How is DNS filtering different from a firewall?

A traditional firewall inspects network packets and blocks based on IP addresses, ports, and protocols. DNS filtering operates earlier — it blocks domain name lookups before a connection is attempted. DNS filtering is simpler to deploy and effective against domain-based threats. Firewalls are complementary, handling threats DNS filtering cannot (direct IP connections, protocol-level attacks).

What is the best free DNS filtering service?

Cloudflare 1.1.1.2 and 1.0.0.2 block malware domains free. Quad9 (9.9.9.9) blocks malware and phishing using threat intelligence from multiple security vendors — also free. OpenDNS Family Shield and Home block malware, phishing, and adult content free. For enterprise environments, paid solutions from Cisco Umbrella and Cloudflare Gateway offer more control.

Does DNS filtering slow down internet?

Negligibly. DNS filtering adds one lookup step where the resolver checks the domain against its blocklist — typically microseconds. Performance-focused filtering services like Cloudflare 1.1.1.2 and Quad9 are benchmarked among the fastest resolvers globally despite their filtering. In practice, the speed difference is imperceptible.

Can DNS filtering be bypassed?

Yes, by using an alternative DNS server or connecting via direct IP address. DNS filtering is not a complete security solution — it is one layer among several. Users who know how to bypass it can do so. For consumer protection it is effective; for enforced enterprise environments, additional network controls are needed.

Shield blocking malicious domain request at DNS level before connection is made

Domain Security

What Is DNS Filtering? How It Works and Whether You Need It

Q: What is DNS filtering?

DNS filtering is a security approach that blocks access to known malicious, phishing, or unwanted domains at the DNS resolution level. Instead of returning the real IP address for a blocked domain, the filtering resolver returns an error or a block page. The connection never happens — malware cannot establish contact with command servers, and phishing sites cannot load.

Domain 360 Team

·July 9, 2026·7 min read

DNS filtering is one of the most effective security measures most people have never enabled, despite it being free and requiring about two minutes to set up. It works by blocking connections to known malicious domains before your device ever connects — stopping malware, ransomware, and phishing at the lookup stage.

How DNS Filtering Works

Every website visit starts with a DNS lookup. Your device asks a resolver to translate a domain name to an IP address. A DNS filtering resolver does this lookup with an additional step: it checks the requested domain against a threat intelligence database of known malicious domains.

If the domain is on the blocklist — a known malware command-and-control server, a phishing page mimicking a bank, a domain distributing ransomware — the resolver returns an error or a block page instead of the real IP. Your browser never connects. The malware never phones home. The phishing page never loads.

This happens before your device reaches the malicious server. It does not matter whether you clicked a link in email, on a website, or from an application — if it requires a DNS lookup (almost everything does), filtering can intercept it.

The Free Options

Quad9 (9.9.9.9): Operated by a non-profit using threat intelligence from multiple security vendors including IBM X-Force, CISA, and others. Blocks malware and phishing. Free. Consistently fast. The most comprehensive free filtering option for general users.

Cloudflare 1.1.1.2 / 1.0.0.2: Cloudflare's malware-blocking variant of their standard 1.1.1.1 resolver. Blocks malware domains. Secondary: 1.0.0.2.

Cloudflare 1.1.1.3 / 1.0.0.3: Additionally blocks adult content. Useful for family networks.

OpenDNS Family Shield (208.67.222.123 / 208.67.220.123): Free consumer filtering blocking malware, phishing, and adult content. OpenDNS (now owned by Cisco) is one of the oldest DNS filtering services.

Setting Up DNS Filtering

The process is the same as changing to any DNS server — covered in detail in our DNS server change guide. Replace your DNS server IP with the filtering resolver's address.

For whole-network protection covering every device, set the filtering resolver in your router's DNS settings. Every device connected to the network benefits automatically.

For Android specifically, use Private DNS (Settings, Network and internet, Private DNS) with dns.quad9.net for Quad9 or security.cloudflare-dns.com for Cloudflare's filtering resolver — these use encrypted DNS for additional privacy alongside filtering.

What DNS Filtering Does Not Protect Against

DNS filtering stops domain-based connections. It does not stop:

Direct IP connections. Malware that connects to a server by IP address without a domain name bypasses DNS filtering entirely. This is less common for consumer malware but exists.

Encrypted DNS bypass. A user who knows to set their DNS to an unfiltered resolver can bypass filtering. On managed networks, additional controls are needed.

Already-established connections. DNS filtering prevents new connections to blocked domains but cannot stop malware already running on a device.

Zero-day malicious domains. Blocklists update frequently but cannot block brand-new malicious domains not yet indexed. There is always a window between a new malicious domain appearing and being added to blocklists.

DNS filtering is one security layer, not a complete solution. It works well alongside antivirus software, regular software updates, email filtering, and general security awareness.

DNS Filtering and Domain Ownership

DNS filtering is relevant to domain owners beyond personal protection. A domain that gets listed on DNS filtering blocklists — because it was previously compromised, was used for spam, or has suspicious patterns — may find its legitimate traffic blocked by filtering services.

If you are buying an expired domain, check whether it appears on major blocklists before purchasing. Tools like MXToolbox Blacklist Check and SURBL can surface this. Our guide to buying expired domains covers pre-purchase research in full.

Never lose a domain again

Track every domain you own in one dashboard. Free for up to 15 domains.