DNS filtering is a security control that stops your employees' devices from reaching dangerous or unwanted websites by refusing to look them up in the first place. It is fast to deploy, light on your network, and one of the most cost-effective layers a small or mid-sized business can add. It works best as one layer in a larger security stack, not as a stand-alone fix. Below, we explain how it works, how it compares with web filtering, what to evaluate in any service, and where it fits in a managed IT program.
TL;DR
- DNS filtering checks every website lookup against threat intelligence and your own policy, then allows it or blocks it before a connection is made.
- It differs from web filtering: DNS filtering works at the domain level and is fast, while web filtering inspects traffic in more depth.
- Judge a service on daily operations: roaming-device coverage, policy control, reporting, identity integration and support, not just blocklist size.
- Encrypted DNS can bypass a filter unless you control which resolver devices may use.
- Treat DNS filtering as one layer next to a managed firewall, endpoint protection and identity controls.
Table of Contents
- What DNS filtering is
- What it protects your business from
- DNS filtering vs. web filtering
- What to compare when choosing a DNS filtering service
- The limits you should plan around
- How to roll out DNS filtering without disruption
- Where DNS filtering fits for Wisconsin manufacturers, law offices and dental practices
- Perspective
- Get DNS filtering handled as part of managed IT
- FAQ
- Sources
What DNS filtering is
Every time someone types a web address or clicks a link, their device asks a DNS resolver to translate the name into an IP address. DNS filtering puts a security decision into that step. Cloudflare explains that specially configured resolvers refuse to resolve queries for domains on a blocklist, and that filtering can work by domain name or by IP address.
In practice, the resolver compares the requested domain to threat intelligence, category data and your custom rules. Then one of three things happens:
- The lookup succeeds and the page loads.
- The resolver returns no usable answer and the site never loads.
- The user lands on a block page that explains why.
Because the decision happens before any connection, a malicious site never gets the chance to deliver a payload to the device. IBM notes that when a domain is blocked, the block covers every page in that domain, not just one URL.
The federal government treats this seriously. CISA and the NSA publish guidance on selecting a protective DNS service, which describes a policy-implementing resolver that checks domain queries and returned IP addresses against threat intelligence to prevent connections to known or suspected malicious sites.
What it protects your business from
A business DNS filter earns its keep in a few specific ways:
- Phishing links. An employee clicks a link in a convincing email. If the domain is known or newly flagged as malicious, the page never opens. This pairs well with strong email authentication, which we cover in why email trust metrics matter.
- Malware downloads and callbacks. Infected software often needs to contact a command-and-control server. Blocking that lookup can cut the malware off from its operator.
- Content policy. You can block categories such as gambling, adult content or known file-sharing sites on company devices.
- Visibility. Every allowed and blocked request can be logged, which helps with incident response and with showing auditors that controls exist. Financial firms, law offices and dental practices that need documented safeguards tend to value that log.
If you want to understand why stopping threats before they connect matters so much, this overview of covers the preventive mindset well.
DNS filtering vs. web filtering
People use the terms as if they were the same. They are not.
| DNS filtering | Web filtering | |
|---|---|---|
| Where it acts | At the domain lookup, before connection | On traffic already moving to the browser |
| What it sees | Domains and categories | URLs, content, apps and categories |
| Speed and overhead | Fast and lightweight | Heavier, depending on inspection depth |
| Control | Broad, domain-wide | More granular, page-level |
The comparison above follows IBM's breakdown, which describes DNS filtering as the faster, preventive approach and web filtering as the one with more analytical depth and finer control.
A practical example: with DNS filtering alone, you can block a whole video site, but you cannot allow one channel on it and block the rest. Web filtering can. On the other hand, DNS filtering stops a known-bad domain before any content is downloaded, with almost no performance cost.
For most small and mid-sized organizations, the right answer is both: DNS filtering as the early, cheap first checkpoint, and deeper inspection through a managed firewall for the policies that need page-level detail. Our managed firewall services are built around that layered approach.
