How DNS Filtering Works
Almost every connection on the internet starts with a DNS lookup: the device asks a DNS resolver for the address of a name such as example.com. A DNS filter sits at that resolver and checks the name before it answers.
- A user taps a link or an app tries to reach a domain.
- The device sends a DNS lookup for that domain to the resolver.
- The filter checks the domain against threat intelligence, website categories and the organisation's own allow and block lists.
- If the domain is allowed, the resolver answers as normal and the connection goes ahead.
- If it is blocked, the resolver refuses or redirects the lookup (for example to a block page), so no connection is made.
Because the decision is made before any connection exists, nothing from the blocked site reaches the device.
What DNS Filtering Can Block
- Phishing sites that imitate banks, email providers or company logins
- Malware distribution sites that deliver malicious downloads
- Command-and-control domains that infected devices use to contact attackers (botnet traffic)
- Newly registered or unknown domains, which attackers often use for short-lived campaigns
- Whole categories of content, such as gambling, adult content, streaming or gaming, to enforce an acceptable-use policy
DNS Filtering vs Web Filtering and Firewalls
DNS filtering, web filtering and firewalls overlap, but they work at different points.
| DNS filtering | Web proxy filtering | Firewall | |
|---|---|---|---|
| Decides on | The domain name | The full web address and page content | IP addresses, ports and protocols |
| When | Before the connection | During the connection | During the connection |
| Effect on speed | Very low: one lookup | Traffic passes through the proxy | Depends on the inspection |
| Best for | Blocking malicious and unwanted domains at scale | Fine-grained rules for specific pages | Controlling which systems can talk to each other |
DNS filtering can't see which page on an allowed site someone visits, so it is often combined with other controls. Its strength is that it is simple, fast and covers every app and browser on a device, not just one.
Where DNS Filtering Runs
- On the device, as an app or agent that sends lookups to a filtering service. It needs installing and keeping up to date on every device.
- In the cloud, by pointing a network or device at a filtering resolver. Common for office networks and Wi-Fi.
- In the mobile network, where the operator's own DNS infrastructure applies the filter to every SIM. Nothing is installed on the device.
DNS Filtering for Mobile Devices
Phones and tablets spend most of their time outside the office network, so filters on the office network don't reach them. Device apps can be removed or switched off, and IoT devices often can't run them at all.
Asavie runs DNS filtering inside the mobile operator's network. Operators use it to protect all their subscribers with Asavie Network Security, and businesses use it to filter content on company phones and tablets with Asavie Mobile. Because the service stays with the SIM, users can't switch it off.