Security topology · 03
DNS Security
Most attacks still begin with a name. DNS Security answers that lookup on the appliance, before a browser, a tunnel, or a malware callback ever receives an address.
Why it is on the topology
Zero Trust Access decides whether a person may connect. DNS Security decides whether a name they ask for is worth resolving. The two controls do not depend on each other: a compromised laptop that never passed ZTA can still be stopped at DNS, and a healthy ZTA user can still be kept off a newly registered or tunneled domain.
FortiGuard DNS filtering and Palo Alto DNS Security sell the same idea as a cloud subscription on top of the firewall. TOORCE runs the decision in the path the branch already uses for resolution: validate signatures, apply threat intelligence, filter categories, detect tunneling and algorithm-generated names, and keep DoH and DoT from walking around the policy.
What the business gets
- Malware and phishing domains fail at the lookup, so the session never starts.
- DNS tunneling and domain-generation patterns are visible as security events, not as mysterious outbound traffic a week later.
- Encrypted DNS (DoH and DoT) can be forced back onto the policy instead of becoming a private resolver.
- Logs sit with the rest of the firewall record, next to the user and the rule that allowed the device onto the network.
How it works
The administrator guide covers the live panels: architecture, DNSSEC validation, threat intelligence, filtering, anti-tunneling, anti-DGA, anomaly protection, DoH/DoT control, and DNS logging. Those pages match the product UI field for field.