Everything You Need To Know About DNS Web Filtering (FAQs)
What Is DNS Filtering?
DNS filtering is the process of filtering web content at the DNS level. With a DNS filter in place, when an end user loads a website, the DNS query is sent to a DNS resolver, using the filtering service. If the web domain is on a blocklist, or contains malicious content, the DNS filtering service will tell the resolver to block the request, preventing a malicious webpage from loading and protecting the user from unsafe content.
DNS filtering can be used to protect employees from harmful and inappropriate web content by enabling admins to enforce policies around which categories of web content is acceptable and not. DNS security tools can also be used to enforce broader network security policies protecting against DNS-based malware attacks.
Phishing is an important use case for DNS filtering. Phishing emails often use links to malicious web pages, such as a fake landing page, in order to steal credentials. With a DNS filter in place, when an end user clicks a harmful link, the phishing website domain is blocked and the user protected against phishing threats.
How Does DNS Filtering Work?
DNS filtering uses the DNS lookup process to filter access to web content for users connected to the DNS Filtering system. DNS filtering services can either filter web content by domain name or by IP address. When filtering by domain name, the DNS process doesn’t take place at all for certain domains. When filtering by IP address, the DNS system resolves the IP address and domain name, but access to the resolved domain is blocked for the user requesting the lookup.
In practice for a user, both methods have the same result. When you look up a blocked domain name, instead of being taken to the webpage, you are taken to a page hosted by the DNS filter. This page should explain that the webpage you have requested has been blocked for being unsafe or inappropriate.
DNS filtering services build block lists of harmful domains or IP addresses, known as blocklists or denylists. These can be shared across providers or built as proprietary lists based on threat intelligence and threat research. The bigger the database of threat research, the more comprehensive the blocklist is likely to be. These blocklists are primarily used to classify malicious domains – sometimes in real time- but they are also used to classify safe web content into categories, such as “Social Media”. Using the DNS filtering service, admins can block access to certain types of safe content in order to enforce company safe usage policies, for example, blocking access to adult material, gambling sites, etc.
What Features Should You Look For In A DNS Filtering Solution?
If you’re considering investing in a DNS filtering solution, there are a number of important features to look for:
- Real-time filtering: It’s important to look for a solution that filters malicious domains in real time, to ensure the best protection against phishing and malware.
- Web security capabilities: The best enterprise DNS filtering solutions provide other security features including secure web gateways, cloud access security brokers and remote browser isolation capabilities.
- Instant categorization of web content: We recommend solutions that instantly categorize web domains, which provides more comprehensive domain filtering.
- Flexible admin policies: Look for a solution that offers flexible admin controls around filtering, including team-based access controls.
- Comprehensive reporting: Reporting is an important benefit of DNS web filtering, so we recommend looking for a solution with advanced analytics in a centrally accessible, easy-to-navigate reporting dashboard.
- No latency issues: We highly recommend conducting a trial to ensure whichever solution you choose does not slow down web browsing for end users.
- Flexible pricing: For SMEs, pricing will be an important consideration. We suggest looking for a cloud-based solution with flexible pricing policies.
- Access controls: Consider access policies such as identity management, activity logs, access and authentication logs, and shadow IT visibility.