Stop threats at the first DNS query.

No — it works alongside them, and it is not trying to do their job. Your firewall protects the traffic that flows through it. DNS Armor Protect™ works one step earlier, at the moment a device looks up a web address, and blocks the dangerous ones before any connection is attempted. It also covers laptops and phones when they are away from the office and never touch your firewall at all. No new hardware, and no changes to your network. Firewalls were also never designed to catch sophisticated DNS tunnelling, where data is drip-fed out inside ordinary-looking lookups over hours or days to stay under the radar. That is exactly the behaviour our models are built to spot.

In the region you choose. Self-service accounts are served from our Frankfurt, Germany service plane, and DNS logs are archived in the region you pick at signup. On the Enterprise track, the service plane and logging plane sit together in the region you choose. Logs are kept for the period in your contract, usually 30, 60 or 90 days. Every customer is held in an isolated tenant, and we never combine or compare data between customers.

Yes, using the tools you already have — Microsoft Intune, Jamf, Workspace ONE, Windows Group Policy, SCCM, Ansible, Puppet or Chef. The install runs silently, with no prompts and no user involvement. Devices appear under Monitoring → Endpoints as they register and pick up your policy automatically.

The on-premises appliance sends three separate streams to your SIEM — firewall events, DNS query logs and portal audit logs. They use CEF, a common security-log format, so Microsoft Sentinel, ArcSight and Elastic read them as they are, and we provide ready-made setup templates for Splunk and QRadar. Send them over TCP, encrypted TLS (port 6514) or RELP rather than plain UDP — longer records can be cut short over UDP without any warning, and a cut-short record will not load.

By watching behaviour rather than checking names against a list. Machine-learning models look at how your DNS traffic actually behaves and flag the patterns that give an attacker away: data being smuggled out inside DNS lookups, malware quietly checking in with its operator, and the throwaway domain names malware generates to avoid being blocked. None of those appear on any blocklist. Each detection carries a confidence score, and your team can approve or reject it to sharpen future results. They appear under Monitoring → AI Threat Detection.

Yes, and it works in both directions. You can pull your existing feeds in over HTTPS, refreshed anywhere from hourly to manually, with sign-in details, timeouts and retries if they are needed. You can also publish DNS Armor™'s own threat, web-filtering and application lists in RPZ — the standard format for sharing them — so your existing DNS servers and security tools can use them.

Yes. The Local Resolver is a virtual machine that runs on VMware ESXi, Hyper-V or KVM. It can either pass queries to our cloud over an encrypted connection, or handle everything itself — filtering, AI detection and your own rules — so queries never leave your premises. Running locally, cached answers come back in under a millisecond. It also supports high availability, time synchronisation, and an Active Directory link so you can see which user made which request.

Through nine roles. A Security Operator can change security policies, rules, exceptions, devices and networks; a Security Analyst sees exactly the same things but cannot change anything. Each person can hold at most one security role, one licensing role and one DNS role, and the system blocks any combination that would undermine separation of duties. Every change is written to an audit log.