DNS filtering myths are obscuring a low-friction control

At a glance

What this is: CyberFOX says DNS filtering is a low-friction control that blocks connections to malicious domains before other tools see the traffic.

Why it matters: It matters to security and IAM practitioners because stopping access at the name-resolution layer can reduce attack exposure without requiring heavy user-facing controls or replacing existing protections.

By the numbers:

• More than 91% of malware leverages DNS for attacks, according to CISA cited by CyberFOX.

Context

DNS filtering controls whether a device can resolve and reach a destination domain, so it acts before a browser, endpoint agent, or firewall sees a payload. That makes it a prevention layer rather than a detection or cleanup layer, and it is most effective when it is paired with broader network and endpoint controls instead of treated as a standalone answer. The article’s core point is that the control is practical, not dramatic, which is why teams often undervalue it.

For identity and access programmes, the relevance is indirect but real: many malicious sessions begin with a successful connection to an untrusted domain, and blocking that first step can reduce credential theft, malware delivery, and user-driven compromise. The article argues that the main barrier is not technical complexity but a set of myths about redundancy, disruption, and cost. That starting position is typical in organisations that have layered controls but have not made DNS governance explicit.

Key questions

Q: What breaks when DNS filtering is not in place?

A: Without DNS filtering, devices can resolve and reach malicious domains before other controls intervene, which gives phishing sites, malware hosts, and command infrastructure a live path to the endpoint. The usual failure is not total security collapse but more frequent exposure to the first step of compromise, especially when users click before endpoint tools can respond.

Q: Why do malicious domains make DNS filtering a useful prevention control?

A: Malicious domains matter because the connection has to be resolved before the payload can be delivered. Blocking that resolution step can stop many attacks earlier than firewall inspection or antivirus detection, which is why DNS filtering is best understood as early-stage prevention rather than after-the-fact detection.

Q: What are the signs that DNS filtering is too blunt?

A: Frequent help desk tickets, repeated bypass requests, and widespread use of temporary exceptions are strong indicators. Those symptoms usually mean the policy is blocking legitimate work rather than just high-risk destinations, which pushes users toward workarounds.

Q: Should organisations rely on DNS filtering instead of firewalls and antivirus?

A: No. DNS filtering is strongest as an early prevention layer, while firewalls and antivirus address different parts of the attack path. The best result comes from layered controls that reduce exposure at multiple points, not from expecting one mechanism to do everything.

Technical breakdown

Why DNS filtering stops threats earlier than firewalls or antivirus

DNS filtering intercepts requests to resolve domain names before a connection is established. That gives it a different point of enforcement from a firewall, which inspects traffic, or antivirus, which often reacts after a file or payload is present. In practical terms, the control can prevent a device from ever reaching a known malicious host, which removes an entire branch of the attack path rather than just detecting it later. The key operational dependency is timely threat intelligence and policy enforcement at the resolver or endpoint layer.

Practical implication: treat DNS filtering as an upstream prevention control and pair it with endpoint and perimeter detection rather than using it as a substitute.

Why granular policy matters for DNS filtering

Modern DNS filtering is not simply a domain blacklist. It can apply category-based rules, site-specific allowlists, and exceptions for business use cases, which is why it can be deployed without becoming a blunt content block. That matters because most organisations need to restrict high-risk destinations while preserving access to legitimate services that share a category with risky sites. The technical challenge is governance, not mechanics: if the policy model is too coarse, users work around it; if it is too narrow, the control loses coverage.

Practical implication: define category blocks and explicit exceptions centrally so security policy stays enforceable without disrupting approved business traffic.

Why static blocklists decay against new malicious domains

Static DNS blocklists age quickly because adversaries can create and switch to new domains faster than manual curation can keep pace. A list that was accurate yesterday can miss today’s infrastructure, which leaves a gap between threat emergence and policy update. Real-time intelligence closes that gap by continuously updating the blocked destinations and by reducing the chance that teams mistake coverage for freshness. The article’s argument is essentially about maintenance economics: the control is only as useful as the rate at which it learns new malicious infrastructure.

Practical implication: prefer DNS protection that refreshes indicators continuously and review whether your block sources are updated often enough to matter.

