K-Shield DNS
Block dangerous sites before they even connect
K-Shield DNS checks every domain name a device asks for and blocks phishing, malware and command-and-control sites before a single page loads.
The problem
Most attacks start with a link: a fake bank site, a booby-trapped download, a domain created the day before. Blocking name resolution cuts the attack off at its source, whatever the browser or application.
What the module does
Encrypted resolver
Encrypted DNS queries (DoH, DoT), so that no intermediary can read your queries; resolvers intended to be hosted in the EU.
Threat categories
Phishing, malware, command and control, cryptomining; very recent domains and typosquatting of your brands are planned with the threat intelligence pipeline, in progress.
Policies by group
Allow and block lists, content categories and schedules, applied by device group and signed.
Clear block page
Users understand why the site is blocked and can ask their administrator for an exception.
Device mode and network mode
The agent protects the device everywhere; network mode protects a router, modem or firewall with a dedicated token.
Bypass detection
The agent flags a browser's encrypted DNS or a third-party VPN that would bypass the protection.
How it works
The device asks for a name
The agent intercepts the DNS query locally and encrypts it.
The resolver checks
The name is compared against threat lists and your organisation's policy.
Allowed or blocked
The site opens normally, or a block page explains the decision.
What you should know
- The resolver and the console are in a pilot programme; the Windows agent is being finalized, with macOS, Android and iOS to follow.
- DNS filtering does not replace an antivirus: it greatly reduces exposure, but it does not scan files.
- No block rate is announced: it will be measured during the pilot.
Frequently asked questions
Questions about this module
Does DNS filtering slow browsing down?
The target is latency under 30 ms at the 95th percentile in France, measured under load. Frequent answers are cached.
Are my DNS queries recorded?
Businesses have a DNS log with a retention period depending on the offer, which can be anonymised. For individuals, only aggregated statistics are kept.
Can I protect my router or modem?
This is planned: network mode will provide an encrypted DNS endpoint with a token specific to your organization. Per-device guides are written but not yet tested on real hardware.
Practical cybersecurity guides
- Good habitsSecuring your DNS: why and howFiltering blocks some known malicious sites; encryption shields your queries from prying eyes. Explanations and steps for households and small businesses.Read the guide
- Scams and threatsRecognising an IBAN change scamFake supplier, fake CEO, altered bank details: the warning signs of payment fraud, the verification procedure and what to do if you have already paid.Read the guide
- In the workplaceSecuring a remote employee's computerCompany laptop, updates, encryption, Wi-Fi, remote access, separate uses: the checklist for secure remote work in small businesses and SMEs.Read the guide
Want to try this module?
The pilot programme gives you access to modules as they are delivered, free of charge and with no commitment.