The small business security gap
A small company often has a handful of laptops, a shared printer, a network storage box and a few phones. IT is somebody's side job. Security software may be installed, but nobody watches alerts, and nobody has time to evaluate an enterprise security platform. Meanwhile, a single successful phishing email can lead to a compromised mailbox, a fraudulent invoice or ransomware.
DNS filtering fits this situation well. It requires no agents on each device, it does not need daily attention, and it blocks a broad range of threats automatically.
Threats DNS filtering helps stop
For a typical small business, the most valuable protections are:
- Phishing links in email, chat and text messages that lead to fake login pages
- Malware downloads from compromised or malicious websites
- Command-and-control connections from devices that are already infected
- Brand-new attack domains caught by newly registered domain blocking
- Malicious advertising on otherwise legitimate websites
Fast, low-maintenance deployment
You do not need to touch each computer. Register the office's public IP address in the FirewallDNS dashboard, then change the DNS settings on your firewall, router or DHCP server. If you run Windows Server with Active Directory, point the DNS forwarders at FirewallDNS so domain-joined machines keep resolving internal names while external lookups are filtered. Our guides cover firewalls from Fortinet, Sophos, SonicWall, WatchGuard and others, as well as Windows Server.
Visibility without a security team
The query log gives the person responsible for IT a clear picture. If a member of staff says a site will not load, the log shows whether it was blocked and why, and the allowlist fixes it in seconds. If a device repeatedly tries to reach malware domains, that is a clear signal to investigate it or bring in outside help.
Acceptable use and compliance
Category filters can support an acceptable use policy, for example blocking gambling and adult content on company devices. If you log DNS queries from staff devices, tell employees in your policy that this happens and why. Data protection laws such as the GDPR expect transparency and a clear purpose for monitoring. Our GDPR page explains how FirewallDNS processes data.
Part of a layered defence
DNS filtering is one layer, not the whole picture. Combine it with multi-factor authentication on email and cloud services, automatic updates, endpoint protection, and backups that are tested and stored separately. Together these steps cover the most common ways small businesses are attacked, and DNS filtering is usually the quickest and cheapest of them to deploy.
A one-hour rollout plan
Most small offices can go from sign-up to protection in about an hour. Create your account and register the office's public IP address. Enable malware, phishing and newly registered domain protection. Change the DNS servers on your firewall or DHCP server, or set forwarders on your Windows DNS server. Restart a test laptop and confirm it receives the new settings. Visit a few common sites, then check the query log to see your traffic arriving. Finally, block outbound DNS to other servers on the firewall so devices cannot bypass the filter.
Telling staff about the change
A short message to staff avoids confusion: explain that the company now blocks known dangerous websites, that some suspicious links will fail to load, and who to contact if a legitimate site is blocked. If you log DNS queries, say so and point to your IT policy. Most staff welcome an extra safety net, especially if they have seen colleagues targeted by phishing.
Review the query log weekly for the first month and adjust allowlists as needed.
Cost compared with an incident
A single compromised mailbox can cost far more in lost time than a year of DNS filtering for a small office. That does not mean filtering prevents every incident, but it is an inexpensive way to reduce risk.
Guest Wi-Fi and visitors
Visitors and their devices are a common blind spot. Point the guest network at FirewallDNS too, so that a visitor's infected phone cannot easily reach command-and-control servers through your connection, and so that your internet connection is not used to reach illegal or harmful content. Keep guest and staff networks separate wherever your equipment allows it.
Predictable pricing
FirewallDNS costs $2.90 per device per month. The Business package covers 25 devices for $72.50 per month. If you work with an IT provider, ask them about the MSP package, which lets them manage and invoice your service directly.