How DNS Filtering Protects Businesses from Phishing

Phishing remains one of the most common ways attackers get into an organisation. The lures keep changing: emails that impersonate suppliers, SMS messages about parcels, QR codes on posters and invoices, messages in collaboration tools and fake search ads. But almost every phishing attack has one thing in common. When the victim clicks, scans or taps, their device must look up a domain name before the fake page can load.

DNS filtering uses that moment. It checks the domain before the device connects and refuses to resolve it if it is known or likely to be malicious, so the fake page never appears, whichever channel delivered the link.

A phishing attack, seen through DNS

• Preparation: the attacker registers a domain that imitates a brand or login page, or compromises a legitimate site, and sets up a credential-harvesting page.
• Delivery: the link reaches the victim by email, SMS, QR code, chat message or advertisement.
• The click: the victim's device asks its DNS resolver for the domain's address. This is the moment DNS filtering acts.
• Credential theft: if the lookup succeeds, the fake page loads and the victim may enter their password or payment details.
• Follow-on activity: stolen credentials or a downloaded payload lead to further lookups, for example to command-and-control servers.

How DNS filtering works

With DNS filtering, the organisation's devices send their DNS queries to a protective resolver. For each query, the resolver checks the domain against threat intelligence and the organisation's policy. Safe domains resolve normally. Domains in blocked categories, such as phishing, malware, command-and-control or newly registered domains, are blocked, or the user is redirected to a page that explains why access was stopped.

Because the decision happens at the DNS layer, it protects every application on the device, not only the web browser, and it takes effect before any connection to the attacker's server is opened.

Why DNS filtering is effective against phishing

• It is channel-independent: the same control applies whether the link arrived by email, SMS, QR code, chat or a search ad.
• It acts on new domains: phishing domains are often used within hours of registration, before they appear on many blocklists, so blocking newly registered and low-reputation domains by category closes much of that window.
• It is a safety net: when a lure gets past the email gateway, or a user scans a QR code on a phone, the lookup is still checked.
• It also breaks later stages: if a phishing page delivers malware, that malware's command-and-control lookups can be blocked too.
• It gives evidence: DNS logs show which devices tried to reach a phishing domain, so the security team knows exactly whom to contact and which passwords to reset.

Building the layers

Good DNS filtering combines several sources of judgement rather than relying on a single list:

• Continuously updated threat feeds covering phishing, malware and command-and-control domains.
• Category controls for newly registered domains and other high-risk categories.
• Machine-learning detection for patterns that lists cannot keep up with, such as algorithmically generated domains.
• Your own rules, for example blocking look-alikes of your brand, your suppliers or your sign-in pages, and explicitly allowing business-critical domains.
• External threat intelligence from industry feeds or ISACs, imported in the standard RPZ format.
• A clear block page that tells users why the site was stopped, which turns a blocked click into a teaching moment.

Protection beyond the office

Phishing does not stop at the office door. Laptops on home and hotel networks, and branch sites without local security staff, need the same protection. A practical DNS filtering deployment therefore covers three situations: networks that point their DNS at a cloud service, sites that run a local resolver for speed and internal names, and roaming devices that carry a lightweight agent so their lookups are filtered wherever they connect.

What DNS filtering does not replace

DNS filtering is one strong layer, not the whole defence. Some phishing pages are hosted on large legitimate platforms that cannot be blocked as a whole domain, so email security, browser protections and user awareness still matter. Multi-factor authentication, ideally phishing-resistant, limits the damage when a password is stolen. DNS filtering works best when it reduces how many lures can reach a login page, and the other layers handle the rest.

Stopping phishing with DNS Armor Protect™

DNS Armor Protect™ applies DNS filtering to every user, office and roaming device. Its security policies combine built-in threat feeds for phishing, malware, command-and-control and newly registered domains with web-filter categories, machine-learning detection, your own local rulesets and external RPZ feeds. Blocked lookups can return NXDOMAIN or redirect to a landing page, and the typical block decision takes about 4 ms.

Protection follows the device: cloud-delivered for your networks, on-premises through the Local Resolver appliance, and on Windows, macOS and Linux laptops through the Endpoint Agent. The DNS Monitor and analytics pages show which devices tried to reach phishing domains, and the Logs Connector streams those events to your SIEM for investigation.