--- title: "Are protective DNS or DNS filtering services in use?" url: https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services category: "Network, logging and monitoring" canonical_key: q_net_014 evidence_state: partial updated: 2026-08-24 --- # Are protective DNS or DNS filtering services in use? URL: https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services Section: Network, logging and monitoring Evidence state: Partly verifiable from your tenant DNS filtering is one of the cheapest controls that interrupts a real intrusion, because almost everything malicious resolves a name first. ## What the carrier is actually asking The carrier is asking whether name resolution is filtered against malicious and newly registered domains, blocking the lookup before a connection is made. It covers both user browsing and machine-to-machine traffic. ## Why it is underwritten Phishing links, malware downloads, and command and control channels overwhelmingly use domain names. Blocking resolution stops the connection early, works regardless of the application making it, and produces high-quality telemetry. Carriers treat it as an inexpensive control with meaningful effect. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Where DNS filtering is a third-party service it is attested. Azure provides DNS-layer threat detection that is measurable. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | DNS service | Protective DNS provider and enabled categories | Malicious, newly registered, and uncategorised domains blocked. Attested | | Azure | Defender for DNS | Enabled, which detects malicious resolution from Azure resources including data exfiltration over DNS | | Network | Whether clients can bypass the filtering resolver | Outbound DNS to arbitrary resolvers blocked, since a device using a public resolver skips the control entirely | | Endpoint | Encrypted DNS settings in browsers and the operating system | DNS over HTTPS in browsers can bypass network filtering unless managed by policy | | Coverage | Whether remote devices are covered | Roaming clients covered by an agent, since network-based filtering protects only devices on the network | **Encrypted DNS bypasses network filtering** Browsers can resolve names over HTTPS to their own resolver, which walks straight past a filtering DNS server. Unless browser policy disables it or points it at your resolver, your DNS filtering covers less than you think. ## What a defensible yes requires - Filtering covers malicious, newly registered, and uncategorised domains. - Devices cannot use alternative resolvers, including encrypted DNS in browsers. - Remote devices are covered off the corporate network. - Server and machine traffic is covered as well as user browsing. - Blocked queries are logged and reviewed, since they are high-quality intrusion indicators. ## How this answer goes wrong Filtering is deployed on the corporate network and the workforce is largely remote, so the control applies to a fraction of the fleet. Or it is deployed everywhere and browsers use encrypted DNS by default, bypassing it silently. ## If this answer turns out to be wrong Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is this the same as web filtering? Related and distinct. DNS filtering blocks at resolution and covers all protocols; web filtering inspects HTTP traffic and can be more granular. They complement each other and carriers ask about both. ### Does it stop ransomware? It interrupts common stages: the download, the command and control channel, and sometimes exfiltration. It is a layer, not a guarantee. ### What about newly registered domains? Blocking them is one of the highest-value categories, because phishing infrastructure is usually days old. Expect a small number of false positives and an exception path. ### Do we need a paid service? The category is inexpensive and several capable options exist. The cost is rarely the obstacle; coverage of remote devices usually is. ## Related questions - [Is web gateway technology used to monitor and filter malicious or suspicious URLs?](https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls) - [Is IP filtering used to prevent connections from known-malicious addresses?](https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses) - [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation) - [Does the Applicant employ intrusion detection/prevention?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-intrusion-detection-prevention) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.