DNS Filtering Explained: How One Tool Blocks Most Malware Before It Lands
DNS filtering is one of those security controls that delivers exceptional value for relatively modest cost, yet most small businesses don't have it in place. Understanding why it's so effective starts with understanding how the Domain Name System works and how attackers exploit it.
How DNS Works
Every time you visit a website, send an email, or connect to an application, your device first performs a DNS lookup. It translates the human-readable domain name — say, a website address — into the IP address that computers use to actually locate and connect to the resource. This happens so quickly and invisibly that most users are unaware of it.
DNS is fundamental infrastructure. Every internet connection starts with DNS. And this creates a unique opportunity: by filtering DNS requests, you can prevent connections to malicious destinations before any data is exchanged.
How DNS Filtering Works
A DNS filtering service replaces or sits in front of your default DNS resolver. When a device makes a DNS request, the filtering service checks the requested domain against threat intelligence databases — lists of domains known to host malware, phishing content, command-and-control infrastructure, or other malicious content.
If the requested domain is on the blocklist, the DNS filtering service returns a non-existent address rather than the real one. The connection never completes. The malware payload never downloads. The phishing page never loads. The command-and-control beacon never reaches the attacker's infrastructure.
This happens in milliseconds, before any content is transferred, before any code executes, before any harm is done.
Why It's So Effective
The effectiveness of DNS filtering comes from its position in the connection chain. By the time traditional endpoint security would detect malware, it's already been downloaded and started executing. DNS filtering intervenes before the download happens.
Modern threat intelligence services track millions of malicious domains and update their blocklists in near real-time. When a new malware campaign begins and new malicious domains are registered, they're typically added to threat intelligence databases within minutes or hours. DNS filtering blocks connections to those domains for all protected users immediately.
DNS filtering also catches threats that aren't malware in the traditional sense. Phishing sites, typosquatted domains (sites that mimic legitimate businesses with subtly different domain names), and infrastructure used in business email compromise attacks all generate DNS requests that can be blocked.
Ransomware command-and-control communication is particularly well suited to DNS filtering. Many ransomware variants need to communicate with attacker-controlled infrastructure to receive encryption keys and send confirmation that a system is infected. Block that DNS communication and you interrupt the ransomware's operation — even if it's already executing on the device.
What DNS Filtering Doesn't Do
DNS filtering is not a complete security solution. It doesn't protect against threats that come through already-established connections, encrypted traffic that bypasses DNS (though this is rare for typical malware), or attacks that use legitimate services to host malicious content (a malicious file on a major cloud platform may not trigger a DNS block on the hosting domain).
It also doesn't replace endpoint security, email filtering, or other controls. It's one layer in a defence-in-depth approach, not a standalone solution.
Practical Implementation
DNS filtering can be deployed in several ways. Network-level deployment — configuring your router to use a filtering DNS service — protects all devices on the network without any client-side configuration. Agent-based deployment installs a lightweight agent on each device, extending protection to devices that operate outside the corporate network (laptops, remote workers).
The most effective approach for most businesses is a combination: network-level filtering for office-based devices, agent-based filtering for laptops and remote users. This ensures consistent protection regardless of where devices are operating.
Commercial DNS filtering services are available at a few pounds per user per month — one of the best value security investments available. Providers like Cisco Umbrella, Cloudflare Gateway, and similar services provide enterprise-quality threat intelligence with straightforward deployment.
Getting It Right
The configuration of DNS filtering is important. An overly aggressive policy blocks legitimate sites and creates user frustration. An insufficiently aggressive policy leaves meaningful threats through. Most services provide category-based filtering — you can block categories like known malware, phishing, command and control, and adult content without needing to manage individual domain lists.
Reporting and alerting from DNS filtering also provides valuable visibility. When DNS filtering blocks a request, that's a data point about what threats are targeting your users. Regular review of blocked request logs can identify users who may have been targeted by phishing campaigns, devices that may already be infected and trying to communicate with malware infrastructure, and patterns in the threats your business faces.
If DNS filtering isn't currently part of your security stack, it should be. We can help you get it in place quickly and inexpensively. Get in touch for a conversation about what's right for your environment.