What to compare when choosing a DNS filtering service
Blocklist size gets the marketing attention, but your day-to-day experience depends on other things. Whether you are choosing a first service or replacing an enterprise suite that has become too complex or expensive, compare these points.
Coverage for roaming and remote devices
A filter that only protects the office network leaves laptops unprotected at home, in hotels and at job sites. CISA's guidance says deployment flexibility is typically achieved through a lightweight, "roaming" DNS client, and that one policy will rarely fit an entire organization. Ask how the service protects devices off your network and whether you can apply different policies to different groups, such as shop floor, front office and executives.
Simple deployment, and what a deeper one adds
The same CISA guidance notes that the simplest deployment just means pointing your organization's recursive resolver at the provider. More secure deployments add software on the host so protection follows the device. Know which one you are buying and what it takes to maintain.
Policy control and exceptions
Can you build category rules, allow-lists and per-group exceptions without opening a ticket every time someone needs a legitimate site? Overly rigid filtering gets switched off by frustrated staff, which defeats the purpose.
Identity and directory integration
Policies tied to users and groups, rather than only to IP addresses, hold up much better when people work from many locations. This is part of a broader shift we describe in identity-first security for SMBs.
Reporting and logs
You want readable reports for leadership and detailed logs for investigations. If you answer to a regulator, a client's security questionnaire or a cyber insurer, you will want to produce evidence on request.
Multi-site management and support
If you have more than one location, check that policies can be managed centrally. Check also what support looks like when a legitimate site is blocked at 7 a.m. and production is waiting.
Licensing and total cost
Prices vary by vendor and contract. According to Vendr's pricing guidance, the main cost drivers are user count (volume discounts typically begin around 100 to 250 users), contract length, plan tier, and add-ons such as onboarding or professional services. Ask for a price that covers the whole term, including any features you will need later, so the second-year invoice holds no surprises.
A quick scorecard you can use:
| Question | Why it matters |
|---|---|
| Does protection follow laptops off the network? | Most staff work somewhere other than the office at least some of the time |
| Can policies differ by group? | Shop floor and front office need different rules |
| Are logs searchable and exportable? | Needed for incidents, audits and insurers |
| Is there a clear all-in price per user? | Avoids add-on creep |
| Who handles blocked-site requests? | Determines whether staff keep using it |
The limits you should plan around
DNS filtering is strong at what it does, and it has well-understood boundaries. Knowing them is how you get full value from it.
Encrypted DNS. Modern browsers and many applications can send DNS queries in encrypted form straight to an outside provider, skipping your resolver. SecurityToday reports that malware increasingly uses this route and that the countermeasure is to make your resolver the only permitted DNS path and block external encrypted DNS at the firewall. That is a firewall configuration task, which is one reason DNS filtering and firewall management belong together.
Hard-coded addresses. Malware that connects directly to an IP address never performs a lookup, so a DNS filter never sees it. Endpoint detection catches this kind of behavior on the device itself. See our EDR services.
Misuse of allowed sites. Domain-level filtering cannot tell a harmless use of an allowed service from a harmful one. Policy, training and web-layer controls fill that gap.
Unmanaged Wi-Fi and guest devices. A filter only covers devices that use it. Segmenting guest traffic and tightening wireless settings matters; we outline common gaps in five Wi-Fi controls SMBs skip.
CISA and the NSA recommend using protective DNS as part of a layered, defense-in-depth strategy. That is the right frame: a strong first checkpoint, backed by other controls.
How to roll out DNS filtering without disruption
- Inventory your devices and locations. Know which laptops, servers, phones and office networks need coverage, and which users need exceptions.
- Start in monitor mode. Log what would be blocked for a week or two. You will find legitimate tools that need allow-listing before they cause complaints.
- Set baseline blocks. Turn on malware, phishing, command-and-control and newly registered domain categories first. Add content categories after you agree on a written acceptable-use policy.
