DNS filtering for business
A business DNS filter checks every domain lookup from company networks and devices against a category policy. It blocks malware, phishing and unwanted content before a connection starts, for every device, at very low cost per user.
This guide is for IT admins and MSPs planning or improving a rollout: how to design the policy, phase the change, cover remote staff and judge the category data your service depends on.
Why businesses use DNS filtering
If you are new to the mechanism, start with what is DNS filtering. In short, the filter answers or refuses each domain lookup based on what the domain is. For a business, that simple control solves several problems at once.
Fewer infections
Malware delivery, command-and-control and phishing domains are refused for every device, including ones without endpoint software.
Acceptable use
Adult, gambling, hate and illegal drug sites are kept off company networks, which supports HR policy and a safer workplace.
Guest and shared networks
Visitors and contractors get the same baseline protection without accounts or software. See guest Wi-Fi content filtering.
Visibility
Category reports show where traffic goes, which AI tools staff try and which devices keep calling suspicious domains.
AI tool governance
Allow the approved assistant and block unknown AI / LLM Tools domains, using a set of 16,000+ AI-tool domains in 18 categories, updated daily.
Bandwidth on busy sites
Limit Streaming Media and File Sharing/P2P on branch links, warehouses and retail networks where capacity is tight.
Keep it in proportion: DNS filtering is one strong layer, not a full security program. Patching, endpoint protection, multi-factor login, email security and backups still matter.
Build the policy by team, not one rule for all
One flat policy creates two kinds of complaints: blocks that stop real work, and gaps where risky sites stay open. A simple group matrix fixes both. This is a typical starting point for an office of 50 to 500 people.
| Category | All staff | Marketing | Developers | Guests | Shop floor |
|---|---|---|---|---|---|
| Malware / Phishing / Suspicious | Block | Block | Block | Block | Block |
| Adult, Gambling, Illegal Drugs | Block | Block | Block | Block | Block |
| VPN / Proxy / Anonymizers | Block | Block | Log | Block | Block |
| Social Networking | Log | Allow | Log | Allow | Block |
| Streaming Media | Log | Allow | Log | Log | Block |
| AI / LLM Tools | Approved only | Approved only | Approved only | Allow | Block |
| Remote Access Tools | Block | Block | Approved only | Block | Block |
| Developer Tools / Code Hosting | Allow | Allow | Allow | Allow | Log |
| Gaming | Block | Block | Block | Log | Block |
Block: lookup refused. Log: allowed and reported. Allow: no record beyond standard logs. Approved only: allow-list of named services inside the category.
Why remote access tools deserve a rule
Unauthorized remote access tools are a common route in scams and intrusions. Blocking the category and allowing only the tool your IT team uses removes that route. Our guide on how to block remote access tools covers the details.
Use ranked categories for shared sites
Large sites carry several labels. A portal can be News first and Sports second. Rules that act on the primary category, with exceptions for secondary ones, avoid blocking whole portals by accident.
A phased rollout that avoids help desk floods
Switching every block on at once is the fastest way to lose trust in the project. A staged plan over four to six weeks keeps the business on side.
Inventory and log-only
Point one site or VLAN to the filter in monitor mode. Record which categories and domains appear, and which business apps depend on unusual hostnames.
Security categories on
Block Malware / Phishing / Suspicious for everyone. These rarely cause false alarms and deliver the clearest value early.
Content baseline
Enable Adult, Gambling, Illegal Drugs, Hate/Discrimination and anonymizer blocks. Publish the acceptable use summary to staff the same day.
Team rules and allow lists
Apply the group matrix. Add allow entries for partners, payment providers and SaaS tools found in the log-only week.
Bypass controls
Force DNS at the firewall, set encrypted DNS policy on managed browsers, and extend coverage to laptops with an agent.
Review cycle
Look at top blocked domains and user reports each month. Adjust rules, not just individual entries, when a pattern shows.
What to tell staff
- Why the company filters: security first, then acceptable use
- Which kinds of sites are blocked and which are only logged
- How to report a wrong block and how fast to expect a reply
- That logs show domains, not page content or messages
Who signs off
- IT or security owns threat categories and bypass controls
- HR owns content rules that touch conduct
- Team leads approve exceptions for their groups
- Data protection lead approves log retention
Where the category data comes in
Every allow or block decision in the matrix above rests on one question: what is this domain? The answer comes from a category database, and its quality shows up directly in user complaints and missed threats.
| Data property | What it means for the business |
|---|---|
| 120 million categorized domains | Long-tail sites that staff reach through search, email and ads still get a label |
| Top 20 million domains well covered | Those domains account for 99.99% of web traffic and usage, so almost every lookup is decided with confidence |
| About 300,000 new domains labelled daily | Fresh phishing and scam sites are less likely to slip through in their first hours |
| Rechecks after a week and a month | Parked domains that later turn into gambling or adult sites move to the right category |
| Several ranked categories per domain | Rules can act on what a site mainly is, not on a minor section |
| 59 filtering categories plus the IAB taxonomy | Policy categories for security and HR, plus content labels for reporting and analytics |
To see how a domain is labelled today, try the domain lookup tool. The full category list is on the taxonomy page.
Remote and hybrid staff
Office-only filtering protects a shrinking share of working hours. Laptops at home, in hotels and on mobile hotspots need the same policy.
Options that follow the device
- Lightweight DNS agent that sends lookups to the filter from any network
- Encrypted DNS profile pushed by device management
- Always-on company VPN that routes DNS to the office resolver
- Browser policy that sets the company encrypted DNS endpoint
Things to decide up front
- Whether personal devices are in scope at all
- How the agent identifies the user and group
- What happens on captive portals in hotels and airports
- Whether split DNS is needed for internal names
Test roaming coverage the simple way: take a company laptop to a home network and a phone hotspot, then look up a known test domain in a blocked category. If it resolves, the device is not using the filter.
The remote workforce web filtering page covers distributed teams in more depth.
Closing the bypass routes
Every business DNS filter faces the same handful of escape routes. Each one has a standard network or device control.
| Route | Control |
|---|---|
| Manual resolver settings | Allow outbound DNS only from your resolvers, redirect or drop the rest at the firewall |
| Browser encrypted DNS | Set browser policy to your endpoint or disable it, and block well-known public encrypted DNS hostnames. More in DNS over HTTPS and web filtering |
| VPN and proxy apps | Block the VPN / Proxy / Anonymizers category and common tunnel protocols. See how to block proxy sites |
| Privacy relay features in operating systems | Use the documented network signals that tell devices the network disables the relay, and set device policy where managed |
| Tethering to personal phones | Device management rules for company laptops, and an agent so lookups stay filtered |
| Direct IP connections | Firewall rules for known address ranges in high-risk categories |
Reporting that leaders read, and privacy that staff accept
DNS logs show which domains were looked up, when and from which device or user. They do not show page content. Even so, logs are personal data in many countries, so treat them that way.
Useful monthly reports
- Threat blocks by device, to find machines that need cleaning
- Top categories by share of lookups
- AI tool usage by service, approved versus unapproved
- Newly seen domains in risky categories
- Wrong-block reports and how they were resolved
Privacy basics
- Tell staff what is logged and why, in the acceptable use policy
- Keep logs only as long as needed, then delete or aggregate them
- Limit who can see user-level data
- Check local employment and data protection rules, which change over time
- Prefer category data that runs inside your own systems
For regulated sectors, our compliance web filtering guide describes how filtering supports common frameworks.
Running business DNS filtering as an MSP
Managed service providers often run DNS filtering for dozens or hundreds of clients. What works for one office has to scale cleanly across tenants.
Baseline plus overrides
One standard policy for all clients, with client-level allow lists. New tenants are protected on day one.
Per-client reports
Branded monthly summaries make the value visible at renewal time without manual work.
Shared category data
One licensed database across the platform means every client sees the same labels and the same updates.
Fast onboarding
A script that sets resolver, firewall redirect and agent policy per site cuts setup to minutes.
Clear escalation
A single queue for wrong-block reports, with category overrides applied at tenant level first.
Bundled services
DNS filtering pairs well with endpoint, email and backup bundles that MSPs already sell.
See MSP web filtering for platform requirements, and the managed DNS filter page for a hosted option built on our data.
What changes by sector
The core policy is similar everywhere, but each sector adds its own priorities. These notes help you adjust the baseline matrix.
Healthcare
Clinical devices often cannot run agents, so network DNS filtering is the main control. Keep patient-facing guest networks separate and strict. See healthcare web filtering.
Finance
Phishing and lookalike domains are the top concern. Block newly registered domains for staff who handle payments, and log Cryptocurrency and Online Banking lookups for review.
Retail and hospitality
Point-of-sale networks should reach only payment and vendor domains. Guest Wi-Fi needs a family-friendly baseline and bandwidth limits.
Manufacturing
Operational networks with old systems benefit from tight allow lists. Remote Access Tools must be limited to the support tool you actually use.
Professional services
Client data travels on laptops, so roaming coverage matters more than office rules. Cloud Storage / File Hosting rules prevent uploads to unapproved services.
Public sector
Expect written policies, audit trails and data location rules. On-premise category data avoids sending lookups outside the network.
Mistakes that undermine a business DNS filter
These come up again and again in reviews of existing deployments. Each one is easy to fix once you know to look for it.
Only filtering the office network
Laptops spend much of the week elsewhere. Without an agent or profile, the policy simply stops at the door.
Leaving port 53 open to the internet
Any device can then use a public resolver and skip the filter. Redirect or drop outbound DNS that does not come from your resolvers.
Blocking with no explanation
Silent blocks on content categories lead to tickets about "broken internet". Use a block page for policy categories and silent blocks for threats and tracking.
Fixing domains one at a time
If the same type of site keeps getting reported, the rule is wrong, not the domain. Change the category rule and the problem stops repeating.
Ignoring device types
Phones, TVs and scanners call many background hostnames. Give them their own group so their needs do not weaken the staff policy.
Never reading the reports
A monthly look at threat blocks by device often finds an infected machine that nothing else flagged.
How to evaluate a business DNS filtering service
Most services look alike in a demo. These questions separate them, because they test the category data and operations behind the dashboard.
Coverage
How much of your real traffic gets a category, not just how many domains are in the database.
Ask: what share of our log-only week was uncategorized?
New domains
How quickly fresh registrations are labelled and rechecked as their content grows.
Ask: when is a domain registered today first categorized?
Accuracy evidence
Whether accuracy is measured by regular manual validation and reported.
Ask: can we see the latest validation report?
Category depth
Whether categories match your policy needs, such as AI tools, remote access and anonymizers.
Ask: how many categories, and can a domain carry several?
Bypass handling
Whether encrypted DNS, relays and VPNs are handled by design, not left to you.
Ask: what happens when a browser turns on its own encrypted DNS?
Data location
Where logs live and whether category lookups leave your network.
Ask: can the data run on our own resolvers?
Teams comparing broader options can read web filtering software for business, which also covers proxy and agent-based tools.
When DNS is not enough
If you need to block parts of a site, inspect downloads or apply rules to specific paths, add a URL-aware layer such as a secure web gateway. Our guide to what a secure web gateway is explains how the layers fit.
Frequently asked questions
Why do businesses use DNS filtering?
To stop malware and phishing for every device, keep inappropriate content off company networks, support acceptable use rules and see which kinds of sites are used.
Is DNS filtering enough security for a small business?
It is one of the most effective low-cost layers, but combine it with patching, endpoint protection, multi-factor login, email security and backups.
How do you filter DNS for remote employees?
Use an agent or managed encrypted DNS profile on company devices, so lookups reach the filter from any network.
Which categories should a business block?
Security categories for everyone, then Adult, Gambling, Illegal Drugs, Hate/Discrimination, Weapons and anonymizers. Limit social, streaming and gaming by team or time.
Does business DNS filtering record what employees do?
It logs domain lookups, not page content. Set retention and access rules and tell staff what is logged.
Can an MSP run DNS filtering for many clients?
Yes, with a baseline policy, client allow lists and per-client reporting on one shared category database.
How do vendors license your data?
As downloadable files with a lookup API, for internal use or inside a product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment. Details on OEM licensing.
Building a business DNS filtering service?
License 120 million categorized domains in 59 filtering categories, with daily new-domain updates, delivered as files that run inside your own resolvers.
Talk to us