Threat narrative

Attacker objective: The attacker wants to reach the victim endpoint through a malicious domain so malware can be delivered or credentials can be harvested.

1. Entry begins when a user or device tries to resolve a malicious domain during phishing, malware delivery, or drive-by browsing.
2. Escalation is prevented when DNS filtering blocks the resolution step, denying the attacker’s infrastructure a live connection path.
3. Impact is reduced because the payload never reaches the endpoint through that domain, limiting malware execution and follow-on compromise.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DNS filtering is an upstream access control, not a cosmetic web filter. The control works because it denies a connection before the rest of the stack has to inspect payloads or react to compromise. That makes it relevant wherever organisations want to reduce exposure without adding user friction. The practitioner conclusion is that DNS policy belongs in the prevention architecture, not in a forgotten corner of network tooling.

The real governance problem is not whether DNS filtering works, but whether policy is maintained with enough precision to stay trustworthy. Static allow and block rules become stale quickly, and coarse category blocking creates pressure for local exceptions. That turns a technical control into a governance exercise around freshness, scope, and exception handling. The practitioner conclusion is that DNS filtering needs ownership, review, and change control like any other access policy.

DNS filtering reveals a named control gap we can call the verification-to-resolution gap. Many teams verify users, devices, and endpoints while leaving the first outbound lookup path under-governed. Malware and phishing often succeed by turning that gap into a live connection. The practitioner conclusion is to treat name resolution as part of the access boundary, especially where user behaviour remains the first compromise vector.

For IAM and NHI teams, DNS filtering is adjacent to credential protection because many identity attacks begin with malicious destination reachability. If users never reach the site, the odds of token theft, fake login capture, or malware-assisted session compromise fall materially. That does not replace identity controls, but it reduces the number of times they are forced to absorb preventable exposure. The practitioner conclusion is to coordinate DNS policy with phishing, browser, and access governance.

What this signals

DNS policy is becoming part of access governance. As more compromise paths begin with a domain lookup, organisations need to treat the resolver path as a control surface, not just a network setting. That shifts ownership from pure infrastructure teams toward security governance and exception management.

Verification-to-resolution gap: the point at which a user or device is trusted enough to operate but not yet prevented from reaching hostile infrastructure. Closing that gap means integrating DNS filtering with phishing defence, browser controls, and identity protection so the first outbound request is no longer an ungoverned step.

For practitioners

• Implement DNS filtering as a prevention layer Place DNS enforcement alongside endpoint and perimeter controls so known malicious domains are blocked before a connection is established.
• Define granular allow and block policies Use category rules and explicit allowlists for business-critical destinations so the control does not become a blunt all-or-nothing filter.
• Replace static blocklists with continuously refreshed intelligence Check that threat feeds update frequently enough to catch newly registered malicious domains and reduce exposure to fast-moving campaigns.
• Document ownership for DNS policy changes Assign a clear owner for exceptions, reviews, and policy updates so filtering does not drift into inconsistent local administration.

Key takeaways

• DNS filtering is valuable because it blocks access to malicious domains before other security tools see the traffic.
• The control is most effective when policy is granular and backed by fresh threat intelligence rather than static blocklists.
• For security teams, DNS filtering should be treated as an upstream prevention layer that complements firewall, antivirus, and identity controls.

Key terms

• DNS Filtering: DNS filtering is a control that blocks, allows, redirects, or reroutes traffic based on domain resolution requests. It reduces exposure to phishing, malware, and unwanted destinations by applying policy at the point where devices attempt to resolve names into reachable internet endpoints.
• Threat Feed: A threat feed is a stream of external or internal indicators, alerts, or intelligence updates that security tools and analysts can consume. Feeds help teams keep detection content current by reflecting newly observed malicious actors, infrastructure, and behaviors. Their value depends on quality, relevance, and integration into the security stack.
• Allowlist: An allowlist is a controlled set of approved origins, methods, or headers that are permitted to interact with a resource. In CORS, it is the practical mechanism that prevents accidental openness while still allowing deliberate cross-origin access when the business need is valid.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to the wider security programme they run every day.