DNS FILTERING – A COMPREHENSIVE GUIDE

There is danger lurking on every corner of the web. How do you protect your team from harmful web content? 

The Internet is a wealth of knowledge and entertainment. But the space home to cute cat videos has a dark side. Malicious cybercriminals hide in plain sight, ready to target the browsing practices of internet users.   At any given moment, 18.5 million websites are infected with malware. The chances of stumbling onto a malicious website or being targeted with one are incredibly high. Protecting a remote or hybrid team in such a threat landscape is increasingly challenging.   A recent survey by Neustar International Security Council (NISC) revealed that 72% of organizations had suffered a DNS-level attack in the last year, such as DNS hijacking, DNS tunneling, or cache poisoning. How can we mitigate such DNS-level threats? This is where DNS filtering comes in. Since you can’t keep a real-time check on your team’s browsing activities in a modern workforce, you need an advanced solution that can do it for you. DNS filtering blocks access to malicious websites and protects web users from the unsavory part of the Internet. If you’re new to DNS filtering, you’re not alone. This blog explores the A-to-Z of DNS filtering.

What is DNS?

Domain Name System (DNS) is often called the “phonebook of the internet.” Just like phonebooks connect names to phone numbers, DNS is the connection between domain names and IP addresses.   Humans recognize and access web information through domain names, like ibm.com or medium.com. On the other hand, web browsers use Internet Protocol (IP) addresses. DNS translates domain names into IP addresses, so browsers can match the IP address of a resource when we type domain names.   Why can’t we directly use IP addresses to access Internet resources? Because IP addresses are complicated. It’s impossible to remember and regularly use complex alphanumeric IP addresses like 2500:cb00:2076:9::c629:d7a2.   The Domain Name System makes our lives easier by making the connection between complex IP addresses and simple domain names. 

How does DNS Work?

There are several elements in the working of the Domain Name System.  

1. DNS resolution 

DNS resolution is converting a domain name into an IP address. While it appears lengthy, the entire interaction takes only a few seconds. The following steps are involved in loading a website: 

1. The user enters the domain name into the search engine.  
2. The user’s device contacts the DNS server and sends a DNS query to request the IP address of that domain.  
3. The DNS resolver checks its cache or queries other DNS servers for the IP address. Once the IP address is obtained, the domain is “resolved.” 

Every basic interaction that happens on the web depends on DNS resolution. Visiting webpages, sending emails, looking at social media pictures – everything depends on DNS resolvers translating human-friendly domain names into computing-friendly IP addresses.

2. DNSSEC (Domain Name System Security Extensions)

DNSSEC makes the system secure by implementing various security improvements. In the 1990s, engineers at the Internet Engineering Task Force (IETF), the organization responsible for technical standards, recognized a lack of authentication in the DNS. DNSSEC was their solution to this problem.   DNSSEC uses public key cryptography to strengthen authentication in DNS using digital signatures. It uses asymmetric cryptography that encrypts and decrypts the DNS communication with different keys.   DNSSEC prevents attackers from exploiting the DNS by intercepting critical communication and finding a loophole to access exploitable information like email addresses.  

3. Recursive vs. Authoritative DNS Servers

Recursive and authoritative servers are both critical components of the DNS infrastructure. Each server performs a different role and occupies a different place in the DNS query pipeline. One way to look at the difference is that recursive servers are placed at the beginning of the DNS query, and authoritative servers are at the end.   The recursive server (or resolver) responds to the request from the client when they enter the domain name. It contacts the authoritative DNS nameserver for the requested IP address. The authoritative nameserver is the one that actually holds DNS resource records. It is placed at the bottom of the DNS lookup chain. When your web browser finally reaches the IP address of the requested domain name, it’s all thanks to authoritative servers.  

