What Is DNS Filtering? Block Malware and Ads at the Network Level

How DNS Filtering Works

DNS filtering is a technique that uses the DNS lookup process as an enforcement point to control which domains can be accessed on a network. Instead of serving the normal IP address for a domain, a DNS filtering resolver returns a block page IP address or NXDOMAIN (no such domain) response for domains on its blocklist.

When a device on a filtered network tries to load malware-site.com, the DNS query goes to the filtering resolver. The resolver checks its blocklist, finds the domain is flagged, and returns a block page IP instead of the real one. The browser connects to the block page, and the malicious content is never loaded.

This all happens at the DNS layer — before any connection to the actual malicious server is made. This makes DNS filtering extremely efficient: it requires no software on individual devices, works for all network traffic (not just HTTP/HTTPS), and adds virtually no performance overhead.

DNS filtering is distinct from browser-level content blockers (like uBlock Origin) because it:

• Works at the network level, affecting all devices automatically
• Can't be bypassed by individual users without changing DNS settings
• Blocks all traffic types, not just web browsers
• Requires no installation on endpoints

What DNS Filtering Can Block

DNS filtering resolvers maintain categorized databases of domains, updated continuously from multiple threat intelligence sources. Categories typically include:

Security threats:

• Malware distribution sites and drive-by download pages
• Phishing sites impersonating banks, payment processors, and login pages
• Command-and-control (C2) servers used by malware to receive instructions
• Ransomware distribution and payment portals
• Cryptomining scripts that hijack browser CPU cycles
• Exploit kits and malvertising networks

Privacy and tracking:

• Advertising networks and tracking pixels
• Analytics domains that aggregate user behavior across sites
• Fingerprinting scripts and supercookie providers

Content categories (for parental controls and enterprise policies):

• Adult content
• Social media (for workplace productivity)
• Gambling, gaming, and streaming sites
• Peer-to-peer and torrent networks

Free DNS filtering services like Cloudflare 1.1.1.2 (malware blocking only) and Quad9 focus exclusively on security threats. More advanced services like NextDNS and AdGuard DNS add ad blocking and custom category control.

DNS Filtering for Homes and Families

DNS filtering is one of the most effective and friction-free parental control tools available. By configuring it at the router level, every device in the home — phones, tablets, smart TVs, gaming consoles — is protected without installing apps on each one.

Free options:

• Cloudflare for Families: 1.1.1.2 blocks malware; 1.1.1.3 blocks malware + adult content. No account needed — just change DNS settings.
• CleanBrowsing: Free tiers with family and adult filters. Primary: 185.228.168.9 (family filter).
• Quad9: 9.9.9.9 blocks malware and phishing with no configuration needed.

Advanced paid options:

• NextDNS: Highly customizable. Configure allowed/blocked categories, whitelist specific sites, view query logs, set schedules, and create separate profiles for different family members. Free tier (300k queries/month); paid plans from $19.90/year.
• AdGuard DNS: Focuses on ad and tracker blocking with some malware protection. Simple setup, free tier available.

Set it up on your router following our guide on how to change your DNS server, then run a DNS leak test to confirm all devices are using the filtered resolver.

DNS Filtering in Enterprise Environments

For businesses, DNS filtering is a foundational security control, not just an option. Enterprise DNS filtering provides:

Threat prevention: Blocking malware C2 communication prevents infected machines from receiving instructions or exfiltrating data, even if endpoint security is bypassed. Many ransomware attacks rely on DNS to locate their payload servers — DNS filtering can neutralize the attack before encryption begins.

Policy enforcement: Block non-work-related content categories to maintain productivity and compliance. Prevent access to known data exfiltration domains.

Visibility and audit logging: Enterprise DNS filters log every query with timestamps, device identifiers, and outcomes. This provides security teams with network-wide visibility into browsing activity and enables rapid incident investigation.

Leading enterprise DNS filtering solutions:

• Cisco Umbrella: Cloud-delivered DNS security with global Anycast coverage, threat intelligence from Talos, and integration with SIEM tools.
• Infoblox BloxOne Threat Defense: DNS security focused on advanced threat detection using behavioral analytics.
• NextDNS for Teams: Cost-effective cloud DNS with per-device profiles, logs, and analytics. Good for smaller businesses.
• Cloudflare Gateway: Part of Cloudflare Zero Trust, offering DNS filtering with threat intelligence and identity-aware policies.

Limitations and Bypassing DNS Filtering

DNS filtering is a powerful tool but not a complete security solution. Understanding its limitations is essential for setting realistic expectations:

HTTPS doesn't bypass DNS filtering — the DNS lookup still happens before the TLS connection is established, so DNS filtering works regardless of HTTPS.

DoH can bypass DNS filtering — if users or applications use DNS over HTTPS to a resolver outside the filtering system, the filter is bypassed. Enterprises mitigate this by blocking DoH providers at the firewall, or using a DoH-capable filtering resolver that intercepts DoH traffic.

IP direct access bypasses DNS filtering — if malware or a user knows the IP address of a blocked domain, they can connect directly without a DNS query. This is why DNS filtering should be combined with firewall rules and endpoint security.

VPNs bypass DNS filtering — VPN users have their DNS queries routed through the VPN provider's resolvers. Organizations typically block VPN usage via firewall policies or require VPN clients that redirect DNS to the corporate filter.

New domains: Blocklists can't catch brand-new malicious domains instantly. There's always a window between a domain being created and being categorized. Zero-day phishing campaigns specifically exploit this gap.

Use DNS filtering as one layer in a defense-in-depth security strategy alongside endpoint protection, email security, and user education.

Frequently Asked Questions