DNS Filtering
Navigation: DNS Security → DNS Filtering
DNS filtering enforces category policy on the queried name. Unlike Web Security, it does not need TLS inspection — the decision is made on the FQDN in the query.
Categories
| Category | Typical use |
|---|---|
| Malware | Overlap with threat intel — keep blocked |
| Phishing | Overlap with threat intel — keep blocked |
| Gambling | Acceptable-use policy |
| Adult | Acceptable-use policy |
| Newly registered domains | Names registered recently (often abused, then abandoned) |
| Dynamic DNS | Consumer DDNS used for C2 and unauthorized remote access |
| Business | Default allow for corporate / productivity names |
You can combine categories in one policy (for example: block malware, adult, gambling, newly registered, and dynamic DNS; allow business).
Allow example:
{
"src_ip": "192.168.1.50",
"domain": "example.com",
"qtype": "A",
"dnssec": "secure",
"category": "business",
"reputation": "clean",
"action": "allow"
}
Recommended starter policy
| Category | Action |
|---|---|
| Malware, phishing | Block |
| Newly registered domains | Block or log |
| Dynamic DNS | Block on corporate LAN |
| Gambling, adult | Block or schedule via a time profile if required |
| Business / uncategorized (clean) | Allow |
Create allow-list exceptions for required vendors that sit in a blocked category (for example a payment processor miscategorized as gambling).
DNS Filtering vs Web Security vs FQDN rules
| Control | Matches on | Needs HTTPS inspection? |
|---|---|---|
| DNS Filtering | Queried FQDN | No |
| Web Security | URL / category after connect | Yes for HTTPS path/host |
| FQDN inline rules | Resolved IPs, refreshed every 60s | No |
Use all three when you need name-level block, URL-level block, and IP-level allow/deny.
Local zones
Do not category-filter internal AD or BIND zones (corp.local, ad.example.com). Mark them as local in Architecture so internal names are not sent to the public rating service.