4. DNS Server Outage

DNS outage, also called DNS downtime, is when DNS cannot resolve the domain name to its IP address. This happens when the recursive server responds with an outdated IP address from its cache, which does not respond. Another reason for a DNS outage can be if the authoritative server does not respond to the request from the recursive server. DNS downtime occurs due to various reasons. They can be either malicious acts, like DDoS attacks, or general maintenance issues. We’ve spent a lot of time discussing how DNS works, but there’s a reason for that. Imagine not being able to reach your email. Or, what if your customers cannot access your company’s website? The Internet commands 90% of our professional lives, which makes the DNS process absolutely business-critical. While measures like DNSSEC make the query process somewhat secure, most Internet still operates on unsecured DNS servers.   Therefore, you need added security measures like DNS filtering.

What is DNS filtering? 

DNS filtering, or DNS blocking, is a security technique that blocks malicious, harmful, and unwanted domains. It’s a simple process. When a web user tries to access a particular domain, the DNS filtering solution compares the query to a blocklist of unwanted domains. The tool blocks the domain resolution process if a match is found and prevents access to the harmful website.   Without a DNS filtering solution, if someone from your team clicks on a phishing link, they will automatically be redirected to a malicious site. The risk of a malware infection or Ransomware attack increases tenfold. On the other hand, if you use a DNS filtering solution and the domain name is blocklisted, the attack is automatically blocked at the very first step.  

1. How are blocklists/denylists created?

A DNS blocklist is a database of malicious or harmful IP addresses, domains, and hashes. Blocklists are compiled by specialist research groups who constantly observe listed internet resources. If an IP address is involved in malicious activities, like sending spam, spreading malware, hosting botnets, or hosting phishing sites, it is added to the block list. Websites with bad reputations are included in the block list.    

2. DNS filtering by the domain name

Since all DNS queries for resolution pass through recursive DNS servers, many resolvers are specifically integrated with filtering mechanisms. When a query is made for a domain name on the blocklist, the DNS resolver automatically blocks the process and returns an error message.  

3. DNS filtering by IP address

DNS filtering at the network level works by analyzing IP addresses. Security teams configure the DNS server not to resolve queries for blocklisted IP addresses. This method also displays an error message once an IP address is blocked.   DNS filtering by IP address is more challenging than filtering by the domain name. That’s because IP addresses tend to change over time while domain names remain consistent. Maintaining a blocklist of malicious domain names is easier than constantly tracking IP addresses.   

Key features of DNS filtering

DNS filtering solutions comprise various elements. Ideally, look for a DNS filtering solution that gives you access to these features. 

1. Cloud Keys

A cloud key is a bypass code that allows a user to access a blocked page. There can be various reasons IT personnel or system administrators might need to bypass the filter. Cloud keys allow users to proceed to the requested website with full knowledge of the risks involved. 

2. DNS Proxy

DNS proxies are small, locally installed agents that integrate with the Active Directory. They allow internet activity reporting for each user.  

3. On The Go Agents

Qualified DNS filters, like the WebTitan solution managed by ACE, installs Windows-based agents on user devices that enable remote work. Users practice safe browsing even while working from outside the office environment.  

4. Flexible Policies

Different business environments and operations need different policies. Even with a business, different teams need individual browsing policy considerations, depending on their requirements. Top DNS filters should allow you to modify allowlists and blocklists to manage your policies.

Significant use cases for DNS filtering

How does your business benefit from using a DNS filtering solution? The answer lies in understanding the use cases for DNS filtering. Let’s explore the benefits of DNS filtering.

1. Block malware-hosting websites

Malware is the greatest bane of the Internet. DNS filtering is the first line of defense against malware infections. If you can’t open the website that spreads malware, your system doesn’t get infected. Users are often tricked or misdirected to malicious sites and download malware. Once in a device, malware spreads like a forest fire across IT infrastructures. Anti-malware solutions also defend against malware, but they operate in reaction to the presence of malware. DNS filtering provides extra security by blocking the source of malware infection itself.

