DNS filtering and secure web gateways
Most attacks reach a user through a web link, and many malware infections call home by looking up a domain name first. DNS filtering and secure web gateways check each lookup or request against reputation data and policy, and block known-bad destinations before a connection is made.
What we do
- Policy design by role and location
- Agent and resolver deployment
- Browser encrypted-DNS handling
- Exception and false-positive handling
- Log forwarding to the SIEM
- Content filtering for schools and guest Wi-Fi
- Review of blocked-request trends
Our team works with Cloudflare Gateway, Cisco Umbrella and DNSFilter for DNS-layer filtering. We deploy them with a small agent or profile on laptops, or by pointing office resolvers at them, and we plan the encrypted DNS settings in browsers so users cannot silently bypass them. Fuller gateways add TLS inspection, file scanning and data loss controls, which we enable only where the customer accepts the privacy and certificate trade-offs.
This group links to our Cybersecurity and Managed IT Services practices. DNS filtering is one layer and does not replace endpoint protection or email security. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Cloudflare Gateway
- Cisco Umbrella
- DNSFilter
- Zscaler Internet Access
Platforms and practices
- DNS-layer malware and phishing blocking
- Category-based web policy
- Roaming agent for laptops
- Encrypted DNS control in browsers
- TLS inspection where appropriate
- Newly registered domain blocking
- Logging and reporting
- School and guest network filtering
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use DNS filtering and secure web gateways for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan users get around DNS filtering?
Some can. A browser that uses its own encrypted DNS (DNS over HTTPS) to another provider bypasses office resolvers, and a laptop away from the office is unprotected without an agent. We set the browser policy, block outbound DNS to unapproved resolvers at the firewall, and deploy a roaming agent or profile so the policy follows the device.
Does DNS filtering inspect encrypted web traffic?
No. DNS filtering decides on the domain name, before a connection is made. A secure web gateway can inspect the content of encrypted traffic only if it decrypts it, which needs a trusted certificate on every device and raises privacy questions for banking and health sites. We enable decryption only where you accept the trade-off, and exempt sensitive categories.
What happens when a legitimate site is blocked?
Users have a documented way to request a review, and we adjust the policy for the site, the group or the category. New domains are one cause, because newly registered domains are often blocked as risky by default, and the setting can be changed to fit your business. Every change is logged with a reason.
Does it help against ransomware?
It helps at some stages. It can block a download from a known malicious site and block malware from contacting its control server. It does not stop an attacker who uses a legitimate service or already has access, so it works alongside endpoint detection, email security and backups.