DNS protection filters the lookups your devices make, so a request for a known malicious domain gets no answer or a block page. It helps against phishing links, malware downloads and callbacks to attacker servers. It works only when a device uses the filtering resolver, and it never replaces patching, authentication or endpoint controls.
How does it work?
Before a device connects to a website it asks a DNS resolver to turn the name into an address. A protective resolver checks the name against rules built from threat feeds and its own analysis. If the domain is on the list, the resolver refuses to resolve it.
The UK National Cyber Security Centre runs a service of this kind, Protective DNS, and describes it as preventing access to domains known to be malicious by not resolving them. Its stated coverage includes malware, ransomware and spyware sites, phishing and other malicious sites, and malware communication. Blocking that last category matters, because it can contain a machine that is already infected.
What does it not do?
The NCSC is plain about limits, and they apply to any product in this class.
- Scope is narrow. It protects name resolution only. An attacker who connects straight to an IP address, or uses a domain not yet listed, is not stopped.
- Rules are not perfect. The list is reviewed to avoid blocking legitimate sites, but that does not guarantee none are blocked.
- Coverage depends on the device. Laptops that leave the office network need a roaming option or a client that sends lookups to the protective resolver.
- Data is shared. Resolver logs reveal browsing patterns. Check who stores them and for how long.
The NCSC service itself is limited to eligible organizations, so it is an example of the category, not an option open to every company.
Constructed example: the fresh phishing link
A finance employee gets an email linking to a lookalike supplier portal registered two days earlier. If the domain is already on a threat feed, the protective resolver refuses the lookup and the employee sees a block page. If the domain is brand new and unlisted, the lookup succeeds and the page loads. DNS filtering narrowed the odds but did not remove the need for multi factor authentication and user reporting.
Is DNS protection the same as DNSSEC?
No. DNSSEC lets a resolver check that an answer really came from the domain's owner and was not tampered with in transit. Protective DNS decides which names to answer at all. They solve different problems and can be used together.
What should you monitor?
DNS logs are a useful detection source. Watch for devices that make a burst of lookups for random looking names, for lookups of newly registered domains, and for repeated queries at regular intervals, which can indicate a program checking in with a remote controller. Blocked lookups are worth reviewing too: a machine that keeps asking for a blocked domain may already be infected.
Who runs the resolver matters
A filtering resolver sees every name your users look up, so choose the operator as carefully as you would choose any provider that handles sensitive logs. Ask about retention, who can query the data, whether it is used for other purposes and what happens to it if the provider is acquired. If you run your own resolver, apply the same questions to your own staff and logging.
Also decide what a block means for users. A clear block page that tells people what happened and how to report a mistake reduces help desk calls and keeps staff from hunting for workarounds, such as switching to a personal hotspot.
How to check or apply this
- List where your devices get their DNS today: router, office resolver, cloud provider or a public service.
- Choose a filtering resolver and read its policy on what it blocks, what it logs and where.
- Point office networks and managed devices at it, and set it on roaming laptops.
- Block or monitor encrypted DNS settings in browsers that bypass your resolver, if your policy requires central filtering.
- Send resolver logs to wherever you review security events.
- Define a process for unblocking a wrongly blocked site.
- Test with a domain the provider publishes for block testing, if it offers one.
Quick check
Will DNS protection stop all phishing?
No. It blocks listed or recognized domains. A new, unlisted phishing domain can still resolve, so you also need multi factor authentication and mail filtering.
Does it work when staff work from home?
Only if their devices use the filtering resolver. Use a roaming client or device level settings for laptops that leave your network.
Sources
Last reviewed: 18 October 2026.