- Deploy the roaming client. Put it on every managed laptop so protection follows the user.
- Lock down alternatives. Force DNS through your approved resolver and block external encrypted DNS at the firewall.
- Define the exceptions process. Decide who approves unblock requests and how fast. A one-hour turnaround keeps staff on your side.
- Review reports monthly. Look for repeated blocked categories, unusual lookup spikes and devices that generate the most blocks. These are early signs of infection or risky habits.
Where DNS filtering fits for Wisconsin manufacturers, law offices and dental practices
Different organizations lean on this control for different reasons.
- Manufacturers often have machines and shop-floor systems that cannot be allowed to go down. Blocking command-and-control callbacks and phishing domains reduces the odds that a single bad click stops production. The filter also gives you a log of what the network is reaching.
- Law offices handle confidential client files and increasingly face security questionnaires from clients. A filter with logging supports your written safeguards.
- Dental and medical practices run a mix of workstations, imaging systems and guest Wi-Fi. Separate policies for each group keep protection tight without breaking clinical tools.
- Financial firms need documentation. Reports from a DNS filter, combined with firewall and endpoint records, help show auditors what controls exist and that they operate continuously.
If you are unsure where your gaps are, the Free IT Risk Score is a 60-second way to start.
Perspective
We think about DNS filtering the way we think about most security controls: it should be standard, not an upgrade you have to negotiate for.
Too many small businesses are sold security in tiers, with the useful pieces sitting behind a higher price. We take the opposite view. Every client gets the same fully loaded stack at a fixed cost per user, so protective layers like DNS filtering, firewall management, endpoint protection and monitoring are part of how we run your infrastructure, not line items that appear later.
What matters most is that someone owns the details. A filter that is installed but never tuned, never paired with firewall rules that stop encrypted DNS bypass, and never reviewed will not do much for you. Proactive ownership means we configure it, watch it around the clock, handle the blocked-site requests and show you what the reports mean in plain language.
We work with small and mid-sized organizations across West Bend and Southeastern Wisconsin, including manufacturers that cannot afford downtime and firms that need documentation for auditors. In our experience, those owners do not want another tool to babysit. They want IT that works as dependable infrastructure and shows up when it is needed.
Dustin Collett
Get DNS filtering handled as part of managed IT
If you would rather not research, deploy and tune this yourself, we manage it for you as part of our managed IT services: fixed cost per user, 24/7 monitoring, proactive support and security management included, with local people who know your environment.
The best starting point is our IT & Security Assessment. We review how your network, devices and accounts are set up today, show you where DNS-level and other protections are missing, and give you a documented plan. If your team already has IT staff and needs backup, our co-managed IT services add our tools and expertise alongside them. For a broader view of what we cover, see our cybersecurity solutions.
FAQ
What is DNS filtering in simple terms?
It is a checkpoint on website lookups. Before a device connects to a site, the DNS resolver checks the domain against threat intelligence and your rules, then allows or blocks it. A blocked site never loads, which stops many phishing and malware attempts early.
Is DNS filtering the same as web filtering?
No. DNS filtering decides at the domain level before a connection is made, so it is fast and lightweight. Web filtering inspects traffic and can apply rules to specific URLs, content and apps. Many organizations use both, with DNS filtering as the early layer.
Can employees bypass a DNS filter?
They can if you leave the gap open. Browsers and apps that use encrypted DNS can send queries to an outside provider and skip your resolver. SecurityToday advises making your resolver the only allowed DNS path and blocking external encrypted DNS at the firewall.
Does DNS filtering protect laptops that leave the office?
Only if the service includes coverage for devices off your network. CISA's guidance points to lightweight roaming DNS clients as the way to keep protection working across different environments. Ask any provider how remote laptops are covered before you sign.
Is DNS filtering enough on its own?
No. It is a foundational first layer. CISA and the NSA recommend protective DNS as part of defense in depth, alongside controls such as firewalls, endpoint detection and identity protection.