Enterprise DNS security: stop threats at the first DNS query

In the region you choose. Your DNS traffic is processed there and your logs are stored there, and personal data does not leave it. Logs are kept for the period in your contract — usually 30, 60 or 90 days. Every customer sits in a separate, isolated space, and we never combine or compare data between customers.

Yes, using the tools you already have — Microsoft Intune, Jamf, Workspace ONE, Windows Group Policy, SCCM, Ansible, Puppet or Chef. The install runs with no prompts and no user involvement: DNS-Armor-Setup.exe /S /API=<api-code>, or drop an API-code.txt file next to the installer. Add /PATH if you want a custom location. Devices appear under Monitoring → Endpoints as they register and pick up your policy automatically.

The on-premises appliance sends three separate streams to your SIEM — firewall events, DNS query logs and portal audit logs. They use CEF, a common security-log format, so Microsoft Sentinel, ArcSight and Elastic read them as they are, and we provide ready-made setup templates for Splunk and QRadar. Send them over TCP, encrypted TLS (port 6514) or RELP rather than plain UDP — longer records can be cut short over UDP without any warning, and a cut-short record will not load.

By watching behaviour rather than checking names against a list. Machine-learning models look at how your DNS traffic actually behaves and flag the patterns that give an attacker away: data being smuggled out inside DNS lookups, malware quietly checking in with its operator, and the throwaway domain names malware generates to avoid being blocked. None of those appear on any blocklist. Each detection carries a confidence score, and your team can approve or reject it to sharpen future results. They appear under Monitoring → AI Threat Detection.

Yes, and it works in both directions. You can pull your existing feeds in over HTTPS, refreshed anywhere from hourly to manually, with sign-in details, timeouts and retries if they are needed. You can also publish DNS Armor™'s own threat, web-filtering and application lists in RPZ — the standard format for sharing them — so your existing DNS servers and security tools can use them.

Yes. The Local Resolver is a virtual machine that runs on VMware ESXi, Hyper-V or KVM. It can either pass queries to our cloud over an encrypted connection, or handle everything itself — filtering, AI detection and your own rules — so queries never leave your premises. Running locally, cached answers come back in under a millisecond. It also supports high availability, time synchronisation, and an Active Directory link so you can see which user made which request.

Through nine roles. A Security Operator can change security policies, rules, exceptions, devices and networks; a Security Analyst sees exactly the same things but cannot change anything. Each person can hold at most one security role, one licensing role and one DNS role, and the system blocks any combination that would undermine separation of duties. Every change is written to an audit log.