Every time a device on your network visits a website, it makes a DNS request — translating the domain name into an IP address. DNS filtering intercepts these requests and blocks connections to known malicious domains before any malicious content loads. It's one of the cheapest, highest-impact security controls available.
Key takeaways
- 1Malware command-and-control — domains used by malware to receive instructions and exfiltrate data
- 2Phishing domains — newly registered domains used for credential harvesting pages
- 3Cryptojacking — domains used by browser-based crypto miners
- 4Botnet infrastructure — domains used to coordinate infected device networks
- 5Known malware distribution — domains hosting malicious payloads
Most malware, ransomware, and command-and-control infrastructure relies on domain names. When malware infects an endpoint, it makes a DNS request to reach its command server — to receive instructions, exfiltrate data, or download additional payloads. DNS filtering intercepts that request and blocks it, breaking the malware's ability to operate even if the initial infection succeeded.
Similarly, phishing links — whether in email or sent via SMS — resolve to domain names. DNS filtering blocks connections to known phishing domains before the page loads, preventing credential theft even if a staff member clicks a malicious link.
How DNS Filtering Works
Your devices use DNS resolvers to translate domain names (optimyze.co.nz) into IP addresses. By configuring your network to use a security-aware DNS resolver (Cloudflare Gateway, Cisco Umbrella, or similar), every DNS query from your network is checked against a continuously updated threat intelligence database. Queries for known malicious domains return nothing — the connection is blocked at the DNS layer before TCP/IP traffic is even attempted.
This works for every device on your network — not just managed computers, but also mobile devices, IoT devices, and any device using your Wi-Fi or network connection. It provides a network-level safety net that complements endpoint security.
What DNS Filtering Blocks
- Malware command-and-control — domains used by malware to receive instructions and exfiltrate data
- Phishing domains — newly registered domains used for credential harvesting pages
- Cryptojacking — domains used by browser-based crypto miners
- Botnet infrastructure — domains used to coordinate infected device networks
- Known malware distribution — domains hosting malicious payloads
A Real Example: DNS Filtering Stops Ransomware
In 2022, an Auckland manufacturing business had a laptop infected via a malicious email attachment. The endpoint antivirus missed the payload — it was a new variant not in signature databases. The malware attempted to contact its command-and-control server to download the ransomware payload. The DNS request to the C2 domain was blocked by the business's DNS filtering solution. The malware was stranded — running on the endpoint but unable to receive its ransomware payload. The business's endpoint security eventually flagged the process as suspicious based on its behaviour. The laptop was isolated and remediated. No ransomware deployed, no data encrypted.
Without DNS filtering, the malware would have received its payload within minutes of the initial infection.
Content Filtering as a Bonus
DNS filtering solutions also support content category blocking — preventing access to known gambling sites, adult content, and high-risk categories like newly registered domains (which are disproportionately used for phishing). This provides a productivity and liability benefit alongside the security benefit, without requiring any client software on individual devices.
DNS filtering costs a few dollars per user per month and blocks a category of attacks that most endpoint security misses. For the cost-to-protection ratio, it's one of the most efficient security investments available to small businesses.