2. Provide phishing protection

2022 saw a dramatic increase in phishing cases, with over a 52% rise in reported incidents. Attackers trying to scam employees into divulging their login credentials practically sustains the cybercrime industry.   DNS filters recognize legitimate-looking websites for what they truly are – fraudulent and illegitimate. You need DNS filtering to secure your business against advanced phishing attempts and safeguard employees who might fall for social engineering. Suggested reading: What is Phishing Email – Definition & Types of Email Attacks  

3. Enforcing content policies

Businesses want to keep illicit content related to gambling, alcohol, or pornography out of the office environment. DNS filters block such prohibited websites. Many productivity-conscious companies choose to block social media or other entertainment sites.  

Cyber threats blocked by DNS filtering

DNS attacks are among the most destructive cyberattacks. They bring business operations to a grinding halt if not countered immediately. DNS-layer security offers a high degree of protection from the following cyberattacks: 

1. URL hijacking/typo-squatting

Cybercriminals exploit human negligence by buying domain names that resemble respected websites. Common typos in the names of well-known sites are exploited if they look like the target company’s web address. If a client types the wrong URL, they will be taken to a phishing website. This attack tactic is very common in online banking.   A dynamic DNS filter checks the entered URL against a database of known typos to block this exploit.  

2. Spear phishing

Targeted phishing attacks are extremely common. Being research-backed and personalized for the target, spear phishing attacks have a significant success rate. DNS filtering protects targets of spear phishing attacks. Even if the target falls for the phishing attempt and clicks on a malicious link, they will be blocked from accessing any fraudulent website.  

DNS Filtering vs. Web Filtering

DNS filtering is often confused with “web filtering,” so let’s clear that up while we explore DNS filtering.   DNS filtering and web filtering are two types of content filtering mechanisms, but with significant differences. DNS filtering blocks access to blacklisted websites based on DNS queries. On the other hand, web filtering is based on URL restrictions.    Several factors make DNS filtering more efficient than URL filtering.  

• DNS filtering blocks access to websites before they even load. 
• DNS filtering occurs before any content is downloaded, which is better for security.  
• DNS filtering is faster than web filtering. There is negligible latency and page load speeds remain unaffected. 
• DNS filtering is capable of blocking access to websites with encrypted connections (HTTPS).  

While the objective of DNS filtering and web filtering is the same, their performance and use cases differ drastically. You definitely need robust content filtering mechanisms in place to prevent dynamic threats using one solution or the other. 

Do you need DNS filtering if you already have endpoint security?

In a word, yes. Having a top-of-the-line security system but keeping one door open makes the whole system pretty pointless, right?   There is no doubt that endpoint security and next-generation antivirus solutions are an indispensable part of any security posture. But that doesn’t mean you have no need for DNS filtering.    Antivirus solutions detect known viruses once they enter your system. DNS filtering provides a different use case. It blocks end users from accessing resources that might give them viruses in the first place. It’s a proactive defense solution.   Also, an antivirus cannot block content that lacks malicious code but is still inappropriate for work. Your endpoint security solution will not block gambling, porn, or social media websites. A DNS filter will do that.   Many antivirus solutions create latency and lagging. Employees may turn off the antivirus or local firewall on their computers to improve performance. In such cases, the added protection of DNS filtering becomes critical.   Multi-layered security is a necessity in today’s threat landscape. DNS filters are a critical component of a comprehensive security posture.   Suggested Reading: What Is SIEM (Security Information & Event Management)? Why Is It Important?

Top 3 approaches to DNS filtering 

The three most effective and common approaches to integrating DNS filtering are: 

1. Manual DNS filtering 

This approach is best for individuals and smaller businesses which do not have a lot of web users to monitor. Internal IT teams configure basic DNS blocking for websites with bad reputations and known threats.   While manual DNS has a low-cost barrier to entry, it requires internal teams to have highly technical capabilities and a practical understanding of DNS lookups and countermeasures. Finding and recruiting specialized IT talent is hard to find in the current market.   

