering must consider how queries will be routed, which devices will be protected, and how the organization will control the use of external DNS.
NIST presents different Protective DNS implementation models, including on-premises services, secure cloud-based recursive services, and hybrid architectures. The choice depends on the infrastructure and needs of each organization.
How to protect remote users and branch offices with DNS filtering?
DNS filtering can protect remote users and branch offices, but how it works depends on where the DNS queries are made and how the solution is configured. To maintain protection outside the main network, queries from devices or distributed networks must still pass through the filtering infrastructure defined by the company.
This allows security policies to be applied even when the user is not directly connected to the network. The strategy can be organized according to the protected environment:
| Environment | How to apply the DNS filter |
|---|---|
| Headquarters | Device queries can be directed to the filtering service used by the company. |
| Branch | The unit's network can utilize the same filtering infrastructure, while maintaining centralized or location-specific policies. |
| Corporate laptop in the office | The device can use the policies applied to the network to which it is connected. |
| Laptop for home office or travel | The device needs to continue directing its DNS queries to the protected infrastructure even outside the corporate network. |
| Environments managed by MSPs | The provider can centralize the administration of policies for different clients and environments, according to the capabilities of the solution used. |
How to protect remote users with DNS filtering?
In a remote environment, the main challenge is ensuring that the device continues to use the protected DNS service even when connected to a home network, public Wi-Fi, or other infrastructure that does not belong to the company.
A solution that comes with the device can maintain the applied filtering policies while the user is out of the office. This way, a corporate laptop can remain subject to the same security rules used by the organization, regardless of the network it is connected to.
This model is especially relevant for companies that adopt remote or hybrid work, because it prevents protection from being limited to the physical perimeter of the corporate network.
How to protect branch offices with DNS filtering?
In branch offices, DNS filtering can be applied at the unit's connection point or through an architecture that directs device queries to a centralized service.
The company can maintain common policies for different locations or establish specific rules for each environment, according to its needs.
A centralized architecture also simplifies administration. Instead of manually replicating all settings across each unit, the IT team can manage policies from a central point and track queries made by different locations.
This is especially useful for organizations that have headquarters, branches, stores, offices, or other geographically distributed units.
How can you maintain the same security policy in different locations?
To maintain a consistent policy, it is necessary to ensure that protected devices and networks utilize the filtering infrastructure defined by the company.
The organization can establish general rules for all environments and, when necessary, create specific policies for certain locations, groups, or devices.
For example, a company might apply a policy to block malicious domains across the entire organization while simultaneously establishing additional rules for a branch office or group of devices with specific needs.
This combination of centralized policies and specific configurations allows filtering to be tailored to the company's structure without losing control over protection.
What should an MSP consider when securing multiple environments?
For a Managed Service Provider (MSP), the challenge is to manage different clients, networks, devices, and policies without turning the operation into a sequence of manual configurations.
In this scenario, centralized management resources can facilitate the application of security policies, the monitoring of DNS queries, and the identification of attempts to access blocked destinations in different environments.
The MSP also needs to consider separating policies between clients and the possibility of adapting the rules to the needs of each organization. The ideal structure depends on the solution used and the architecture of each environment.
Does the DNS filter work outside the corporate network?
It can work, provided the implementation manages to keep DNS queries from devices or networks directed to the protected service.
A configuration made only on the router or DNS server of a branch office, for example, does not automatically follow a laptop when it leaves that network.
Therefore, companies with remote users should assess whether the solution offers mechanisms to protect devices outside the corporate network. Similarly, organizations with multiple units should verify how policies will be applied and managed in each location.
The goal is to prevent protection from existing only within the company's perimeter and failing to monitor devices in environments where users remain exposed to links, domains, and other internet threats.
Does a DNS filter replace a firewall?
No. DNS filtering does not replace a firewall. The two technologies operate at different layers and can be used together to enhance network protection.
DNS filtering primarily acts on domain queries, allowing or blocking access to destinations based on security information and company-defined policies. Firewalls, on the other hand, control network traffic according to rules related to connections, IP addresses, ports, and protocols.
What is the difference between a DNS filter and a firewall?
| Feature | DNS Filter | Firewall |
|---|---|---|
| Main function | Analyze and filter DNS queries | Control network traffic |
| What can you control? | Domains, categories and destinations | IPs, ports, protocols, and connections |
| Performance | In resolving the domain | In traffic between networks, devices, and services |
| Use against phishing | It can block domains identified as malicious | It can block certain traffic and connections |
| Role in security | Filtering and access control layer | Network control and protection layer |
In practice, a DNS filter can prevent a device from resolving a domain associated with a threat, while a firewall can control whether a network connection should be allowed according to its rules.
Why use a DNS filter along with a firewall?
Combining the two technologies allows for the creation of different control points within the infrastructure. The firewall remains responsible for controlling network traffic, while DNS filtering adds a specific layer for analyzing domain queries.
