DNS Filtering

What is DNS filtering?

Domain name system (DNS) filtering prevents users from accessing unauthorized, inappropriate, or malicious content. Organizations use DNS filtering to control what their employees can browse on company-managed networks to keep data secure.

DNS identifies an internet protocol (IP) address associated with a domain name to access webpages. This enables internet users to type the domain name instead of a nine-digit IP address for accessing web pages. 

A DNS filter blocks the IP address of websites where it suspects threats. It restricts professionals’ access, limiting threats to the organization’s core network. Commonly, a DNS filter blocks websites related to gambling, malware attacks, or pornography. 

Modern organizations leverage DNS security solutions to secure DNS servers and the websites they support. 

Benefits of DNS filtering

DNS filtering blocks access to any site that seems to be a threat. It provides reasonable control over users accessing unwanted content. That's the primary benefit, and there are some more: 

• Meet compliance regulations. DNS filtering meets the requirements of policies such as the Children’s Internet Protection Act (CIPA), the National Institute of Standards and Technology (NIST), and the Health Insurance Portability and Accountability Act (HIPAA).
• Promote productivity. Organizations use DNS filtering to block recreational websites in their systems. It improves the productivity of the employees. Companies can also use time-based DNS filtering to schedule filters for specific periods. For example, blocking social media during working hours.
• Block malware downloads. In case a user within the organization is misled to a site containing malware, it can quickly spread through to the rest of the organization. DNS filtering provides safety against any such malware infections around the clock. 
• Block visits to phishing sites. Phishing attacks can come in any form. They keep a close watch on the victim and can bypass any sort of security control. DNS filtering blocks phishing attacks by preventing access to sites previously exploited by such attacks.
• Eliminate ransomware. DNS filtering solutions go through a blacklist of IP addresses and domains every time a user requests access to a website. It immediately denies access to the user if the website seems to be pushing ransomware.
• Gain insights. Keep tabs on the things going around in the organization. For example, tracking employee productivity, any attempts at visiting blocked sites, etc. 

DNS filtering process

DNS filtering keeps the DNS secure and protects users from being victims of harmful or unwanted activities. Here’s a brief overview of how it maintains security.  

• Domain name registry. All registered domains on the internet have a unique IP address that helps other sites to locate them. To find the website online, the user enters the domain name in the browser. 
• DNS filtering. The page loads after the DNS process’ completion to identify the IP address associated. It uses queries to look up the domain in its internal database. No content will load unless the DNS process is completed.
• DNS blacklisting. During DNS filtering, the browser cannot access the site if it comes across any fraudulent sites or sites blocked by the administrators. DNS keeps track of blocked or malicious sites continuously. 
• DNS whitelisting. Whitelisting contains the list of sites accessible to users. For instance, a list of trusted domains and IPs. It denies access to all sites except those approved by the administrators.

DNS filtering approaches

There are multiple approaches to implementing DNS filtering. Some of the popular approaches implemented across industries are:

• Policy-based DNS filtering blocks websites or domains based on pre-set policies. Organizations can customize policies according to their needs. For example, blocking social media sites during work hours and providing access during lunch breaks. 
• DNS sink-holing redirects a DNS request to an IP address that does not exist–often termed a blackhole IP address.
• DNS filtering with machine learning prevents access to sites based on content. A machine learning algorithm interprets if a website contains malicious content. 

DNS filtering vs. web filtering 

DNS filtering is a type of web filtering that blocks all access to malicious or unwanted domains. It helps organizations to keep their network and users safe. It provides customization options so users can create and follow their policies and avoid unwanted content. 

Web filtering uses several methods to control web traffic. It acts against security breaches by blocking access to specific web pages and sites. When a user requests to access a web source, web filtering scans the website for any unwanted content and then provides access if safe. Web filtering provides more granular control. For instance, Google or Firefox can block certain content from users.

Learn more about DNS spoofing and explore how to protect servers against it.