DNS filtering for businesses: block phishing and malware before the connection

The short answer: DNS filtering blocks a dangerous domain at the moment the computer asks for its address, before the connection is even established. A click on a phishing link, malware contacting its command server, a fake banking site: everything starts with a DNS query. Filtering it protects every device on the network at once, including printers, cameras and IP phones where no antivirus can be installed. But poorly deployed DNS filtering is easy to bypass: you must enforce the company resolver, control browser encrypted DNS and cover laptops outside the office.

At ALLSAFE SOLUTIONS, we deploy this filtering for businesses in Casablanca and across Morocco, most often with firewalls from our partners Fortinet and WatchGuard, and with Microsoft Defender on endpoints. The capabilities described here come from the vendors’ official documentation.

Why filter DNS

DNS translates a domain name into an IP address. Every website visited, every update, every piece of software that “phones home” starts with a DNS query. It is a mandatory checkpoint, and an excellent place to block.

In their joint information sheet on Protective DNS published in March 2021, the NSA and the US agency CISA explain that protective DNS greatly reduces the effectiveness of ransomware, phishing, botnet and malware campaigns by blocking known malicious domains. They also point out a second, often overlooked benefit: DNS logs support incident response and threat hunting.

In practice, DNS filtering blocks:

• phishing domains that fake emails point to, see our article on the phishing scams targeting SMBs in Morocco;
• command and control servers (C&C) that an infected computer contacts to receive orders or exfiltrate data, a key step in most ransomware attacks;
• newly registered or low-reputation domains, often used by attackers for only a few days;
• categories banned by the IT acceptable use policy: gambling, adult content, illegal downloads, or social networks on some workstations.

What DNS filtering does not do

DNS filtering works at the domain name level. It sees neither the page, nor the downloaded file, nor encrypted content. It therefore has limits you need to know:

DNS filtering…	DNS filtering does not…
Blocks a domain known to be malicious for every device	Block a malicious page hosted on a legitimate domain (cloud storage, compromised site)
Protects agentless devices (printers, cameras, IP phones)	Scan downloaded files or attachments
Is lightweight and does not slow browsing	Prevent a direct connection to an IP address
Provides logs that are useful during an incident	Work if the device uses another resolver

That is why it is added to EDR on endpoints, firewall web filtering and email protection, without replacing them.

Three ways to deploy DNS filtering

1. On the company firewall

This is the simplest option when the business already has a next-generation firewall under subscription.

FortiGate (Fortinet). The FortiOS “DNS filter” profile groups several protections: FortiGuard category filtering, botnet command and control domain blocking (a list continuously updated by FortiGuard, complemented by a botnet IP database), SafeSearch, a static domain filter to allow or block domains, and external block lists. Queries are rated by querying the FortiGuard secure DNS service. Some features require the FortiGuard Web Filtering subscription. An important point: since FortiOS 7.0, a policy in proxy inspection mode can also inspect DNS over TLS (DoT) and DNS over HTTPS (DoH). We cover enabling security profiles in our 10 FortiGate security settings.

WatchGuard Firebox with DNSWatch. DNSWatch is a subscription service: once the licence is added to the Firebox feature key, the Firebox uses DNSWatch as the resolver for protected networks. Blocked and allowed domains are managed in WatchGuard Cloud. A useful feature: a blocked user is redirected to a page that reinforces phishing awareness, turning each block into a training moment. See our WatchGuard Firebox guide for SMBs.

Limit: the firewall only protects devices that go through it. A laptop working from home, on hotel Wi-Fi or on 4G is outside its perimeter.

2. On endpoints

The filtering then follows the device everywhere.

Microsoft Defender for Business and Microsoft 365 Business Premium. Microsoft Defender web content filtering blocks website categories and custom indicators (domains or addresses to block). It relies on SmartScreen for Microsoft Edge and on network protection for other browsers (Chrome, Firefox, Brave, Opera). Microsoft states that network protection must be enabled in block mode for filtering to work across browsers. With Defender for Business, the filtering policy applies to all users. Our article on deploying Microsoft Defender for Business covers the rollout.

WatchGuard DNSWatchGO. WatchGuard describes it as DNS-level filtering that works outside the corporate network without a VPN: the device’s queries are checked against a list of malicious domains and dangerous requests are blocked.