This combination is especially relevant against threats that rely on communication with specific domains, such as phishing, malware, and servers used for command and control.
The goal is not to replace one technology with another, but to reduce dependence on a single layer of protection. In a defense-in-depth strategy, network controls, DNS, endpoints, and identity act in a complementary way.
How can this protection be applied in practice?
Implementing DNS filtering against phishing requires more than just defining a list of blocked domains. It's necessary to ensure that the company's devices and networks use the protected DNS service and that the policies are applied consistently.
To put this protection into practice, the IT team can follow a few steps:
- Define which environments will be protected: include headquarters, branches, corporate laptops, and remotely used devices.
- Directing DNS queries to the filtering service: protection depends on queries passing through the DNS configured by the company. Devices using external DNS servers may fall outside the policies.
- Configure security policies: Use reputation information and threat intelligence to block malicious targets and define additional restrictions according to the organization's needs.
- Ensuring protection outside the corporate network: laptops used for home work, travel, or other networks must remain subject to security policies even when not connected to the company's infrastructure.
- Separate policies by location, group, and device: different environments may require specific rules, without losing centralized administration.
- Monitoring queries and blocks: logs and reports help identify attempts to access malicious domains, understand network behavior, and adjust policies.
- Integrating DNS with other security layers— firewall, endpoint protection, email security, MFA, and identity controls—remains necessary to address threats that DNS filtering alone cannot block.
For MSPs that manage different clients, centralization also facilitates policy enforcement, tracking of blocks, and maintaining security standards across multiple environments.
The main point is to ensure that DNS filtering is present wherever the queries are performed. A policy configured only on the main DNS server, for example, does not automatically guarantee the same protection for a laptop used on a home network.
How does Lumiun DNS fit into this strategy?
Lumiun Lumiun DNS applies DNS filtering as a layer of protection to control and monitor the company's internet access. The solution allows you to apply security policies to DNS queries and block domains associated with threats or categories defined by the organization.
Protection can be organized according to different company environments, using locations, groups, and devices. This allows policies to be adapted to the needs of each unit or set of devices without relying on a single rule for the entire organization.
For companies with hybrid or remote teams, ActiveNet, currently available for Windows devices, allows access policies to remain in place even outside the corporate network.
The solution also provides logs and reports that help track queries performed, blocks applied, and destinations accessed by devices. This information can support the IT team in identifying suspicious behavior and reviewing security policies.
For MSPs, the ability to centrally manage different environments facilitates the application of policies and the monitoring of the protection of different clients.
Lumiun DNS, therefore, can act as an additional layer within the company's security architecture. It does not replace firewalls, endpoint protection, email security, or identity controls, but complements these technologies by applying policies directly to domain access.
Frequently asked questions about DNS filtering
Does DNS filtering slow down the internet?
Filtering adds an analysis step to DNS queries, but this doesn't necessarily mean a noticeable reduction in browsing speed. The impact depends on the infrastructure, the location of the servers, and the service used.
Does DNS filtering allow you to control website categories?
Yes. In addition to blocking domains identified as malicious, a DNS filtering solution can enable policies based on content categories. The company can, for example, define different rules for groups, locations, or devices according to its access needs.
What is the difference between DNS filtering and email security?
The two technologies operate at different times. Email security can analyze received messages, senders, attachments, and links, while DNS filtering acts when the device attempts to resolve a destination's domain.
Therefore, the technologies are complementary: email security can help prevent a malicious message from reaching the user, while DNS filtering can block access to a domain identified as a threat if the user tries to access it.
Can DNS filtering help protect against malicious links received via WhatsApp, SMS, or other apps?
Yes. The channel used to receive the link does not determine the action of the DNS filter. If the user clicks on a link and the device needs to query the corresponding domain, the request may be analyzed by the filtering service.
This allows you to add a layer of protection against malicious links received through various means, as long as the device is using a protected DNS infrastructure.
Can a DNS filter block websites by category?
Yes. Depending on the solution used, the company can create policies for categories of websites and apply different rules according to groups, devices, or locations.
This feature expands the use of DNS filtering beyond phishing protection, also allowing control over internet access according to the organization's policies.
DNS filtering reduces exposure to phishing, but it shouldn't work alone
DNS filtering helps to stop some phishing attacks by blocking the resolution of domains identified as malicious before the user reaches the fraudulent page. Its advantage lies in adding a technical barrier even after the user has clicked on the link.
This protection has its limits. Newly created domains, pages hosted on legitimate services, and attacks that don't rely on a known malicious domain require additional layers, such as email security, endpoint protection, firewalls, and MFA.
For companies and MSPs, the most important point is to keep this layer active where users actually browse, both at headquarters, in branches, and on remote devices. Lumiun DNS can be part of this strategy with DNS security, browsing policies, and centralized management.
