Securing your DNS: why and how
Before every visit to a website, your device queries a directory: the DNS. Choosing a resolver that filters dangerous domains and encrypts queries is one of the simplest protections to put in place.
Kayzen Security editorial team4 min read
DNS in two sentences
When you type a website's name, your computer asks a server called a DNS resolver for the corresponding IP address. By default, this resolver is often your internet service provider's, and the exchanges travel unencrypted.
Because this step comes before any connection, it is an ideal checkpoint: a resolver that knows phishing or malware domains can prevent the connection before it even happens.
What DNS filtering blocks, and what it does not
A filtering resolver compares each requested domain against continuously updated threat lists. If the domain is known to be dangerous, it returns a block response or an explanatory page.
- It blocks: phishing domains that have already been listed, known malware command servers, and the categories you choose (adult content for a household, for example).
- It does not block: a booby-trapped site that has just been created and is not yet on the lists, a malicious file received on a USB stick, or a phone scam.
- It can be bypassed: a savvy user can switch resolvers, unless the device is managed and the setting is locked.
Encrypting queries: DoH and DoT
Two public standards encrypt exchanges with the resolver: DNS over HTTPS (RFC 8484) and DNS over TLS (RFC 7858). On public Wi-Fi, they prevent a third party from seeing which sites you request or from tampering with the responses.
Recent systems (Windows 11, macOS, iOS, Android) and the main browsers can use an encrypted resolver. Be careful: a browser set to its own resolver ignores the filtering configured on the system.
Setting up a protective DNS: the steps
- Household: configure a filtering resolver on your internet box if it allows it, or on each device (the “Private DNS” setting on Android, a configuration profile on iPhone and Mac).
- Small business: prefer a centrally managed solution that applies the same policy to every computer, including away from the office, and reports attempts to bypass it.
- Check the result: a test domain provided by your resolver should be blocked; your usual sites should work normally.
- Document your choice (which resolver, which categories are blocked): in a company, inform employees, as filtering falls under the IT usage policy.
Privacy questions
The resolver sees the list of domains visited. Choose a service that publishes its log retention policy, its location and its subprocessors. In a company, filtering and its logs must comply with employment law and the GDPR: employees informed in advance, limited retention period, restricted access.
Official sources
- ANSSI (new tab) — Agence nationale de la sécurité des systèmes d'information — guides et publications
- IETF (new tab) — RFC 8484 — DNS Queries over HTTPS (DoH)
- IETF (new tab) — RFC 7858 — DNS over Transport Layer Security (DoT)
- CNIL (new tab) — Commission nationale de l'informatique et des libertés
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.