AI threat detection
Tunnelling, fast-flux and DGA findings per customer and tenant, with CSV export.
Classification pipeline
From domain to decision in five steps.
Each step adds evidence. The final decision follows your policy, not a fixed vendor verdict.
- 01
Domain
The name requested by the device.
Example
x9-update-check[.]top
- 02
Classification
Matched against threat, web and application intelligence.
Example
Malicious
- 03
Threat score
Risk weighted by reputation, age and behaviour.
Example
High (97 / 100)
- 04
Category
The kind of threat or content it represents.
Example
Malware distribution
- 05
Policy
Your rules for this network, user and time of day.
Example
Block
In the portal
What the evidence looks like.
Real screens from the DNS Armor™ portal: detections, discovery and reporting your SOC can act on.
Discovery analytics
Apps, web filters, threats and countries seen in DNS for each tenant.
Reporting
Daily trends and geo views that feed audits and board reporting.
Intelligence
Intelligence that updates itself.
20M+ active indicators.
Scored at resolution time.
AI models watch for tunnelling, DGA and fast-flux behaviour that static lists miss.
AI detection
Catching what lists miss.
Machine-learning and behavioural models watch how DNS traffic behaves, not only which names appear, to surface covert channels that never match a signature.
DNS tunnelling
Data or commands encoded inside query names and responses, detected by pattern and volume.
Data exfiltration
Slow, low-volume leakage through DNS that perimeter firewalls were not built to see.
Domain generation algorithms
Machine-generated names malware uses to find its command-and-control servers.
Fast-flux infrastructure
Rapidly rotating hosting used to keep phishing and malware sites online.
Newly registered domains
Recently created domains, frequently used in phishing campaigns, flagged for policy.
Findings appear under Monitoring → AI Threat Detection in the portal.
Feeds
Bring your own intelligence, and share it.
Response Policy Zones work in both directions, so DNS Armor fits into an existing security stack.
External RPZ feeds
DNS Armor
BIND · Infoblox · third-party resolvers
Built-in feeds
Threat intelligence, web-filtering and application feeds are included with DNS Armor Protect™.
Ingest external RPZ
Subscribe to external RPZ feeds over HTTPS and keep them in sync on a schedule.
Export your own feeds
Publish your feeds in RPZ format for BIND, Infoblox and other third-party resolvers.
Continuously updated, applied instantly.Indicators are updated continuously and take effect at resolution time. There is no signature file to push to endpoints and no client update to wait for: the next lookup uses the latest intelligence.
Threat research
From our research team
AI & emerging threats
Why AI is non-negotiable for DNS tunnelling detection
Read the research
Security strategy
Ransomware's first packet
Read the research
Threat intelligence
Quishing, deepfake lures and LLM-written phishing
Read the research
Buyer's guide
The 12 questions every CISO should ask
Read the guideQuestions about threat intelligence
Does DNS Armor replace my firewall or EDR?
No. It works at a different control point: the moment a name is looked up, before any connection is attempted. It complements perimeter firewalls and endpoint tools, and it also covers roaming devices those tools may not see.
Can I use my own threat feeds?
Yes. DNS Armor Protect™ ingests external RPZ feeds over HTTPS on a sync schedule, and can export your feeds in RPZ format to BIND, Infoblox and other resolvers.
Can I override a block decision?
Yes. Local Rulesets give explicit allow and block decisions, and Cloud Policies can differ by network, user group and schedule.
Where do AI findings go?
They appear under Monitoring → AI Threat Detection in the portal and can be streamed to your SIEM over CEF.
See what DNS Armor finds in your traffic.
Book a walkthrough, or start a free trial and review your own AI findings.