TechKnowSurge
TechKnowSurge Catalog Videos DNS Filtering
VideoSecurityFree

DNS Filtering

DNS filtering controls web access by intercepting domain name resolution requests and returning a blocked-site address instead of the real destination. It provides an alternative to traditional proxy-based web filtering by acting at the DNS layer before a connection is ever established.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DNS filtering is an approach to web access control that operates at the domain name resolution layer. Every time a device attempts to connect to a website, it first queries a DNS server to translate a human-readable domain name into an IP address. DNS filtering takes advantage of this process by evaluating the request at that point and determining whether the destination is permitted or blocked before any connection to the actual server is made. When a site is flagged as off-limits, the DNS server does not return the real IP address of the requested resource. Instead, it returns the IP address of a local or internal machine configured to display a block notification. The requesting device, unaware that it has been redirected, connects to that machine and receives an access-denied response. This means the filtering is handled entirely through DNS resolution rather than through packet inspection or proxy interception. This approach differs from traditional web filtering, where DNS resolution completes normally and the client receives the correct IP address. In that model, the firewall or proxy intercepts the outbound connection after the IP has already been resolved and blocks it at that stage. DNS filtering acts earlier in the process, making it a lightweight and efficient alternative that requires no deep packet inspection and can be implemented through the existing DNS infrastructure of a network.

What you'll learn

What's covered

DNS Filtering

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Proxy Server
An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
DNS Filtering
A security method that blocks access to malicious or unauthorized domains by intercepting and filtering DNS queries.
DNS Poisoning
An attack that corrupts the DNS cache to redirect users to malicious websites.

Topics

Dns Filtering Domain Name System Web Filtering Network Security Proxy Filtering Content Filtering Networking

Transcript

Filtering with DNS

Another way to do web filtering is through DNS filtering. Web filtering essentially is that we are filtering these different websites going through something like a proxy server to filter those sites. But we also can do it using DNS. So based off of these DNS names, or the IP addresses they translate to, we can do some filtering.

A refresher on DNS

Let's do a quick refresher on domain name system, or DNS. Let's say we jump on this machine right here and we're trying to access a web server that's over on this other side. When we pull up a browser, we're not typing in an IP address, but we do need to have an IP address. Our machine needs to have an IP address to know where to send the request to. It needs to know what the destination IP address is. The packet uses both a source and destination IP address, so it does need to know this IP address.

What we type in is some sort of host record, or host name, or DNS name. We type that in, it gets translated using domain name system, or DNS, and then translates that to an IP address, so that it can send this packet to the proper location.

So we're typing in something like www.techknowdj.com. This is known as the domain part of this. This is the host. And so there's some sort of host record, and that host record specifies the IP address for that host record. So we type this in and it gets translated to this IP address.

In order to do this, we need a DNS server. Often, if it's a home network, this is our firewall/router. Or maybe if it's a business, maybe we have a separate DNS server. Whatever the case may be, we have some sort of DNS server. So what happens is, if we want to make it to some sort of external resource, it makes this request and says who belongs to www.techknowdj.com, and then this server responds back with, well, this is the IP address of that, that's what you're trying to reach. So this machine then can go out and reach that machine.

How DNS filtering works

So it's pretty easy to set this up as DNS web filtering. All that needs to happen is that this machine requests the IP address of that external resource. This machine can respond back with that IP address if it's acceptable to visit, and then this machine gets to that.

If it's not acceptable to visit, then what does that look like? It could respond back with an IP address that's different. It could even respond back with an IP address of this machine right here. So it responds back with that machine. This machine then reaches out to what it thinks is the server it's trying to reach, and then this machine responds back with, no, access denied, we're not allowing you to get there.

So what DNS web filtering really does is it just translates it to an IP address, not of where you're trying to reach, but instead of a machine that can let you know you're not supposed to be visiting that site.

DNS filtering versus regular web filtering

So let's break down the difference between this DNS filtering and regular web filtering. Let's look at regular web filtering. This machine right here wants to know the IP address of this resource right here, so it makes a request to the DNS server. Let's say that this is the DNS server. It gets an IP address back of this machine out here in the web, and so then it reaches out to communicate with that IP address. The filtering in this case is maybe happening on the firewall. The firewall responds and says no, you're not allowed to make it there. So that's regular web filtering right there.

Versus DNS web filtering, where it makes a request for an IP address, and rather than giving it the IP address of the actual resource, it gives it the IP address of the local machine. And now it reaches out to the local machine for that website, in which it responds back and says, no, you're not allowed to make it to that site.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →