What is DNS filtering?
DNS filtering controls internet access at the very first step of every connection: the moment a device asks which address belongs to a domain name. If the name sits in a blocked category, the answer never comes back, and the site never loads.
This guide explains how a DNS filter works, what it can and cannot see, how people try to get around it, and what to look for in the category data behind it.
DNS filtering in one minute
Every visit to a website starts with a Domain Name System query. The device asks a resolver to turn a name like news.example into an IP address. A DNS filter is a resolver that checks the name against a policy before it answers.
Because almost every app, browser and device depends on DNS, a filter at this layer covers laptops, phones, smart TVs and guest devices without installing anything on them. That reach is the main reason DNS content filtering is so widely used.
Short definition: DNS filtering is the practice of allowing, blocking or redirecting domain name lookups according to the category or reputation of the domain, so unwanted or dangerous sites are stopped before a connection is made.
How does DNS filtering work, step by step?
The flow below is the same whether the filter runs as a cloud service, an appliance in a server room, a feature in a router or a resolver run by an internet provider.
The query arrives
A device sends a lookup for a hostname. The resolver notes the source address, network or device identity so it knows which policy to apply.
Local lists first
The resolver checks admin allow and block lists. An explicit allow entry wins, so a business partner on a shared host never gets caught by a broad rule.
Security check
The name is compared with malware, phishing and suspicious feeds. Threat categories are normally blocked for everyone, whatever the content policy says.
Category lookup
The domain, and if needed its parent domain, is looked up in a category database. A domain can carry several categories, ranked by how much of the site each describes.
Policy decision
The categories are matched against the group's rules: block Adult and Gambling, allow News, log Streaming Media, and so on.
Answer and log
The resolver returns the real address, a block page address or an empty answer, and writes a log line for reporting and investigations.
What a blocked answer looks like
Filters differ in how they say no. The choice affects user experience, troubleshooting and how well apps behave.
| Response | What the device sees | Good for | Watch out for |
|---|---|---|---|
| NXDOMAIN | The domain does not exist | Quiet blocking of trackers, malware and IoT noise | Users think the site is down and call the help desk |
| Block page address | An address that serves an explanation page | Telling users why, offering an unblock request | HTTPS sites show a certificate warning unless a trusted certificate is deployed |
| 0.0.0.0 or similar sinkhole | An address that leads nowhere | Simple, fast, widely used in hosts-style lists | Some apps retry repeatedly and drain battery |
| REFUSED | The resolver declines to answer | Rarely used for content, sometimes for abuse control | Devices may fall back to another resolver |
| Safe rewrite | A different address for the same service | Forcing restricted or safe-search modes on search and video | Needs maintenance when services change hostnames |
What DNS filtering is good at, and where it stops
DNS filtering sees a domain name and nothing else. That makes it fast and private, and it also sets clear limits. Knowing both sides avoids surprises after rollout.
Strong at
- Blocking whole sites by category: adult, gambling, dating, weapons, illegal drugs
- Stopping malware callbacks and phishing domains for every device at once
- Covering devices you cannot install software on, such as TVs, printers and guest phones
- Working the same way for HTTPS sites, because the lookup comes before encryption
- Low cost per user and low latency, with answers cached for repeat visits
- Giving clear reports of which categories users try to reach
Cannot do alone
- Block one page or path on a large site while allowing the rest
- See search terms, video titles or text typed into a page
- Stop traffic that uses raw IP addresses without a lookup
- Inspect file downloads for malware
- Separate good and bad content on the same shared hostname
- Protect devices that ignore the network resolver unless bypass controls are in place
For page-level control you need a proxy, firewall or agent that sees full URLs. Our DNS filtering vs web filtering comparison sets the two layers side by side, and what is URL filtering explains the second layer in depth.
What can a DNS filter block?
Most policies combine security categories that are blocked for everyone with content categories that vary by group. These are the families admins use most often.
Threats
Malware / Phishing / Suspicious domains, plus newly registered domains during their riskiest first days. See our phishing and malware domain feed guide.
Adult and restricted
Adult, Gambling, Illegal Drugs, Weapons, Violence and Hate/Discrimination. The adult content category is usually the first one enabled.
Bypass tools
VPN / Proxy / Anonymizers and URL Shorteners, which keep the rest of the policy working. Details on the VPN and proxy category page.
Productivity and bandwidth
Streaming Media, Gaming, Social Networking and File Sharing/P2P, often limited by time of day rather than blocked.
AI tools
AI / LLM Tools, where many companies allow approved assistants and block the rest. Our AI tools set covers 16,000+ domains in 18 categories, updated daily.
Noise
Advertising/Marketing and Parked / For-Sale Domains, blocked to cut clutter, tracking and low-value traffic.
The full list of labels and how they nest is on the web filtering categories page. If you want to stop a specific group of sites, the guide on how to block websites by category walks through the policy steps.
How users bypass DNS filtering, and how to close each gap
A DNS filter only works when devices actually use it. Every serious deployment plans for these routes from day one.
Changing the resolver
A user types a public resolver address into network settings. Fix: allow outbound port 53 only from your resolver and redirect other DNS traffic to it at the firewall.
Encrypted DNS in apps
Browsers and operating systems can send DNS over HTTPS or over TLS to their own provider. Fix: manage the setting by policy, block known encrypted DNS endpoints, and see our DNS over HTTPS and web filtering guide.
VPN and proxy apps
A tunnel carries both DNS and traffic out of reach. Fix: block the VPN / Proxy / Anonymizers category, block common VPN ports and protocols, and follow how to block VPN apps.
Hosts files and raw IPs
A device skips DNS for a site by hard-coding the address. Fix: pair DNS filtering with firewall rules for known IP ranges, and use endpoint controls on managed devices.
Mobile data
Phones leave Wi-Fi and use the carrier network. Fix: for managed phones, push a DNS profile or agent so the policy follows the device.
Translators and caches
Pages viewed through translation or cache services appear under another domain. Fix: categorize those services and decide on them deliberately.
Ways to deploy DNS filtering
The right model depends on who manages the network and whether users leave it. Many organizations mix two of these.
| Model | How it works | Best fit | Main trade-off |
|---|---|---|---|
| Cloud resolver | Networks or devices send queries to a hosted filtering service | Small and mid-size offices, schools, MSP clients | Depends on the provider's data and uptime |
| On-premise resolver | A server or appliance in your network holds the category data locally | Regulated sites, air-gapped networks, large campuses | You run updates and capacity yourself |
| Router or gateway feature | Filtering built into the edge device that hands out DNS settings | Homes, branches, retail sites, guest Wi-Fi | Limited reporting on low-end hardware |
| Endpoint agent | Software on the device intercepts lookups and applies the policy anywhere | Remote staff, laptops, managed phones | Needs installation and management |
| Provider level | The internet provider's resolvers apply an opt-in family or business policy | Consumer and small business subscribers | Coarse groups, limited per-user control |
For business rollouts, our guide to DNS filtering for business covers policy design and reporting. Providers building family services should read ISP-level content filtering, and hardware makers can start with router content filtering for OEMs.
Why the category data decides how good a DNS filter is
The resolver software is rarely what separates a good DNS filter from a frustrating one. The quality of the domain categories is. Users notice two failures: a needed site blocked by mistake, or an unwanted site left open.
Coverage of real traffic
The 20 million most visited domains cover 99.99% of web traffic and usage. If those are categorized well, almost every lookup gets a confident answer.
New domains, fast
About 300,000 newly registered domains are categorized each day, then checked again after a week and after a month, because many sites add content after launch.
Ranked, multiple labels
A domain can carry several categories ordered by how much of the site each describes. That lets policy treat a news site with a sports section differently from a betting site.
Measured accuracy
Regular manual validations measure accuracy, and validation reports are available to licence holders.
Runs locally
Data delivered as CSV, Parquet or JSON files runs inside your own resolver, with no per-lookup call to an outside service.
Ready formats
Licensed customers can export DNS RPZ, hosts files and resolver list formats. See blocklist formats.
You can check how any domain is labelled with the domain lookup tool, and the full category list shows every label a domain can carry.
A rollout checklist for DNS content filtering
Use this list when you move from a test network to the whole organization. Each item prevents a common support ticket.
- Write down which groups exist and which categories each group blocks
- Start in log-only mode for a week to see real category traffic
- Block threat categories for everyone from the first day
- Add allow entries for business-critical partners and SaaS tools
- Force outbound DNS through the filter at the firewall
- Set encrypted DNS policy on managed browsers and operating systems
- Block the VPN / Proxy / Anonymizers category for restricted groups
- Decide on block page or silent block per category
- Deploy a trusted certificate if you want HTTPS block pages
- Give users a simple way to report a wrong block
- Review the top blocked domains monthly and adjust
- Keep logs only as long as your privacy policy allows
Tip for MSPs: keep one baseline policy for all clients and layer client-specific allow lists on top. It makes onboarding faster and reporting comparable. The same approach works for multi-tenant platforms of any size.
Common DNS filtering problems and quick fixes
Most tickets after a rollout fall into a handful of patterns. This table helps the help desk answer them without escalating.
| Symptom | Likely cause | What to do |
|---|---|---|
| A business app loads but images or logins fail | The app uses a CDN or login hostname in a blocked category | Check every hostname the app calls in the query log and allow the ones it needs |
| Users see a certificate warning instead of a block page | The block page is served over HTTPS without a trusted certificate | Deploy your own root certificate to managed devices or switch that category to a silent block |
| Policy changes take hours to apply | Devices and forwarders cache old answers | Use short TTLs on block answers and flush local caches after big changes |
| A site is blocked for some users only | Different groups or a device with its own resolver | Check which policy the source address maps to and whether encrypted DNS is on |
| A clearly harmful site is still open | Brand new domain or a page on a shared host | Block newly registered domains for risky groups and add a manual entry while data updates |
| Streaming apps on TVs stop working | Advertising or analytics hostnames blocked that the app requires | Create a device group for TVs with a lighter advertising rule |
Testing: keep a short list of known domains per category and query them from each network segment after every change. A failed test shows a policy or bypass problem before users report it.
DNS filtering terms you will meet
The server that looks up names on behalf of devices and caches the answers. A DNS filter is usually a recursive resolver with a policy engine.
A local DNS server that passes queries upstream, often to a filtering resolver, while serving local names itself.
Response Policy Zone, a standard way to give a resolver a list of names and the answers it should return for them.
Time to live, how long an answer may be cached. Short TTLs on block answers make policy changes take effect sooner.
DNS over HTTPS and DNS over TLS, encrypted transports that protect lookups in transit and can also carry them past a local filter.
Answering a bad name with an address under your control, so you can see which devices tried to reach it.
Rewriting search and video hostnames to their restricted versions so explicit results stay hidden.
Assigning a domain to content categories such as News or Gambling, the data that turns a resolver into a content filter.
Frequently asked questions
What is DNS filtering in simple terms?
It is a way of choosing which websites a device can reach by checking each domain lookup against a policy. Blocked names get no usable answer, so the site never opens.
What is a DNS filter?
A resolver, or a layer in front of one, that applies the policy. It uses a domain category database, a threat feed and your own allow and block lists.
Does DNS filtering work with HTTPS sites?
Yes. The name is requested before encryption starts. What the filter cannot see is the path or content after the domain.
Can users bypass DNS filtering?
They can try with other resolvers, encrypted DNS or VPNs. Force DNS to your resolver, manage encrypted DNS and block the anonymizer category to close those routes.
Is DNS filtering the same as web filtering?
No. DNS filtering decides on the domain. Web filtering sees full URLs where traffic is inspected. Many teams run both on one category database.
Does DNS filtering slow browsing down?
Not noticeably. A local category check takes a fraction of a millisecond and answers are cached. Slowness usually points to a distant or overloaded resolver.
How is your category data licensed?
As downloadable files with a lookup API included, for internal use or embedded in a product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Power your DNS filter with better categories
120 million categorized domains, 59 filtering categories and daily new-domain deltas, delivered as files that run inside your own resolver.