What Is Protective DNS? A Practical Explanation

A definition

Protective DNS, often shortened to PDNS, is a DNS resolution service that adds security checks to every lookup. When a device asks for the address of a domain, the protective resolver compares the domain with threat intelligence. If the domain is associated with malware, phishing, command-and-control infrastructure or other malicious activity, the resolver refuses to return the real address. Otherwise it resolves the name normally.

The term is used widely by government cyber security agencies, which have promoted protective DNS as a basic control for public sector organisations and businesses. In everyday use, "protective DNS", "DNS firewall" and "DNS security" describe largely the same idea: using the DNS resolver as a security checkpoint.

Why the idea took off

DNS is involved in almost every connection on the internet. Attackers depend on it to deliver phishing pages, host malware and control infected machines, because domain names are flexible and cheap. At the same time, DNS is a small, well-understood protocol that every organisation already uses. Adding security to the resolver therefore protects nearly every device without changing how people work.

Protective DNS is also inexpensive to run compared with many other security controls, and it produces useful data: a log of which domains devices tried to reach, and which of those attempts were blocked. For agencies trying to raise the baseline of security across many organisations at once, those properties make protective DNS attractive. [VERIFY: cite specific national programmes, e.g. UK NCSC PDNS or US CISA Protective DNS, with links, before publishing]

How protective DNS works step by step

The flow of a protective DNS lookup is simple. A user clicks a link in an email. Their laptop asks the configured resolver for the address of the domain in the link. The protective resolver checks the domain against its threat lists and policy. If the domain is clean, it resolves the name recursively and returns the answer. If the domain is listed as phishing, it returns a blocked response such as 0.0.0.0, NXDOMAIN or the address of a block page. The browser fails to load the malicious site, and the attempt is recorded in the log.

• Device sends a DNS query to the protective resolver
• Resolver checks the domain against threat intelligence and policy
• Clean domains are resolved and returned normally
• Malicious domains receive a blocked answer
• Every decision is logged for review

What protective DNS blocks

The exact coverage depends on the provider and its threat intelligence. Typical categories include domains distributing malware, phishing and credential-harvesting sites, command-and-control servers, domains used by ransomware operators, cryptojacking domains and domains generated algorithmically by malware. Many services also offer optional blocking of newly registered domains, which catches attack infrastructure before it appears on lists.

Protective DNS is security-focused by definition. Content filtering, such as blocking adult content or social media, is a related but separate policy choice. Many services, including FirewallDNS, offer both, and let you enable each independently.

Benefits for organisations

Protective DNS improves security across an organisation with a small, low-risk change. It covers unmanaged and embedded devices that cannot run endpoint software. It works for encrypted traffic without inspecting content. And the logs provide early warning of compromise: a device repeatedly trying to reach command-and-control domains is very likely infected, even if no other tool has noticed.

For organisations with limited security staff, protective DNS is one of the few controls that delivers meaningful protection without ongoing tuning. For larger organisations, its logs are a valuable data source for incident response and threat hunting.

Limitations and common misconceptions

Protective DNS is not a silver bullet. It cannot block threats that do not use DNS, such as malware connecting directly to IP addresses. It cannot see inside allowed connections, so it will not stop a malicious file hosted on a reputable cloud storage domain. It only protects devices that actually use it, which means you must stop devices bypassing it by blocking outbound DNS to other resolvers and managing browser-level encrypted DNS.

Another misconception is that protective DNS replaces antivirus or email filtering. It does not. It adds a layer that catches many threats the other layers miss, and those layers catch threats protective DNS cannot see.

Deploying protective DNS at work

Deployment usually means changing where your network sends DNS queries. In a small office, set the protective resolver on the router or firewall, or in the DHCP settings so clients receive it automatically. In a Windows domain, keep clients pointing at domain controllers and configure the domain controllers to forward external queries to the protective resolver. For laptops that leave the office, consider per-device encrypted DNS or an agent so protection follows the device.

• Set the protective resolver on your edge router, firewall or DHCP server
• In Active Directory, configure DNS forwarders on domain controllers
• Block outbound DNS (port 53 and 853) to any other resolver
• Manage browser DoH settings by policy
• Review the query log during the first weeks and allowlist false positives

Choosing a protective DNS provider

When comparing providers, look at the quality and freshness of threat intelligence, whether newly registered domain blocking is available, how logs are stored and for how long, where servers are located, how false positives are handled, and how the service is priced. For MSPs, multi-customer management and billing matter as well. Ask for a data processing agreement if you will process personal data.

Test before committing. Point one network at the service for a week, watch the query log, and see how often legitimate domains are blocked and how quickly you can fix them.

Protective DNS with FirewallDNS

FirewallDNS is a protective DNS service with optional content filtering. It blocks malware, phishing and newly registered domains, offers adult, gambling and social media categories, and lets you override any decision with your own allowlist and blocklist. It is a closed resolver that only answers registered IP addresses, and each customer sees only their own logs. Pricing is $2.90 per device per month.

Measuring the effect

Once protective DNS is running, measure what it does rather than assuming. Look at the number of blocked security lookups per week, which categories they fall into and which networks or devices generate them. A steady trickle of phishing blocks shows the service catching links that reached users. Clusters of command-and-control blocks from one network point to an infected device. A sudden rise in blocks for newly registered domains can signal a phishing campaign aimed at your organisation.

Share a short summary with management or customers. Protective DNS works silently, so without reporting, few people see its value. Simple numbers from the query log, presented monthly, make the benefit concrete and help justify keeping layered defences in place.

Summary

Protective DNS turns the resolver into a security control. It is cheap, broad and easy to deploy, and it blocks a large share of common attacks before they start. Combine it with firewall rules that stop DNS bypass, endpoint protection and strong authentication, and you have a solid foundation for almost any organisation.