A closed resolver
FirewallDNS is not an open public resolver. It only answers DNS queries from IP addresses that customers have registered in their dashboard and ignores all other traffic. This prevents strangers from using the service, reduces the risk of it being abused for amplification attacks and ensures every query belongs to a known customer with their own settings. Rate limits per IP address add further protection. [VERIFY: rate limiting is enforced on production servers]
How DNS queries are processed
When a device on a registered network makes a lookup, the FirewallDNS server checks the domain against the customer's settings: security lists, newly registered domain rules, categories and custom allowlists and blocklists. Allowed queries are resolved through an upstream recursive resolver; blocked queries receive 0.0.0.0 or NXDOMAIN. [VERIFY: upstream resolver software and whether it is operated by FirewallDNS or a third party]
What is logged and for how long
For each query, FirewallDNS records the time, the requested domain, the query type, the registered IP address it came from and whether it was allowed or blocked, including the reason. These records power the query log in the dashboard.
Logs are kept for [VERIFY: retention period, e.g. 30 days] and then deleted automatically. [VERIFY: whether customers can choose a shorter retention period or disable logging] Logs are used to show customers their own activity and to operate and secure the service. We do not sell DNS query data. [VERIFY: confirm no sale or advertising use of query data]
Who can access the data
Each customer can only see data for their own registered network. Access controls in the database enforce this separation, so one customer cannot read another customer's settings or logs. In the MSP model, the MSP administrator manages their customers, while each customer only sees their own data and cost. Internal staff access is limited to what is needed for support and operations. [VERIFY: internal access controls and audit logging]
Server locations
DNS resolvers and the dashboard are hosted in [VERIFY: countries, regions and hosting providers]. Account data and logs are stored in [VERIFY: database location]. Where data is transferred outside the EU or EEA, it is protected by appropriate safeguards as described on our GDPR page. [VERIFY: transfer mechanisms]
Encryption
The dashboard and all account traffic are served over HTTPS. Data stored in the database is encrypted at rest by the hosting provider. [VERIFY: at-rest encryption] DNS queries between your network and FirewallDNS can be encrypted with DNS-over-HTTPS or DNS-over-TLS where supported; classic DNS on port 53 is unencrypted by design. [VERIFY: DoH/DoT availability]
Account security
Passwords are never stored in plain text. [VERIFY: password hashing, two-factor authentication, account lockout after failed login attempts and email verification] We recommend using a unique, strong password for your FirewallDNS account and enabling two-factor authentication where available.
Data processing agreement
Business and MSP customers who process personal data of employees, pupils or end customers through FirewallDNS can request a data processing agreement (DPA). [VERIFY: DPA availability, how to request it, and the list of sub-processors] Contact us to receive a copy. Our privacy policy and GDPR page describe our role, legal bases and your rights in detail.
Infrastructure and operational security
Servers run DNS and web services as non-privileged users, and administrative access is restricted to authorised staff. [VERIFY: non-root services, SSH key policy, firewall rules, patching cadence] Backups of account data are taken regularly and stored separately. [VERIFY: backup frequency, retention and encryption] We monitor the service for availability and abuse, including unusual query volumes from registered IP addresses.
These measures are reviewed as the service grows. We will not claim certifications we do not hold. [FILL IN: any security certifications or independent audits, with dates]
Your responsibilities as a customer
Security is shared. Keep your registered IP address up to date so filtering applies to your network and not to someone else who later receives that address. Protect your account with a strong password. If you monitor employees, pupils or family members through query logs, inform them and follow the laws that apply to you. Our GDPR page describes the roles of controller and processor in more detail.
Reporting a vulnerability
If you believe you have found a security vulnerability in FirewallDNS, please email [FILL IN: security email] with a description and steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to fix it, and do not access or modify other customers' data while testing. [FILL IN: disclosure policy, response timeline and safe harbour statement]