2. Automated DNS filtering  

Growing businesses prefer DNS filtering solutions with automated capabilities. Automated DNS filtering tools can either be open-source or proprietary. This is most apt for small-to-medium businesses. 

3. Managed DNS filtering

Managed DNS filtering is the best-suited approach for large or rapidly scaling businesses. Managed security service providers (MSSPs) leverage their existing security stack and specialized security expertise to coordinate DNS filtering for clients.   The benefit of working with MSSPs is that they implement, monitor, and maintain the DNS filtering process, along with ensuring overall security health. They evaluate your infrastructure for known and unknown vulnerabilities, implement patches, and provide comprehensive protection.  

What should you look for in a managed DNS filtering solution?

You already know the immense benefits of a DNS filtering solution. If you’re worried about malicious web content (as you should be), it’s high time to invest in a DNS filtering solution. You should ensure the managed DNS filtering solution has the following features: 

1. Round-the-clock monitoring  

Round-the-clock security monitoring and real-time assistance are the most attractive features of partnering with an MSSP. Make sure you don’t miss out on the benefits of a security partner that secures your infrastructure even when your team is offline.   Partner with an MSSP that has a 24/7/365 security operations center  

2. Comprehensive reporting 

Go with a solution that offers advanced analytics and a full-visibility reporting dashboard. Advanced security solutions should provide actionable intelligence and a comprehensive understanding of what’s happening within the internal systems.  

3. Flexible policies 

You should be able to modify DNS filtering policies, content access policies, and blacklists depending on your teams’ requirements.  

4. Real-time updates 

A qualified DNS filter should report newly identified threats immediately to a global database. This ensures maximum coverage against emerging and zero-day threats.  

5. Client support 

The best part of working with an MSSP is that your IT team is not alone. Make sure your security provider offers always-on customer support and open lines of communication.  

6. Customizable pricing 

Tailor-made pricing options and the ability to pay only for what you use ensure you get a solid return on investment. 

7. Scalability 

Your dynamic business grows at a rapid pace. So, ensure your managed DNS filtering solution provider can keep up with fluctuating traffic and growing demand.  

How Does Ace MSS Implement Secure DNS filtering? 

Your search for an effective DNS filtering solution shall end with Ace Managed Security Services. Powered by TitanHQ, Ace managed DNS filtering offers a secure and intuitive browsing experience. Ace’s proactive approach to cybersecurity prevents new-age breach tactics and blocks malware attacks.   Security experts at Ace take the time to understand your needs and current practices. Implementation of the DNS filtering solution is customized according to the client’s current infrastructure and their goals. For instance, if a client requires a common point of filtering for the entire network, Ace experts have a solution for that.   A tenant is created for the client where they simply have to change their primary DNS and secondary DNS address for their machines. This implementation strategy works for clients who have standalone machines, not connected to the Active Directory.   In cases where an Active Directory is involved, the implementation strategy changes. A DNS proxy solution is deployed that redirects internal DNS queries to the Active Directory. The external DNS queries are directed to the TitanHQ cloud. In this way, your current infrastructure remains intact with additional layers of DNS security.   There are also cases where clients want to filter DNS traffic on a per-user base or want to accommodate remote devices. In such cases, Ace’s managed DNS implementation involves four major components: 

• The WebTitan cloud 
• DNS proxy 
• WADA (WebTitan Active Directory Agent) 
• OTG (on-the-go) agent   

Ace Managed DNS Filtering – Secure, Intuitive, Hassle-free

The managed DNS filtering solution by Ace Cloud Hosting protects your business against malicious traffic and restricts harmful websites. Empower the first line of cyber defense with Ace’s advanced managed security solutions. Block malware, filter inappropriate content, and secure BYOD – with unparalleled speed, scalability, and efficiency.  Book a Free Trial Today