FortiClient. For businesses running FortiGate, the FortiClient agent extends security policies to roaming endpoints, with or without a tunnel. See FortiClient, VPN and ZTNA for remote work.

3. In the cloud

Filtering resolver services such as Cloudflare Gateway (part of Cloudflare One) filter DNS and web traffic from endpoints and sites without local equipment. We present the platform in our article on Cloudflare for businesses. This approach suits multi-site or highly mobile businesses, provided you check where logs are stored, a point to compare with your obligations under Law 09-08.

Which approach to choose?

Situation	Recommended approach
One site, FortiGate or WatchGuard firewall already under subscription	Enable the firewall’s DNS filtering
Many laptops, frequent remote work	Endpoint filtering (Defender, DNSWatchGO, FortiClient) in addition to the firewall
Several sites without a consistent firewall	Cloud filtering resolver
Microsoft 365 Business Premium already in place	Enable Defender web filtering, then complement at the firewall

In most SMBs, we combine two layers: the firewall for everything plugged in at the office, including agentless devices, and the endpoint for laptops that leave.

The real issue: preventing bypass

DNS filtering is only worth something if devices actually use it. Three bypasses are common.

Manually configured public resolvers

A user, or a piece of software, can replace the company DNS with a public resolver. The fix is on the firewall: only allow outbound DNS (port 53) from the internal resolver or the firewall itself, and block the rest. On FortiGate, these queries can also be intercepted and filtered in transit.

Browser encrypted DNS (DoH)

Chrome, Edge and Firefox can send their DNS queries over HTTPS to an external resolver, which escapes traditional filtering. Vendors document how to control it:

• Chrome and Edge: the DnsOverHttpsMode policy accepts off, automatic or secure. In a business, set it to off, or enforce an internal DoH resolver, through Group Policy or Microsoft Intune.
• Firefox: Mozilla provides a “canary domain”, use-application-dns.net. If the company resolver answers that it does not exist, Firefox disables default-on DoH. This signal does not apply to a user who enabled DoH manually: Firefox enterprise policies remain the safer method.
• On the firewall: block public DoH resolver categories or inspect DoH in proxy mode where the device supports it.

Personal VPNs and proxies

A consumer VPN app sends all traffic, DNS included, outside the company. Block it with the firewall’s application control and by preventing software installation without administrator rights.

Deploying DNS filtering in six steps

1. Inventory resolvers: who hands out DNS (DHCP, Active Directory, ISP router) and which devices have a fixed DNS.
2. Centralise: endpoints use the domain controller or the firewall as resolver, which in turn queries the filtering service. Internal Active Directory names must keep resolving.
3. Enable in logging mode for a few days: observe what would be blocked and spot false positives (business tools, hosted software, banks).
4. Switch to blocking: security threats first (phishing, malware, C&C, newly registered domains), then the categories set out in the IT policy.
5. Close bypasses: outbound DNS limited to the internal resolver, DoH controlled, personal VPNs blocked, filtering on roaming endpoints.
6. Use the logs: a computer that keeps trying to reach a command domain is an infected computer. These alerts must reach monitoring, ideally a SIEM.

The most common mistakes

• Enabling filtering on the firewall while endpoints use the ISP router’s DNS.
• Blocking whole categories without an observation phase, then switching everything off after complaints.
• Forgetting laptops, which spend much of their time outside the office.
• Leaving browser DoH enabled, making filtering blind to part of the traffic.
• Never reviewing the logs, even though they often reveal an infection before the antivirus does.
• Testing a rule without thinking about the DNS cache: on FortiGate, Fortinet notes that the cache, enabled by default, can answer with an old result.

How we support businesses

We start with the free initial audit: DNS resolution chain, security subscriptions already available on your firewall or in Microsoft 365, uncovered devices and bypass options. We then enable filtering in observation mode, adjust exceptions with your teams, switch to blocking and close bypasses, in line with your VPN and remote access.

As a Fortinet partner and WatchGuard partner, we supply the required licences, with or without installation. As part of our business cybersecurity in Morocco offer, DNS logs and alerts are followed by 24/7 monitoring, and a critical incident is handled in under 15 minutes. Request your free initial audit: we reply within 24 business hours.