Protective DNS (DNS filtering)

Protective DNS, or DNS filtering, is a domain name resolution service that refuses to answer, or points to a block page, when a machine asks for the address of a domain known to be malicious. Almost every attack goes through a DNS (Domain Name System) lookup at some point, from the phishing link through to the malware calling back to its command and control server. Cutting it off there is cheap, and it protects everything that goes through the resolver without installing an agent. The service draws on threat intelligence feeds, on blocking domains registered only a few days earlier, and on spotting names churned out by a domain generation algorithm. In the UK, the National Cyber Security Centre (NCSC) runs one for the public sector; in the US, CISA (Cybersecurity and Infrastructure Security Agency) offers one to federal agencies. Cyber applications ask about it as a supporting control, rarely a knockout one, in two steps: is DNS filtering in place, and does it cover machines away from the office? The second question is the one that matters. Filtering set up only on the head office resolver sees nothing of a laptop connecting from a hotel, unless an agent or an always-on VPN forces traffic through it. The underwriter has little way to check this from outside and settles for a declaration, at best proof of a subscription to the service. The blind spots are well known. Malware that connects straight to an IP address, with no name lookup, gets through. DNS over HTTPS (DoH), switched on by a browser or by the malware itself, bypasses the company resolver unless someone has blocked it on the network. Filtering remains one more layer, most useful against mass attacks.