Why malware depends on DNS
Modern malware is rarely a single file that does all its damage on its own. A typical infection begins with a small loader delivered through an email attachment, a malicious advert or a compromised website. The loader then reaches out to a server on the internet to fetch the real payload. Once installed, the malware keeps contacting a command-and-control server to receive instructions, upload stolen data or spread to other machines.
Attackers use domain names rather than hard-coded IP addresses because domains are flexible. They can move their servers behind a domain at any time, and they can register many domains to survive takedowns. That flexibility is also a weakness: every one of those steps begins with a DNS lookup that a DNS firewall can refuse.
What FirewallDNS blocks
When malware protection is switched on, FirewallDNS checks every requested domain against threat intelligence lists that identify malware distribution sites and command-and-control infrastructure. Lists are updated automatically. [VERIFY: list sources and update frequency] If the domain matches, the resolver returns 0.0.0.0 or NXDOMAIN and the device never opens a connection.
- Domains that host malicious downloads and exploit kits
- Command-and-control domains used by botnets and remote access trojans
- Domains linked to ransomware staging and data exfiltration
- Cryptomining domains used by malicious scripts [VERIFY: included in malware list]
Stopping infections that already happened
Malware protection is valuable even after a device is infected. If a machine on your network is compromised, its attempts to reach command-and-control servers will show up in the query log as blocked requests. That gives you two things at once: the malware cannot receive instructions or send data out, and you get an early warning that a specific device needs attention.
Repeated blocked lookups to random-looking domain names are a classic sign of a domain generation algorithm, a technique some malware families use to find their control servers. When you see a pattern like that in the log, isolate the device and investigate it with your endpoint tools.
Protecting devices that cannot run antivirus
Endpoint security software covers laptops and servers, but many devices on a modern network cannot run it. Printers, IP cameras, network storage, smart TVs, door controllers and industrial sensors all run small embedded systems that are rarely patched and frequently targeted by botnets. Because FirewallDNS works at the network level, these devices are protected the moment your router or DHCP server hands out the FirewallDNS resolver address.
Limits you should know about
DNS-based malware protection is effective but not absolute. Malware that connects directly to a hard-coded IP address does not need DNS, and a device configured to use a different resolver bypasses the filter. Brand-new malicious domains may not be on any list yet, which is why we recommend combining malware protection with newly registered domain filtering. A DNS firewall also cannot clean an infected machine; it only limits what the malware can do.
For this reason we position malware protection as one layer in a defence-in-depth strategy alongside a traditional firewall, endpoint protection, prompt patching and reliable backups.
Handling false positives
No threat list is perfect. Occasionally a legitimate domain is flagged, often because it shared hosting with something malicious. If that happens, the query log shows which list blocked the request, and you can add the domain to your allowlist in the dashboard. The change applies to every device on your registered network.
Malware protection for MSP customers
For managed service providers, malware protection is often the baseline every customer receives. Blocked malware lookups in a customer's log are a clear, actionable signal that a technician can follow up, and they make the value of the service visible to customers who otherwise never see what was stopped. Each customer only sees their own logs and settings.
Malware protection and remote workers
Network-level protection covers devices while they are on a registered network. Laptops that travel need their own protection on the road, such as endpoint security and, where available, a per-device encrypted DNS address. [VERIFY: per-device DoH/DoT]
How to turn it on
Sign in, register the public IP address of your network, and make sure the malware protection switch is enabled in your settings. Then point your router, firewall or DHCP server at the FirewallDNS resolver addresses. Our setup guides cover more than twenty-five vendors step by step.