How phishing attacks use domains
A phishing attack usually starts with a message: an email about an unpaid invoice, a text about a parcel, a chat message with a shared document. The link leads to a page that imitates a real service such as a bank, a cloud storage provider or a company login portal. When the victim enters a password or card number, the attacker collects it.
To look credible, attackers use domains that resemble the real thing. They swap letters, add words such as "secure" or "login", use a different top-level domain, or use characters from other alphabets that look identical on screen. They also abuse free hosting and compromised websites. Every one of these pages still needs a DNS lookup before the browser can display it.
What phishing protection blocks
With phishing protection enabled, FirewallDNS compares every lookup against continuously updated phishing intelligence. [VERIFY: list sources] Matching domains receive a blocked answer, and the browser shows a connection error instead of the fake page.
- Known credential-harvesting pages and fake login portals
- Lookalike and typosquatted domains that imitate well-known brands [VERIFY: lookalike detection is part of the phishing list]
- Domains used for scam shops and payment fraud [VERIFY]
- Phishing kits hosted on compromised websites when the hostname is listed
Why DNS is a good place to stop phishing
Email filters catch many phishing messages, but not all of them, and links also arrive through text messages, social media and chat apps that the email filter never sees. Browser warnings help, but only in browsers that support them and only after the page is requested. A DNS firewall covers every app and every device on the network in the same way, regardless of how the link arrived.
It also works when the user is in a hurry. Security awareness training teaches people to check the address bar, but on a phone at the end of a long day that check is easy to skip. Blocking at DNS removes the decision from the user entirely for every domain that is already known to be malicious.
Combine with newly registered domain filtering
Phishing domains have short lives. Many are registered, used for a campaign lasting hours or days, and abandoned before they appear on public blocklists. That is the gap newly registered domain filtering closes. By blocking domains younger than a set number of days, FirewallDNS stops a large share of fresh phishing infrastructure before any list knows about it. We recommend running both protections together.
What phishing protection cannot do
DNS filtering cannot see the content of a page, so it cannot detect a phishing form placed on a legitimate, widely used domain such as a large file-sharing service. It also cannot stop a user from typing a password into a phone call or a reply email. Multi-factor authentication, ideally phishing-resistant methods such as security keys, remains the best defence against stolen passwords being misused.
Think of phishing protection as a safety net that catches a large number of attacks automatically, not as a replacement for authentication controls and training.
A practical rollout plan
Turn on phishing protection together with newly registered domain blocking on day one. During the first week, check the query log daily for blocked domains and confirm they are not business tools. Tell your users that some suspicious links will now fail to load, and ask them to report anything legitimate that is blocked. After that, most organisations rarely need to adjust anything.
If you run phishing simulations, add the simulation provider's domains to your allowlist before a campaign so the test results stay meaningful.
Phishing protection for every app
Links arrive in email, SMS, WhatsApp, Teams, Slack, social media and QR codes. Because DNS filtering happens before any connection, it treats all of these the same way. A QR code on a fake parking sign is blocked just like a link in an email, as long as the device uses FirewallDNS.
Reviewing blocked phishing attempts
Every blocked phishing lookup appears in the query log with the time and the domain. A spike of blocks for the same domain often means a phishing campaign is targeting your organisation. That information is useful: you can warn colleagues, search mailboxes for the original message and report the sender to your email provider.