Definition and purpose
DNS filtering is a method for controlling DNS lookups—requests that turn a domain name into an IP address. Instead of letting every lookup go to the open internet, a filtering system applies rules (for example, allowlists, blocklists, or category policies) and then permits, blocks, or redirects the resolution result.
The main goal is usually to reduce exposure to unwanted or risky domain names (such as domains known for malware distribution) and to enforce organization or household policies on which domains may be reached.
How it works (simple model)
At a high level, DNS filtering sits between the device and the DNS resolver the device would normally use:
- Your device tries to resolve a domain name (for example, example.com) by sending a DNS query.
- The filtering resolver or gateway intercepts that query.
- The filter checks the domain against configured rules.
- The system responds with an allowed IP, a denied/blocked outcome, or sometimes a redirect-like response (depending on implementation).
Because DNS filtering acts before an IP address is returned, it can prevent follow-up connections from being established using blocked domain names.
What DNS filtering can and can’t do
DNS filtering is specifically about DNS resolution, not direct content inspection. That means:
- It can help prevent access when the application relies on DNS lookups for the domain.
- It does not automatically guarantee that a device is safe, because threats can come through other paths (for example, direct IP connections) or because malicious content could still be reached through allowed domains.
It can also be limited by how DNS traffic is handled in practice. For example, if a device uses an alternate resolver path or a DNS-over-encryption method that the filtering system does not control, the filter may not see the queries it needs to enforce rules.
Differences and common exceptions
DNS filtering is often confused with other kinds of blocking:
- Content filtering / web filtering: focuses on the HTTP/HTTPS layer and may block specific pages or responses after a connection attempt.
- IP blocking / firewall rules: control network traffic by IP address and ports, which is different from filtering by domain name.
- Malware protection on endpoints: detects and removes threats at the device level, which is broader than DNS.
A key exception to keep in mind is that DNS filtering only helps for the DNS lookups it can observe and control. If DNS queries are bypassed or routed around the filtering resolver, the rules won’t be applied to those queries. In that situation, DNS filtering effectiveness can be reduced.
Practical checks you can do
To place DNS filtering in the right mental model, you can verify what DNS resolution your device is actually using and whether the filter can see those queries:
- Check which DNS resolver(s) the device is configured to use (manually or via network settings).
- Observe whether domain lookups are being handled by the expected resolver on your network.
- Test a known blocked vs. allowed domain in a controlled way and confirm the observed behavior is consistent.
Because encrypted DNS and network configuration choices can change what is visible to a filter, treat results as environment-dependent rather than universal. If your setup uses a different resolver path than the filtering system expects, the outcome may differ.