How a DNS firewall works
Almost every connection on the internet begins with a DNS lookup. Before a laptop loads a web page, before a phone app syncs and before malware calls home, the device asks a DNS resolver to turn a name such as example.com into an IP address. A DNS firewall sits at exactly that point. It checks the requested name against threat intelligence and your own rules, and if the domain is blocked it answers with 0.0.0.0 or NXDOMAIN instead of the real address. The connection never starts.
Because the decision happens before any traffic flows, a DNS firewall protects every device that uses it, including printers, cameras, televisions and guest devices that cannot run security software. There is nothing to install on the devices themselves. You change the DNS server on your router, firewall or DHCP server, and every client on the network inherits the protection.
Security features
The core of FirewallDNS is security filtering. Malware protection blocks domains used to distribute malicious software and domains used by infected machines to reach command-and-control servers. Phishing protection blocks domains that imitate banks, cloud services and login pages. Newly registered domain filtering blocks domains that are only a few days old, because a large share of attack infrastructure is set up shortly before it is used and has not yet reached any blocklist.
Each protection is a separate switch in the dashboard. You can run them all together, which is what we recommend for most networks, or switch one off if it conflicts with a specific workflow. Each feature page below explains what the filter looks at and what kinds of false positives to expect.
Content and privacy features
Not every unwanted domain is malicious. Parental controls let you block categories such as adult content, gambling and social media. Ad and tracker blocking reduces the number of advertising and analytics domains your devices contact, which also cuts background traffic from smart TVs and apps. Encrypted DNS protects the lookups themselves from being read or changed on the way to the resolver.
These features are about control rather than threat prevention. A family may want strict category filtering on a child's tablet, while an office may only want to block gambling and leave social media open. The settings are yours to choose.
Visibility and control
Filtering is only useful if you can see what it does. Query logs show which domains were requested from your registered IP address, which were allowed and which were blocked, and why. Allowlists and blocklists let you override any decision: allow a business tool that a filter flagged, or block a domain that no list has caught yet.
Together, logs and custom lists form the feedback loop that keeps a DNS firewall accurate. When a user reports that a site will not load, the log tells you whether DNS filtering caused it, and one entry on the allowlist fixes it for the whole network.
What a DNS firewall does not do
A DNS firewall is one layer of defence, not a complete security programme. It does not inspect the content of web pages, it cannot stop a connection made directly to an IP address without a DNS lookup, and it does not replace endpoint protection, patching, backups or user training. Devices that are configured to use a different DNS resolver, or that use their own encrypted DNS, can bypass it unless your network blocks those paths.
We say this plainly because honest expectations lead to better security decisions. Used together with a traditional firewall and good endpoint hygiene, DNS filtering removes a large class of threats cheaply and with almost no impact on users.
Deployment options
Most customers deploy FirewallDNS on the router or firewall at the edge of the network. Organisations running Windows Server point their Active Directory DNS forwarders at FirewallDNS so internal names keep resolving locally. Our setup guides cover more than twenty-five vendors, from enterprise firewalls to home mesh systems.
Choosing which features to enable
For most networks, start with malware protection, phishing protection and newly registered domain filtering switched on. Watch the query log for a week, add allowlist entries for anything legitimate that was caught, and then decide whether you also want category filtering or ad blocking. This gradual approach gives strong protection on day one while keeping surprises for your users to a minimum.