DNS filtering
termsecuritynetworking
Blocking or rewriting DNS answers to stop clients reaching chosen domains.
Because every connection to a named host starts with a lookup, refusing to answer stops the connection before it is attempted - no session to inspect, no port to match, and it works for protocols nobody has written a parser for. The same mechanism is sold as response policy zones, protective DNS, a secure web gateway's DNS layer, and a vendor DNS filter with category ratings.
The control is high-leverage and low-visibility: it applies to every device on a network without an agent, including printers, cameras and visitors' laptops, and it produces almost no evidence of working correctly. Its two failure modes are silent and opposite - a block returned as NXDOMAIN is indistinguishable from a domain that does not exist, so it reads as an outage; and a client using its own resolver is never filtered at all, so the queries that were never seen appear on no report.
Also known as: dns filtering, protective dns, dns security