Bad domains simply never resolve.
Every connection starts with a DNS lookup. Filter at that layer and phishing sites, malware callbacks and freshly-registered lookalikes die before a single packet of the actual attack is exchanged — on the office network or a kitchen table.
The best security control is the one that works before anything has happened.
EDR fights the malware after it runs. The mail gateway catches the lure at delivery. DNS filtering acts a step earlier than both: the click happens, the lookup is refused, and there is simply nothing at the other end. It cannot carry the defence alone — nothing can — but for its cost it removes more incidents per dollar than anything else we deploy, which is why it goes in on day one.
The lookup is the chokepoint.
What actually gets refused at the resolver, and what each refusal prevents downstream. The categories are dull; the arithmetic is not.
| The lookup | Why it is refused | What never happens |
|---|---|---|
| 01Credential-harvest page | Why it is refusedKnown phishing infrastructure, blocklisted within minutes of discovery | What never happensThe login page never loads; no password to steal |
| 02Domain registered yesterday | Why it is refusedNewly-registered domains are held by policy until they earn reputation | What never happensThe lookalike created for this week’s campaign is dead on arrival |
| 03Malware calling home | Why it is refusedCommand-and-control domains refused, so implants cannot fetch instructions | What never happensPayload runs but cannot detonate — and the block is the alarm |
| 04Typo of a real brand | Why it is refusedCousin-domain and homoglyph detection | What never happensThe fake invoice portal is unreachable |
| 05Laptop on home Wi-Fi | Why it is refusedThe agent enforces the same policy off-network | What never happensProtection does not end at the office door |
| 06DNS-over-HTTPS bypass | Why it is refusedEncrypted resolvers blocked at policy level, lookups pinned to ours | What never happensThe filter cannot be quietly routed around |
The third row deserves attention: a refused callback is also a detection. Several incidents have announced themselves as a DNS block on a machine where EDR then found the implant within minutes. Sectors that lean on this: schools and retail. The related reading is IoT security for Ottawa SMBs and Zero Trust explained.
The ones people actually ask.
If yours isn’t here, ask it directly — you’ll get an answer from an engineer, not a form letter.
Same layer, different job. A router category filter mostly manages productivity. Security DNS filtering is threat-intelligence-driven — feeds updated by the minute, newly-registered-domain policy, bypass resistance, and it follows the laptop home. One is furniture; the other is a control.
Rarely, and exceptions take minutes — a per-site allow with a name and a reason attached, same discipline as a firewall rule. Security categories, not opinion categories: we are not the productivity police unless you ask us to be.
No. Lookups resolve in milliseconds either way, and the resolver infrastructure is anycast — often faster than an ISP default. Nobody has ever noticed it in use; several have noticed its absence.
Managed devices get the agent through Intune, so the policy applies to whatever the device connects through. Unmanaged personal phones are covered only while on your network — which is one of the arguments for managing devices that touch company data.
Because each acts at a different moment: the gateway at delivery, DNS at the click, EDR at execution. Attacks that survive one moment die at the next — and this is the cheapest of the three moments to defend.
Next
Dead on arrival.
Twenty minutes. This is the cheapest layer in the stack — the conversation is mostly about what else the same console gives you.